Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
teamviewer_Px-yDq1.exe

Overview

General Information

Sample Name:teamviewer_Px-yDq1.exe
Analysis ID:1333246
MD5:e0cb873b4abc6e0650ebfcf9b7a328ff
SHA1:bacdeece4458ac1ee50cb505bd775588c4616b45
SHA256:3e6dd43ddc4d7f8b25bcfcefa639eb791e837325b92f137f61c1098ea11af0a8
Infos:

Detection

Score:42
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:36
Range:0 - 100

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes many files with high entropy
Writes a notice file (html or txt) to demand a ransom
Uses schtasks.exe or at.exe to add and modify task schedules
Drops certificate files (DER)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
query blbeacon for getting browser version
EXE planting / hijacking vulnerabilities found
Drops files with a non-matching file extension (content does not match file extension)
Adds / modifies Windows certificates
Drops PE files
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Registers a DLL
HTML page contains hidden URLs or javascript code
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Deletes files inside the Windows folder
Contains functionality to shutdown / reboot the system
Creates files inside the system directory
PE file contains sections with non-standard names
Stores large binary data to the registry
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Searches the installation path of Mozilla Firefox
Enables debug privileges
Queries information about the installed CPU (vendor, model number etc)
PE file does not import any functions
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Allocates memory with a write watch (potentially for evading sandboxes)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates or modifies windows services
Queries disk information (often used to detect virtual machines)

Classification

Process Tree

  • System is w10x64
  • teamviewer_Px-yDq1.exe (PID: 7480 cmdline: C:\Users\user\Desktop\teamviewer_Px-yDq1.exe MD5: E0CB873B4ABC6E0650EBFCF9B7A328FF)
    • teamviewer_Px-yDq1.tmp (PID: 7540 cmdline: "C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp" /SL5="$20458,831488,831488,C:\Users\user\Desktop\teamviewer_Px-yDq1.exe" MD5: C2A9A21C0C0BD341958033EA11684FEA)
      • file_Px-yDq1.exe (PID: 7628 cmdline: "C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64 MD5: EE66976DF0A5C903F5A718ABF3E8AC85)
        • file_Px-yDq1.tmp (PID: 7644 cmdline: "C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp" /SL5="$40456,1559708,780800,C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64 MD5: 4AFC5E8740E48A3A9DEF088703BF320F)
          • saBSI.exe (PID: 8072 cmdline: "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: BB7CF61C4E671FF05649BDA83B85FA3D)
            • installer.exe (PID: 3968 cmdline: "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: 58EB889F91B5133D5DB88612CA6E5887)
              • installer.exe (PID: 1524 cmdline: "C:\Program Files\McAfee\Temp3848859477\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: 38F970B5919FA4F8174F559A91003924)
                • sc.exe (PID: 6868 cmdline: sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
                  • conhost.exe (PID: 7008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • regsvr32.exe (PID: 5276 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
                  • regsvr32.exe (PID: 7816 cmdline: /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
                • sc.exe (PID: 2816 cmdline: sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
                  • conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • regsvr32.exe (PID: 4828 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
                • sc.exe (PID: 3416 cmdline: sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
                  • conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                • regsvr32.exe (PID: 2584 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
                  • regsvr32.exe (PID: 2812 cmdline: /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)
                • sc.exe (PID: 1932 cmdline: sc.exe start "McAfee WebAdvisor" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
                • regsvr32.exe (PID: 6264 cmdline: regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)
          • avg_antivirus_free_setup.exe (PID: 8108 cmdline: "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I MD5: 26816AF65F2A3F1C61FB44C682510C97)
            • avg_antivirus_free_online_setup.exe (PID: 8188 cmdline: "C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /ga_clientid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 MD5: 3817B172EA2CEF28D73F746A40F3B275)
              • icarus.exe (PID: 1056 cmdline: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\icarus-info.xml /install /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 MD5: A87978C382EABC0165DB0C7EDC5797B2)
                • icarus.exe (PID: 340 cmdline: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps MD5: 9A20D03282B552AAE11F3EBB5C6FE6EC)
                • icarus.exe (PID: 2052 cmdline: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av MD5: A87978C382EABC0165DB0C7EDC5797B2)
          • teamviewer.exe (PID: 6324 cmdline: "C:\Users\user\Downloads\teamviewer.exe" MD5: D9CC2F111B059473F9AAEA203B42104F)
            • TeamViewer_.exe (PID: 1932 cmdline: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" MD5: 2E185F8A6622BC3062254F6F195ACC81)
              • schtasks.exe (PID: 2840 cmdline: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F MD5: 48C2FE20575769DE916F48EF0676A965)
                • conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • schtasks.exe (PID: 5072 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)
                • conhost.exe (PID: 3784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • conhost.exe (PID: 2524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • chrome.exe (PID: 3704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://download.it/?typ=1 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
            • chrome.exe (PID: 7600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2028,i,935018131516826606,2306456977688268637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)
  • svchost.exe (PID: 7588 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • TeamViewer_.exe (PID: 6460 cmdline: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE MD5: 2E185F8A6622BC3062254F6F195ACC81)
    • schtasks.exe (PID: 6876 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 4948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • servicehost.exe (PID: 5688 cmdline: C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe MD5: 786DA7AE2B6CCFE4A6A15675EE687036)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\is-MAUM5.tmpAvira: detection malicious, Label: PUA/OfferCore.Gen
Multi AV Scanner detection for submitted file
Source: teamviewer_Px-yDq1.exeReversingLabs: Detection: 21%
Source: teamviewer_Px-yDq1.exeVirustotal: Detection: 25%Perma Link
Antivirus / Scanner detection for submitted sample
Source: teamviewer_Px-yDq1.exeAvira: detected
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_dcf90765-d
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpEXE: C:\Users\user\Downloads\teamviewer.exeJump to behavior
Source: https://fbc7e286a76978d9bf8e054d8b69f180.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.htmlHTTP Parser: Base64 decoded: https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAIIoSw63dpr-tKNYCUkano&google_cver=1&google_push=AXcoOmRQiKQKWhuXp8l7VZlOWczaI5f_oOxSHhTrayngN_5BDaCqNQ2v7RTI4FB5KqYGNf0r0t1F_xKj03E8yPkk5IEJkiFm4Cpt
Source: https://fbc7e286a76978d9bf8e054d8b69f180.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.htmlHTTP Parser: No favicon
Source: https://fbc7e286a76978d9bf8e054d8b69f180.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.htmlHTTP Parser: No favicon
Source: https://fbc7e286a76978d9bf8e054d8b69f180.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.htmlHTTP Parser: No favicon
Source: https://securepubads.g.doubleclick.net/static/topics/topics_frame.htmlHTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.htmlHTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframeHTTP Parser: No favicon

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpEXE: C:\Users\user\Downloads\teamviewer.exeJump to behavior
Uses 32bit PE files
Source: teamviewer_Px-yDq1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Found installer window with terms and condition text
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpWindow detected: HYPERLINK "https://cassinilabs.com/privacy-policy/" End User License AgreementHYPERLINK "https://cassinilabs.com/privacy-policy/" Privacy PolicyThis will download TeamViewer to your computer click "Next" to continue.Una soluzione efficace per realizzare...Welcome to TeamViewer Download Manager&NextCancel
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeWindow detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?
Source: C:\Windows\System32\sc.exeWindow detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?
Creates license or readme file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-TW.txt
Creates a directory in C:\Program Files
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\analyticsmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\analyticstelemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\balloon_safe_annotation.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\browserhost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\browserplugin.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\downloadscan.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\eventmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_complete.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_failed.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_laptop.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jquery-1.9.0.min.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\l10n.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\logicmodule.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\logicscripts.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\lookupmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\main_close_large.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafeecerts.xml
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-mwb.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-nps.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\resource.dll
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\resourcedll.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\servicehost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\settingmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\taskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\telemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uihost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uimanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uninstaller.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\updater.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-common.css
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-core.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-install.css
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-install.html
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-ui-install.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-utils.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wataskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_check.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_check2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_close.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_close2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_error.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_logo.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_logo2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\webadvisor.ico
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wssdep.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-TW.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-cs-CZ.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-da-DK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-de-DE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-el-GR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-en-US.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-ES.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-MX.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fi-FI.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-CA.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-FR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hr-HR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hu-HU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-it-IT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ja-JP.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ko-KR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nb-NO.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nl-NL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pl-PL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-BR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-PT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ru-RU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sk-SK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sr-Latn-CS.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sv-SE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-tr-TR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-CN.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-TW.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-cs-CZ.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-da-DK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-de-DE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-el-GR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-en-US.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-ES.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-MX.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fi-FI.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-CA.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-FR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hr-HR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hu-HU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-it-IT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ja-JP.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ko-KR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nb-NO.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nl-NL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pl-PL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-BR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-PT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ru-RU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sk-SK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sr-Latn-CS.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sv-SE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-tr-TR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-CN.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\resource.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\uihost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\updater.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\clipboard.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\npshandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\mwbhandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-controller-nps-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\stop-video-alert-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-nps-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-controller-mwb-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-mwb-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wb-rocket-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\browserhost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\aj_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\edge_onboarding.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\miscutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers_selector.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\ss_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\tests_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\type_tag_utils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\usage_calculation.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\affid_monitor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wss.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor_v2.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util_selector.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\yahoo.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.chrome.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.firefox.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\handlers.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\logger.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\postinit.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\priorityqueue.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\triggeracceptor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uiarbitratorhelper.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uihandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uithreadexithandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\reset_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\common_utils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\allow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow-right.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\packageutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\settingsdb.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\card_bg_image.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\telemetry.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\celebration_white_bg_color.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\green_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\icn_mshield.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\installer_background.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\jquery-1.9.0.min.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close_icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dialog-balloon-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\loading-spinner.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_ss.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_wa.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\main_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_sideloaded_ext_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-lg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\keep_changes_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\logomark_white.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafeeicon.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-wa-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\open_sideloaded_ext_alert_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_0.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\minimize.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_3.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\msac.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_ext_on_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_on.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_1_3.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\spinner_large.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-checklist.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-woman.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-common.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-bg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-core.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-window.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-dialog.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-uninstall-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-utils.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_increase_bg_left.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_error.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg_v2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_good.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_downchevron.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_exclamation.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_red.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_questionmark.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_yellow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_timer.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop-features.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\edge_search_events.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon-selected.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\amazon_upsell_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\checklisthandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\chrome_extension_push_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\cryptojack-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\ext_install_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\facebook.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-noxup.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-warningbackground.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new_tab_main_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\overlay_ui_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\securesearchhandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon-selected.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_off.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_on.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\toast_impact_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\twitter.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\upsell_toast_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-risk.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-status.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-controller-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dwtoast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-options.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast-bing.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-danger.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-risk.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-wss.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\warning-icon-toast.png
Creates install or setup log file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\RollbackTemp\TV15Install.log
PE / OLE file has a valid certificate
Source: teamviewer_Px-yDq1.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: teamviewer_Px-yDq1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\linoy\Documents\GitHub\zbShield-Utils-CPP\zbShieldUtils\bin\Release\Helper.pdb source: file_Px-yDq1.tmp, 00000004.00000003.2676688582.0000000007700000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb/ source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb~ source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A17A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3013060276.0000000009160000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 00000008.00000000.2613996083.0000000000A93000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdbU source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A17A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000000.2635641082.00000000002D1000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Desktop.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.0000000009366000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: t:\untgz\Joel_plugins_src\dialogsEx\dialogs\Release\dialogsEx.pdb source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdbR source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extractJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00405FFD FindFirstFileA,FindClose,10_2_00405FFD
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,10_2_0040559B
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00402688 FindFirstFileA,10_2_00402688
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,14_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004064C1 FindFirstFileW,FindClose,14_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004027FB FindFirstFileW,14_2_004027FB
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,17_2_0040596F
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004064C1 FindFirstFileW,FindClose,17_2_004064C1
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004027FB FindFirstFileW,17_2_004027FB
Source: Joe Sandbox ViewIP Address: 151.101.1.91 151.101.1.91
Source: Joe Sandbox ViewIP Address: 104.20.218.77 104.20.218.77
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s:%d;https=https://%s:%dHTTP/1.0Content-Encodingdeflate
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://alogicalparadox.com)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://beneb.info)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bevry.me
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://bripkens.de
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797109613.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.0000000005639000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2796704373.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.00000000055F7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2785087894.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794591087.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2801637523.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795678446.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012549380.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018061519.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA40
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039AB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817847934.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816970742.000000000551B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039AB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797109613.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2796704373.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.00000000055F7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2785087894.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005244000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794591087.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2801637523.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795678446.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2809037081.0000000005559000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cert.ssl.com/DTNT-Intermediate-codeSigning-RSA-4096-R2.cer0Q
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://client.teamviewer.com/intro/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%DSorry.
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://client.teamviewer.com/shutdown/index.aspx?lng=en
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://client.teamviewer.com/whatsnew/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%&insiderbuild=%5%
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx#
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx%
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx4
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxC
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx_
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxd
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxh
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxv
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnx.conceptsheartranch.com/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://connect.teamviewer.com/v15Hhttp://www.teamviewer.com/download/version_15x/TeamViewer_Host_Set
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/.
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2818055839.0000000005259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000016.00000003.3038352991.0000025064C47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797109613.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.0000000005639000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2796704373.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.00000000055F7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2785087894.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794591087.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2801637523.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795678446.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012549380.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018061519.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039AB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817847934.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816970742.000000000551B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000028.00000003.3203643425.000001BD69E98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012549380.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018061519.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/DTNT-Intermediate-codeSigning-RSA-4096-R2.crl0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crl0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.0000000002498000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://dl.jalecdn.com/IT/teamviewer.exe
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A03000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dl.jalecdn.com/IT/teamviewer.exession
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dojofoundation.org/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclid
Source: svchost.exe, 0000000C.00000003.2675738308.000001FA99070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gajus.com/)
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gf.tools.avast.com/tools/gf/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hdl.handle.net/1895.22/1013
Source: avg_antivirus_free_setup.exe, 00000008.00000000.2613996083.0000000000A93000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://https://:allow_fallback/installer.exe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://insertafter.com/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://j.mp/1stW47C)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.com/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jryans.mit-license.org/)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kael.me/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://knockoutjs.com/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathiasbynens.be/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-a1.iavs9x.u.avast.com/iavs9x/avast_one_essential_setup_online.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-free.iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: teamviewer.exe, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000000.2659158723.0000000000409000.00000008.00000001.01000000.00000014.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000000.2659158723.0000000000409000.00000008.00000001.01000000.00000014.sdmp, TeamViewer_.exe, 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012549380.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018061519.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039AB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797109613.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2796704373.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.00000000055F7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2785087894.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005244000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794591087.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2801637523.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795678446.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2809037081.0000000005559000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797109613.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.0000000005639000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2796704373.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794967526.00000000055F7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2785087894.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2794591087.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2801637523.000000000555A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795678446.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039AB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817847934.0000000005559000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005245000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816970742.000000000551B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2818055839.0000000005259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000016.00000003.3038352991.0000025064C47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsps.ssl.com0
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.org/licenses/MIT
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://push.ff.avast.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFL
Source: saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/
Source: saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/%
Source: saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2818055839.0000000005259000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000016.00000003.3038352991.0000025064C47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcb.com/sf.crt0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcd.com0&
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://spdx.org/licenses/MIT.html
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/MD/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/PD/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tanyabrassie.com/
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://underscorejs.org/
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636272034.0000000005352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.c#
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636272034.0000000005352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.00000000052F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/F
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052F1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi3
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636272034.0000000005352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/s
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2618953946.00000000052FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgigo
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgimK
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/WTUI
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/wtu.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0).
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com0/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.boost.org/users/license.html).
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cisl.ucar.edu/css/software/fftpack5/ftpk.html
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cnri.reston.va.us)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cwi.nl)
Source: file_Px-yDq1.tmp, 00000004.00000003.2632326153.0000000006A25000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.00000000039A7000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000003.2684888158.0000000002965000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012549380.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3007408873.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3018061519.00000000071B0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2330819607.00000000022D2000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2206928989.0000000002640000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2327153898.00000000023CA000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2211964267.0000000003490000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2938002592.00000000009A8000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dk-soft.org/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A17A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dns-sd.org/ServiceTypes.html
Source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fdos.org/win32/nsis.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gnu.org/licenses/lgpl.html
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/Y%
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/collect
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/collect8
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/m%
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/v
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com:80/collect/K
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.hiddentao.com/)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iport.it/)
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2795883067.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817657804.00000000054B1000.00000004.00000020.00020000.00000000.sdmp, servicehost.exe, 00000028.00000003.3203643425.000001BD69E98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mcafee.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pythonlabs.com/logos.html
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exe
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewer_Setup.exe
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/favicon.ico
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=103286
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=130291
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=141508
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=144319
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=148325
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=181342
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=190014
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=233248
Source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=271351
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=271351$Pridae
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=301635
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=301635SAko
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=301635TAk
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=308980
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=362946
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=364893
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=413309
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=441415
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=456463
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=456463qSkripte
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=475051
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=517756
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=522447
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=526914
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=539523
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=563890
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=591924
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=613217
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=632515
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=633113
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=649250
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=649250y
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=659842
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=666256
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=696517
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=703800
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=720679gPrihl
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=720679hPrijavljivanje
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=740465
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=801210gVo
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=801210jUdaljeni
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=861823
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=861823gAby
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=866109
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=874259
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=891850&Bezpe
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=8918503Sigurnosna
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=899369
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=907878
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=922587
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=934954=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=934954=Zahtev
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=942683
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=954698
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=964412
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.teamviewer.com/link/?url=999999
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDlltimeZoneUTCdateStyletimeStyle
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%1%.teamviewer.com/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%1%.teamviewer.com/%2%
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/fluentui-assets-license
Source: TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/privacy
Source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/privacy)
Source: TeamViewer_.exe, 0000000E.00000003.2774555313.0000000006DF0000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2773919924.0000000006E20000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2707582225.0000000006D00000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2709142306.0000000006D00000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmp, TeamViewer_.exe, 0000000E.00000003.2709675152.0000000006D00000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2709510226.0000000006D00000.00000004.00000800.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.2709413153.0000000006D00000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/privacy.
Source: TeamViewer_.exe, 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpString found in binary or memory: https://aka.ms/privacy.Error:
Source: TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/privacy.TeamViewer
Source: saBSI.exe, 00000007.00000003.2630778342.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/0
Source: saBSI.exe, 00000007.00000003.2630778342.00000000008B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2754817251.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653464283.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2654552819.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.0000000003439000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.000000000343C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2837060472.0000000003436000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653675194.0000000003445000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/2508bd75
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.000000000343C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25Z
Source: avg_antivirus_free_online_setup.exe, 00000009.00000000.2635641082.00000000002D1000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25installSending
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bitbucket.org/jpommier/pffft/src/master/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bloatware.ff.avast.com/avast/ss/
Source: file_Px-yDq1.tmp, 00000004.00000002.2916879904.000000000018F000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://cassinilabs.com/privacy-pol
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A64000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cassinilabs.com/privacy-policy/
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cassinilabs.com/privacy-policy/ent=true&oc=
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-download.avastbrowser.com/avg_secure_browser_setup.exe
Source: file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A11000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.download.it/gen/teamviewer-100x100.png
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/third_party/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/libyuv/libyuv/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://client.teamviewer.com/blizzintro/?language=%1%&os=%2%&client=%3%
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cloudstorageintegration-rc.teamviewer.com/v1/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cloudstorageintegration.teamviewer.com/v1/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/English/kb/articles/108794-system-requirements-for-teamviewer-engag
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/English/kb/articles/108883-supported-operating-systems-for-assist-a
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/English/kb/articles/109112-system-requirements-for-teamviewer-class
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/English/kb/articles/23610-which-platforms-operating-systems-are-sup
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/English/kb/articles/4047-which-operating-systems-are-supported-for-
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/108794-systemvoraussetzungen-fuer-teamviewer-eng
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/109112-systemanforderungen-fuer-teamviewer-klass
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/23610-which-platforms-operating-systems-are-supp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/24141-unterstuetzte-betriebssysteme
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/26239-welche-betriebssysteme-werden-fuer-teamvie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/4047-welche-betriebssysteme-werden-fuer-remote-m
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/German/kb/articles/45796-unterstuetzte-betriebssysteme-fuer-teamvie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/t5/Knowledge-Base-EN/Which-operating-systems-are-supported/ta-p/241
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz$Radnja
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz)Platnose
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/t5/Meeting-Knowledge-Base-EN/Which-operating-systems-are-supported-
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.teamviewer.com/t5/Pilot-Knowledge-Base-EN/Which-operating-systems-are-supported-fo
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.0000000009366000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://configdl.teamviewer.com/configs/https://configdl.teamviewer.com/rev/https://configdl-test.te
Source: file_Px-yDq1.exe, 00000003.00000003.2938002592.0000000000A0E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003B1C000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003C02000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://control.kochava.com/v1/cpi/click?campaign_id=kohotspot-shield-2oo5a3058127822662&network_id=
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: file_Px-yDq1.exe, 00000003.00000003.2938002592.0000000000A0E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003B1C000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2717260823.00000000075A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f
Source: file_Px-yDq1.exe, 00000003.00000003.2938002592.0000000000A0E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003BEB000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003B1C000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/
Source: file_Px-yDq1.tmp, 00000004.00000003.2328204707.00000000038F0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612840162.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605804435.0000000003997000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2930309403.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG/images/09052021/EN.png
Source: file_Px-yDq1.tmp, 00000004.00000003.2612840162.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.0000000003998000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG/images/09052021/EN.pngg
Source: file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG/images/09052021/EN.pnggw
Source: file_Px-yDq1.tmp, 00000004.00000003.2736808171.0000000002411000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG_AV/files/1319/avg.zip
Source: file_Px-yDq1.tmp, 00000004.00000002.2930309403.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.zi
Source: file_Px-yDq1.tmp, 00000004.00000003.2612840162.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.0000000003998000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.ziG
Source: file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/AVG_AV/files/1319/avg.zipngi
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/files/1248/saBSI.zipBC0F0
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/files/1248/saBSI.zipBC0F0i
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/files/1248/saBSI.zipd2
Source: file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/files/1248/saBSI.zipmentR
Source: file_Px-yDq1.tmp, 00000004.00000003.2612840162.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611841459.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2605804435.0000000003997000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2930309403.0000000003998000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/images/943/EN.png
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/images/943/EN.png&
Source: file_Px-yDq1.tmp, 00000004.00000003.2605804435.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/f/WebAdvisor/images/943/EN.pngQ
Source: file_Px-yDq1.exe, 00000003.00000003.2938002592.0000000000A0E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003B1C000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2717260823.00000000075B1000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/o
Source: file_Px-yDq1.exe, 00000003.00000003.2938002592.0000000000A0E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2269728287.0000000002510000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003C2E000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003B1C000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2611553890.0000000006E09000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2280244937.00000000035A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d1i3c1dyhuowa7.cloudfront.net/zbd
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2330819607.0000000002339000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2206928989.0000000002640000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2327153898.000000000244C000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2327153898.00000000023CA000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2326410390.0000000000888000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2211964267.0000000003490000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.000000000378B000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d2nko69k18f2wb.cloudfront.net/installer/737209/825485955765064
Source: teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d2nko69k18f2wb.cloudfront.net/installer/737209/825485955765064.
Source: teamviewer_Px-yDq1.tmp, 00000002.00000002.2327153898.0000000002440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d2nko69k18f2wb.cloudfront.net/installer/737209/825485955765064fString;
Source: teamviewer_Px-yDq1.tmp, 00000002.00000002.2326410390.0000000000888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d2nko69k18f2wb.cloudfront.net/installer/737209/825485955765064gnZ
Source: teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d2nko69k18f2wb.cloudfront.net/x
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentDuringSession?token=%1%&lng=%2%&version=%3%&o
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dl.teamviewer.com/docs/en/TeamViewer-Software-Lifecycle-Policy-en.pdf
Source: file_Px-yDq1.tmp, 00000004.00000002.2933998010.0000000006E05000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2930309403.000000000399D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684434182.0000000003944000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933998010.0000000006E19000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933998010.0000000006E09000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928228731.0000000003905000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928478644.000000000394C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1
Source: file_Px-yDq1.tmp, 00000004.00000003.2661913851.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2930309403.00000000039BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=10$%
Source: file_Px-yDq1.tmp, 00000004.00000002.2930309403.000000000399D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=13
Source: file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928228731.0000000003905000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=14
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=19
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1A
Source: file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928228731.0000000003905000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1L
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1Q
Source: file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928228731.0000000003905000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1X
Source: file_Px-yDq1.tmp, 00000004.00000003.2661913851.00000000039BD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2930309403.00000000039BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1h%
Source: file_Px-yDq1.tmp, 00000004.00000002.2933998010.0000000006E05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1l:
Source: file_Px-yDq1.tmp, 00000004.00000002.2933998010.0000000006E05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it/?typ=1l~
Source: file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2925623111.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2717260823.00000000075CB000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it?typ=1
Source: file_Px-yDq1.tmp, 00000004.00000003.2717260823.00000000075CB000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://download.it?typ=1s
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it?typ=1t
Source: file_Px-yDq1.tmp, 00000004.00000002.2933510991.0000000006DD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.it?typ=1y
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feedbackservice-test.teamviewer.com
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feedbackservice-test.teamviewer.com/?source=TvClient&type=InSessionDashboard
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feedbackservice.teamviewer.com
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feedbackservice.teamviewer.com/?source=TvClient&type=InSessionDashboard
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://feedbackservice.teamviewer.com/upload/index8https://feedbackservice-test.teamviewer.com/uplo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://frontlinedocs.teamviewer.com/en/solutionoverview
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://frontlinedocs.teamviewer.com/en/solutionoverview/system_requirements
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://frontlinedocs.teamviewer.com/solutionoverview
Source: svchost.exe, 0000000C.00000003.2675738308.000001FA990CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.2675738308.000001FA99070000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://get.teamviewer.com/v15/%1%vYou
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://get.teamviewer.com/v15/%2%
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://getpilot.teamviewer.com/%1%
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://getpilot.teamviewer.com/%2%
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://git.coolaj86.com/coolaj86/atob.js.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://git.tukaani.org/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/7rulnik/source-map-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/A11yance/aria-query
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/A11yance/axobject-query
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/AriaMinaei/RenderKid
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/AriaMinaei/dom-converter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/AriaMinaei/pretty-error
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/AriaMinaei/utila
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/BerkeleyTrue/warning
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChALkeR/safer-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/CoderPuppy/os-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/DanielRuf/html-minifier-terser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/DefinitelyTyped/DefinitelyTyped
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/DirtyHairy/microevent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/DirtyHairy/worker-rpc
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/EventSource/eventsource
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/FB55/domutils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ForbesLindesay/acorn-globals
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ForbesLindesay/throat
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Gamote/lottie-react
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChrome/web-vitals
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/native-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Gozala/events
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Gozala/querystring
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/IonicaBizau/regex-parser.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/JedWatson/classnames
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/JsCommunity/make-error
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KingSora/OverlayScrollbars
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/LinusU/buffer-from
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MattDiMu/postcss-replace-overflow-wrap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Microsoft/TypeScript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Microsoft/tslib
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Microsoft/tslib.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MikeMcl/big.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MikeMcl/decimal.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/NMFR/last-call-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/NMFR/optimize-css-assets-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/NV/CSSOM
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Qix-/color
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Qix-/color-convert
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Qix-/color-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Raynos/duplexer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Raynos/function-bind
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Raynos/xtend
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ReneNyffenegger/cpp-base64
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/estree-walker
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/estree-walker/graphs/contributors)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/is-reference.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/sourcemap-codec
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/svg-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rich-Harris/svg-parser/tree/v2.0.4#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Richienb/char-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/at-least-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/react-grid-layout
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SamVerschueren/decode-uri-component
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Sebmaster/tr46.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Semigradsky/postcss-attribute-case-insensitive
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SergiusTheBest/exceptxx
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ShiqiYu/libfacedetection
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Siilwyn/css-declaration-sorter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/SimenB/collect-v8-coverage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TehShrike/deepmerge
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Tjatse/ansi-html
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/file-uri-to-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-agent-base
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-bindings
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-http-proxy-agent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-http-proxy-agent/tree/4.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-https-proxy-agent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/node-https-proxy-agent/tree/5.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/once
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ToruNiina/toml11
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TrySound/alphanum-sort
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TrySound/postcss-value-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TrySound/read-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TrySound/rollup-plugin-terser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Two-Screen/stable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Two-Screen/stable/tree/v0.1.8#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TypeStrong/fork-ts-checker-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/TypeStrong/ts-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Urthen/case-sensitive-paths-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebReflection/flatted
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebReflection/html-escaper
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/YuzuJS/setImmediate
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn-bigint.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn-export-ns-from
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn-import-meta.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn-jsx
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/acornjs/acorn.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/adobe/react-spectrum
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/adrianheine/acorn-import-meta
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ai/nanoid
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/airbnb/lottie-web
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ajafff/tsutils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ajv-validator/ajv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ajv-validator/ajv-formats
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/alexei/sprintf.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/alexeyraspopov/picocolors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/alexindigo/asynckit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/amasad/sane
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/amasad/sane/tree/v4.1.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ampproject/remapping
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/anodynos/upath
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/antonk52/lilconfig
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/apideck-libraries/better-ajv-errors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arcanis/jest-pnp-resolver
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arcanis/pnp-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arcanis/pnp-webpack-plugin/tree/v1.6.4#license-mit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arcanis/ts-pnp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arcanis/ts-pnp/tree/v1.2.0#license-mit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ashtuchkin/iconv-lite
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/avajs/find-cache-dir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/avoidwork/filesize.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/axios/axios
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babel
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babel-eslint
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babel-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babel-polyfills
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babel/tree/v6.26.0/packages/babel-plugin-transform-object-rest-spread
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/babylon
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/babel/preset-modules
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bahamas10/css-color-names
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/beatgammit/base64-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bendrucker/builtin-status-codes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bestiejs/punycode.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bevry/domain-browser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bholloway/adjust-sourcemap-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bholloway/resolve-url-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bigstickcarpet/readdir-enhanced
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitinn/node-fetch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/blakeembrey/array-flatten
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/blakeembrey/change-case
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bnjmnt4n/regjsgen
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/boostorg/boost
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brion/yuv-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brion/yuv-buffer/blob/v1.0.0/package.json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/brion/yuv-canvas
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/bripkens/connect-history-api-fallback
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/broofa/mime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/broofa/node-int64
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/broofa/node-mime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/acorn-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/commonjs-assert
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/console-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/detective
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/resolve
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/stream-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserslist/browserslist
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserslist/caniuse-lite
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserslist/update-db
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/c-smile/quickjspp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/minimalistic-assert
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/minimalistic-assert.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/calvinmetcalf/process-nextick-args
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/caolan/async
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cfware/get-package-type
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chaijs/type-detect
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-styles
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/chalk
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/slice-ansi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/strip-ansi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/supports-color
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chartjs/Chart.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cheeriojs/dom-renderer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chenqingspring/react-lottie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chicoxyzzy)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chicoxyzzy/node-releases
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chimurai/http-proxy-middleware
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chrisdickinson/raf
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/clean-css/clean-css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/colorjs/color-name
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/emitter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/escape-html
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/is-module
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/merge-descriptors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/path-to-regexp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/component/toidentifier
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cowboy/node-exit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/creationix)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/creationix/http-parser-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/EVP_BytesToKey
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/browserify-aes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/browserify-cipher
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/browserify-des
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/browserify-rsa
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/browserify-sign
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/buffer-xor
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/cipher-base
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/createECDH
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/createHash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/createHmac
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/crypto-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/diffie-hellman
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/hash-base
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/md5.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/parse-asn1
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/pbkdf2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/publicEncrypt
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/randombytes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/randomfill
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/ripemd160
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/crypto-browserify/sha.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cspotcode/node-source-map-support
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cspotcode/v8-compile-cache-lib
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css-modules/icss-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css-modules/postcss-modules-extract-imports
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css-modules/postcss-modules-local-by-default
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css-modules/postcss-modules-scope
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css-modules/postcss-modules-values
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/css/csso
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cssnano/cssnano
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/css-blank-pseudo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/css-has-pseudo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/css-prefers-color-scheme
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/cssdb
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/normalize.css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/postcss-browser-comments
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/postcss-normalize
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/postcss-plugins
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/postcss-preset-env
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstools/sanitize.css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/csstree/csstree
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/cure53/DOMPurify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/curl/curl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/daaku/nodejs-makeerror
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/daaku/nodejs-tmpl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/daaku/nodejs-walker
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/danethurber/webpack-manifest-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/danez/pirates
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/darsain/remove-trailing-separator
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/davidtheclark/cosmiconfig
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/davisjam/safe-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dcodeIO/long.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dcporter/didyoumean.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/debug-js/debug
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/defunctzombie/node-process/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/defunctzombie/node-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/defunctzombie/node-util
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/demurgos/v8-coverage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dequelabs/axe-core
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/developit/dlv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/developit/dlv/tree/1.1.3#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/devongovett/browserify-zlib
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dfcreative/color-name
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/digitalbazaar/forge
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dividab/tsconfig-paths
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dmnd/dedent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/domenic/path-is-inside
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/indexes-of
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/doowb/ansi-colors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dougwilson/nodejs-depd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dperini/nwsapi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/drac94/react-auth-code-input
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dropbox/nn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/dvtng/react-loading-skeleton
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eemeli/yaml
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ehmicky/human-signals
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/electerious/nice-try
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ember-cli/capture-exit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ember-cli/capture-exit/blob/v2.0.0/package.json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/enquirer/enquirer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/epoberezkin/ajv-errors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/epoberezkin/ajv-keywords
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/epoberezkin/fast-deep-equal
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/epoberezkin/fast-json-stable-stringify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/epoberezkin/json-schema-traverse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Array.prototype.flat
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Array.prototype.flatMap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Array.prototype.reduce
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Array.prototype.toSorted
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Function.prototype.name
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Object.entries
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Object.fromEntries
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Object.hasOwn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/Object.values
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/RegExp.prototype.flags
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/String.prototype.matchAll
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/String.prototype.trimEnd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/String.prototype.trimStart
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/array-includes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/object-is
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es-shims/object.getownpropertydescriptors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es128/glob-parent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/es128/path-dirname
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/doctrine
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint-scope
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslint-visitor-keys
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/eslintrc
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eslint/espree
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/escodegen
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/esquery
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/esrecurse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/esrecurse/tree/v4.3.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/estraverse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/estools/esutils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/evanw/node-source-map-support
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/eventualbuddha/lines-and-columns
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/body-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/compression
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/express
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/serve-index
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/expressjs/serve-static
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/create-react-app
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/jest
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/prop-types
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/react
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/react)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/regenerator/tree/main/packages/runtime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/regenerator/tree/master/packages/regenerator-runtime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/regenerator/tree/master/packages/transform
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/watchman
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/zstd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/farzher/fuzzysort
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/faye/faye-websocket-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/faye/websocket-driver-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/faye/websocket-extensions-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/boolbase
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/css-select
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/css-what
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/domelementtype
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/domhandler
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/domutils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/entities
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/htmlparser2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fb55/nth-check
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/felixge/node-combined-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/felixge/node-delayed-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fengyuanchen/cropperjs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fent/ret.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/ieee754
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/is-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/queue-microtask
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/run-parallel
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/typedarray-to-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fgnass/uniqs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fitzgen/glob-to-regexp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fitzgen/glob-to-regexp/tree/0.3.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fitzgen/glob-to-regexp/tree/0.4.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fkhadra/react-toastify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/floatdrop/pinkie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/floatdrop/pinkie-promise
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/floatdrop/require-from-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/follow-redirects/follow-redirects
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/cubic2quad
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/microbuffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/svg2ttf
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/svgpath
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/ttf2eot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/fontello/ttf2woff
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/form-data/form-data
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/frenic/csstype
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gajus/eslint-plugin-flowtype
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gajus/table
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/garycourt/uri-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/github/fetch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gkz/levn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gkz/optionator
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gkz/prelude-ls
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gkz/type-check
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/glennrp/libpng
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/farmhash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/googlechrome/workbox
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/googlefonts/dm-fonts/tree/main/Sans
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-add-jsx-attribute
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-remove-jsx-attribute
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-remove-jsx-empty-expression
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-replace-jsx-attribute-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-svg-dynamic-title
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-svg-em-dimensions
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-transform-react-native-svg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-plugin-transform-svg-component
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/babel-preset
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/core
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/hast-util-to-babel-ast
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/plugin-jsx
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/plugin-svgo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gregberge/svgr/tree/master/packages/webpack
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/grncdr/merge-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/gulpjs/glob-parent
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/guybedford/cjs-module-lexer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/guybedford/es-module-lexer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hapijs/address
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hapijs/bourne
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hapijs/hoek
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hapijs/joi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hapijs/topo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/henrikjoreteg/html-parse-stringify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/henrikjoreteg/html-parse-stringify/tree/v3.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hiddentao/fast-levenshtein
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/http-party/node-http-proxy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/http-party/node-portfinder
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hughsk/from2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hughsk/is-typedarray
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/humanwhocodes/config-array
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/humanwhocodes/module-importer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/humanwhocodes/object-schema
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/hydiak/a-sync-waterfall
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/i18next/i18next
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/i18next/i18next-browser-languageDetector
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/i18next/i18next-http-backend
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/i18next/i18next-resources-to-backend
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/i18next/react-i18next
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/aproba
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/promise-inflight
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/run-queue
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/unique-filename
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/unique-slug
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/iliakan/detect-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/immerjs/immer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/immutable-js/immutable-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/import-js/eslint-plugin-import
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/asn1.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/bn.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/brorand
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/des.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/des.js/tree/v1.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/elliptic
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/elliptic/tree/v6.5.4#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/handle-thing
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hash.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hash.js/tree/v1.1.7#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hmac-drbg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hmac-drbg/tree/v1.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hpack.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/hpack.js/tree/v2.1.6#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/http-deceiver
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/miller-rabin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/miller-rabin/tree/v4.0.1#miller-rabin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/minimalistic-crypto-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/minimalistic-crypto-utils/tree/v1.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/node-ip
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/node-ip/tree/v1.1.8#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/node-spdy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/offset-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/select-hose
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/select-hose/tree/v2.0.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/indutny/wbuf
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/infusion/Fraction.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inikulin)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inikulin/parse5
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/defined
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/functions-have-names
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/get-symbol-description
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/has-property-descriptors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/has-symbols
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/has-tostringtag
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-arguments
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-bigint
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-boolean-object
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-callable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-core-module
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-date-object
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-negative-zero
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-number-object
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-shared-array-buffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-symbol
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/is-weakref
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/node-supports-preserve-symlinks-flag
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/object-inspect
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/inspect-js/which-boxed-primitive
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/chownr
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/core-util-is
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/fs.realpath
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/inherits
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/ini
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/isexe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minimatch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minipass
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minipass-collect
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minipass-flush
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minipass-pipeline
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minizlib
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-glob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-graceful-fs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-lru-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-mkdirp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-which
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/once
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/readable-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/rimraf
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/sax-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/yallist
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/babel-plugin-istanbul
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/istanbuljs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/load-nyc-config
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/schema
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/test-exclude
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/istanbuljs/v8-to-istanbul
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jakearchibald/idb
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jakejs/jake
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jakubpawlowicz/clean-css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jamestalmage/normalize-range
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jamestalmage/supports-hyperlinks
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/janl/node-jsonpointer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jantimon/html-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaredLunde/react-hook
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jaredhanson/utils-merge
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jashkenas/underscore
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jbgutierrez/path-parse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jensyt/imurmurhash-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jergason/recursive-readdir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jest-community/eslint-plugin-jest
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jest-community/jest-watch-typeahead
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jfromaniello/selfsigned
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jhchen/fast-diff
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jhchen/fast-diff/blob/3068710be7decb6cffb6259faf67e2e21ba5c6dc/package.json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jhchen/fast-diff/blob/f4e19f4486123086679ee2c8f703efb44dfb2499/package.json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jhiesey/stream-http
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jhiesey/to-arraybuffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jimmycuadra/shellwords
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathanong/ee-first
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/convert-colors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-color-functional-notation
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-color-mod-function
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-dir-pseudo-class
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-double-position-gradients
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-env-function
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-focus-visible
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-focus-within
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-gap-properties
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-image-set-function
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-lab-function
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-logical
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-nesting
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-overflow-shorthand
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-place
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonathantneal/postcss-pseudo-class-any-link
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/arr-diff
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/arr-flatten
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/arr-union
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/array-unique
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/assign-symbols
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/babel-extract-comments
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/cache-base
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/class-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/collection-visit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/copy-descriptor
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/define-property
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/expand-brackets
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/extend-shallow
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/fill-range
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/for-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/fragment-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/get-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/global-modules
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/global-prefix
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/has-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/has-values
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-accessor-descriptor
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-data-descriptor
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-descriptor
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-directory
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-extendable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-extglob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-glob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-number
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/is-windows
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/isobject
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/kind-of
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/map-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/map-visit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/mixin-deep
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/normalize-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/object-copy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/object-visit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/object.pick
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/pascalcase
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/posix-character-classes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/regex-not
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/repeat-element
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/repeat-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/set-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/snapdragon
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/snapdragon-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/snapdragon-util
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/split-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/static-extend
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/strip-comments
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/to-object-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/to-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/union-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/unset-value
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/use
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jonschlinkert/word-wrap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jorgebucaran)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jorgebucaran/colorette
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/libuv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-fs-extra
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jprichardson/node-jsonfile
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquense/react-common-hooks
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquense/uncontrollable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery-validation/jquery-validation
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/esprima
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/gen-mapping
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/resolve-uri
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/set-array
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/source-map
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/sourcemap-codec
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jridgewell/trace-mapping
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jryans/timers-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/js-sdsl/js-sdsl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/abab
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/cssstyle
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/data-urls
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/domexception
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/html-encoding-sniffer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/js-symbol-tree
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/jsdom
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/tr46
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/w3c-hr-time
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/w3c-xmlserializer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/webidl-conversions
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/whatwg-encoding
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/whatwg-mimetype
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/whatwg-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsdom/xml-name-validator
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/accepts
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/compressible
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/content-disposition
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/content-type
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/cookie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/etag
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/forwarded
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/fresh
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/http-errors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/media-typer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/methods
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-db
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/mime-types
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/negotiator
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/on-finished
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/on-headers
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/proxy-addr
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/range-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/statuses
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/type-is
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jshttp/vary
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jslicense/spdx-correct.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jslicense/spdx-exceptions.json/tree/v2.3.0#copyright-and-licensing
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jslicense/spdx-expression-parse.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jslicense/spdx-license-ids
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jslicense/spdx-license-ids/tree/v3.0.12#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/json5/json5
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/json5/json5/contributors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsx-eslint/eslint-plugin-react
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jsx-eslint/jsx-ast-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/balanced-match
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/constants-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/isarray
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/justmoon/node-extend
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jviereck/regjsparser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kaelzhang/node-ignore
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kemitchell/spdx-exceptions.json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kemitchell/validate-npm-package-license.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kentcdodds/babel-plugin-macros
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kesne/acorn-dynamic-import.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kevva/astral-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kevva/dir-glob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kevva/shebang-command
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kevva/strict-uri-encode
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/keyanzhang/identity-obj-proxy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kikobeats/emojis-list
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kilian/electron-to-chromium
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/knockout/knockout
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kpdecker/jsdiff
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kriskowal/asap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kriskowal/q
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kriszyp/json-schema
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kumavis/browser-process-hrtime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/kyldvs/ast-types-flow
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lakenen/node-unquote
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lddubeau/saxes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lddubeau/xmlchars
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lesshint/postcss-values-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/libjpeg-turbo/libjpeg-turbo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/tree/master/include/uv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/tree/master/src
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/limulus/call-me-maybe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/litejs/natural-compare-lite
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/litejs/natural-compare-lite/tree/v1.4.0#licence
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/call-bind
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/define-properties
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/es-abstract
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/es-array-method-boxes-properly
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/es-shim-unscopables
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/es-to-primitive
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/get-intrinsic
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/has-bigints
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/internal-slot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/is-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/object-keys
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/object.assign
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/qs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/qs/graphs/contributors)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/safe-regex-test
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/shell-quote
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/side-channel
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/unbox-primitive
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/ljharb/util.promisify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lodash/lodash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/loganfsmyth/gensync
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lquixada/cross-fetch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/luisrudge/postcss-flexbugs-fixes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/clsx
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/dequal
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/escalade
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/kleur
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/klona
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lukeed/resolve.exports
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lupomontero/psl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lydell/js-tokens
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lydell/resolve-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lydell/source-map-resolve
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lydell/source-map-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lydell/urix
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/lz4/lz4
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/cyclist
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/dns-packet
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/duplexify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/flush-write-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/multicast-dns
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/multicast-dns-service-types
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/parallel-transform
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pumpify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/stream-each
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/stream-shift
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/thunky
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mahdyar/ansi-html-community
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mantinedev/mantine
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/marcbachmann
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/marten-de-vries/killable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/martinheidegger/ip-codec
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/String.fromCodePoint
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/String.prototype.codePointAt
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/cssesc
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/emoji-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/he
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/is-potential-custom-element-name
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/jsesc
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/regenerate
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/regenerate-unicode-properties
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/regexpu-core
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/unicode-canonical-property-names-ecmascript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/unicode-match-property-ecmascript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/unicode-match-property-value-ecmascript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/unicode-property-aliases-ecmascript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mattcg/language-subtag-registry
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mattcg/language-tags
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mattcg/language-tags/tree/v1.0.5#credits-and-collaboration
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/maximkoretskiy/postcss-initial
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/maxogden/concat-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/maxogden/mississippi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/fastq
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mcollina/reusify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mde/ejs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mde/filelist
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mdevils/html-entities
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mdevils/node-html-entities
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mdn/data
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/d
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/es5-ext
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/es6-iterator
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/es6-symbol
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/next-tick
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/medikoo/type
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/anymatch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/braces
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/extglob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/is-glob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/micromatch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/nanomatch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/picomatch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/micromatch/to-regex-range
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/fluentui
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/fluentui-system-icons
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/rushstack
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mightyiam/get-own-enumerable-property-symbols
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikaelbr/node-notifier
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mike-spainhower/querystring
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/watch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikolalysenko/functional-red-black-tree
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikolalysenko/uniq
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/minimistjs/minimist
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/missive/emoji-mart
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mk-pmb/flatten-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/moment/luxon
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/moment/moment
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/moment/moment/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/motdotla/dotenv
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/motdotla/dotenv-expand
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/moxystudio/node-cross-spawn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla/nunjucks
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla/source-map
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mrcgrtz/postcss-opacity-percentage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mridgway/hoist-non-react-statics
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mrmlnc/fast-glob
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mscdex/io.js/blob/js-http-parser/test/pummel/test-http-parser-durability.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/myrne/performance-now
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/eslint-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/regexpp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mziccard/node-timsort
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nexdrew/which-module
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/BufferStreams
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/VarStream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/neatequal
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/svg-pathdata
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/svgicons2svgfont
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nfroidure/ttf2woff2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nicolo-ribaudo/babel-preset-current-node-syntax
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nicolo-ribaudo/eslint-scope-5-internals
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/node-base/base
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/node-modules/address
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/node-modules/detect-port
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodeca/argparse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodeca/js-yaml
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodeca/pako
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/nan
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/nan#wg-members--collaborators
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/readable-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodelib/nodelib/tree/master/packages/fs/fs.scandir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodelib/nodelib/tree/master/packages/fs/fs.stat
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodelib/nodelib/tree/master/packages/fs/fs.walk
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nolimits4web/Swiper
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nolimits4web/dom7
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nolimits4web/ssr-window
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/novemberborn/common-path-prefix
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/cacache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/copy-concurrently
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/figgy-pudding
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/fs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/fs-minipass
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/fs-write-stream-atomic
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/hosted-git-info
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/infer-owner
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/inflight
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/json-parse-even-better-errors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/move-concurrently
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/move-file
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/normalize-package-data
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/ssri
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/write-file-atomic
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nrkn/css-select-base-adapter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nuxt-contrib/create-require
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nwoltman/string-natural-compare
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/nyalab/caniuse-api
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/oliviertassinari/babel-plugin-transform-react-remove-prop-types
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/omgovich/colord
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/onlxltd/bonjour-service
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/onlxltd/bonjour-service)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/open-source-parsers/jsoncpp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/orling/grapheme-splitter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/papnkukn/qrcode-svg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/paulmillr/async-each
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/paulmillr/chokidar
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/paulmillr/chokidar.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/paulmillr/readdirp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/petkaantonov/bluebird
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pigcan/is-color-stop
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/encodeurl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/finalhandler
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/parseurl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pillarjs/send
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pimterry/loglevel
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pmmmwh/react-refresh-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/polemius/postcss-clamp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/popperjs/popper-core
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/autoprefixer
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-calc
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-color-gray
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-color-hex-alpha
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-color-rebeccapurple
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-custom-media
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-custom-properties
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-custom-selectors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-font-variant
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-import
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-load-config
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-media-minmax
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-nested
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-safe-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-selector-matches
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-selector-not
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/postcss/postcss-selector-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/primus/eventemitter3
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/protocolbuffers/protobuf
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pugjs/void-elements
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/puleos/object-hash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pvorb/node-clone
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/qix-/node-error-ex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/qix-/node-is-arrayish
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/qix-/node-simple-swizzle
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/quilljs/delta
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/quilljs/parchment
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/quilljs/quill
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-bootstrap/dom-helpers
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-bootstrap/prop-types-extra
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-bootstrap/react-bootstrap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-cropper/react-cropper
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-dropzone/attr-accept
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-dropzone/file-selector
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-dropzone/react-dropzone
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-grid-layout/react-draggable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-grid-layout/react-resizable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-hook-form/react-hook-form
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-native-async-storage/async-storage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-restart/ui
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reactchartjs/react-chartjs-2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reactivestack/cookies
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reactivex/rxjs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reactjs/react-lifecycles-compat
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reactjs/react-transition-group
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/redux-observable/redux-observable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reduxjs/react-redux
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reduxjs/redux
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reduxjs/redux-thunk
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reduxjs/redux-toolkit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reduxjs/reselect
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/regexhq/rgba-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/regexps/hex-color-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/regexps/hsl-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/regexps/hsla-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/regexps/rgb-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/remix-run/react-router
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reworkcss/css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reworkcss/rework
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reworkcss/rework-visit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reworkcss/rework-visit/tree/1.0.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/reworkcss/rework/tree/1.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rich-harris/magic-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rochal/jQuery-slimScroll
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/plugins
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/plugins/graphs/contributors)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/rollup
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/rollup-plugin-babel
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/rollup-plugin-babel/graphs/contributors)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/rollup-pluginutils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rollup/rollup/graphs/contributors)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/royriojas/file-entry-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/royriojas/flat-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/node-errno
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/node-errno/tree/v0.1.8#copyright--licence
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/node-levelup#contributors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/node-worker-farm
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/prr
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/rvagg/through2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/salesforce/tough-cookie
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/samccone/chrome-trace-event
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/samn/json-stable-stringify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sass/dart-sass
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/shellscape/webpack-manifest-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/shesek/iferr
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/shinnn)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/shinnn/is-resolvable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/shrpne/postcss-page-break
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/silverwind/default-gateway
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sinclairzx81/typebox
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/aggregate-error
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/ansi-escapes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/array-union
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/array-uniq
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/arrify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/binary-extensions
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/builtin-modules
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/caller-callsite
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/caller-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/callsites
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/camelcase
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/clean-stack
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/crypto-random-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/decamelize
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/deep-assign
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/define-lazy-prop
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/del
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/detect-newline
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/dot-prop
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/emittery
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/escape-string-regexp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/execa
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/find-up
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/get-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/globals
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/globby
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/gzip-size
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/has-flag
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/import-cwd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/import-fresh
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/import-from
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/import-local
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/indent-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/internal-ip
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/ip-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-absolute-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-binary-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-docker
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-fullwidth-code-point
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-generator-fn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-obj
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-path-cwd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-path-in-cwd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-path-inside
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-plain-obj
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-regexp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-root
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-stream
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/is-wsl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/leven
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/locate-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/make-dir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/mimic-fn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/normalize-url
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/npm-run-path
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/object-assign
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/onetime
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/open
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/opn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-each-series
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-finally
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-limit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-locate
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-map
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-retry
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-try
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/parent-module
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/parse-json
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-exists
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-is-absolute
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-key
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/path-type
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/pify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/pkg-dir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/pkg-up
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/prepend-http
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/pretty-bytes
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/query-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/quick-lru
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/read-pkg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/read-pkg-up
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/resolve-cwd
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/resolve-from
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/shebang-regex
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/slash
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/sort-keys
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/string-length
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/string-width
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/strip-bom
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/strip-eof
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/strip-final-newline
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/strip-json-comments
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/temp-dir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/tempy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/terminal-link
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/to-fast-properties
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/type-fest
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/unique-string
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/yn
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/yocto-queue
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sinonjs/commons
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sinonjs/fake-timers
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sockjs/sockjs-client
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sockjs/sockjs-node
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/soldair/node-buffer-indexof
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spdy-http2/handle-thing/tree/v2.0.1#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spdy-http2/http-deceiver/tree/v1.2.7#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spdy-http2/node-spdy/tree/v4.0.2#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spdy-http2/spdy-transport
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spdy-http2/spdy-transport/tree/v3.0.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sqlite/sqlite
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stacktracejs/error-stack-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stacktracejs/stackframe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stefanpenner/get-caller-file
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stevenvachon/camelcase-css
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stevenvachon/relateurl
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stoeffel/arityN
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stoeffel/compose-function
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stream-utils/destroy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stream-utils/raw-body
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/stream-utils/unpipe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/streamich/fs-monkey
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/streamich/memfs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/strml/async-limiter
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/node-deep-equal
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/path-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/tty-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/vm-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/suguru03/neo-async
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/surma/rollup-plugin-off-main-thread
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/svg/sax
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/svg/svgo
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tad-lispy/node-damerau-levenshtein
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tailwindlabs/tailwindcss
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tapjs/signal-exit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tapjs/signal-exit.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tapjs/stack-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tarruda/has
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/teambition/merge2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/terkelg/prompts
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/terkelg/sisteransi
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/terser/html-minifier-terser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/terser/terser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/testing-library/eslint-plugin-testing-library
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/theabraham/growly
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/then/promise
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/thlorenz/convert-source-map
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/thlorenz/deep-is
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tildeio/rsvp.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tim-kos/node-retry
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tj/co
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tj/commander.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/troygoode/node-require-directory
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trusktr/geometry-interfaces
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tsconfig/bases
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tsertkov/exec-sh
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tsyrogit/zxcvbn-c
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/twbs/bootstrap
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/typescript-eslint/typescript-eslint
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/unshiftio/querystringify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/unshiftio/requires-port
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/unshiftio/url-parse
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/veged/coa
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/arg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/vercel/ms
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/batch
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/bytes.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/debug
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/node-cookie-signature
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/visionmedia/node-progress
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/bonjour
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/bonjour)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/ci-info
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/dns-equal
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/dns-txt
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/watson/is-ci
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webmproject/libvpx
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/css-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/css-minimizer-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/eslint-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/file-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/mini-css-extract-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/postcss-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/sass-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/schema-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/source-map-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/style-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/terser-webpack-plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/url-loader
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack-contrib/webpack-log
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/enhanced-resolve
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/loader-runner
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/loader-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/memory-fs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/node-libs-browser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/schema-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/source-list-map
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/tapable
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/watchpack
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/webpack
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/webpack-dev-middleware
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/webpack-dev-server
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/webpack/webpack-sources
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/weidai11/cryptopp
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wesleytodd/setprototypeof
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/whitequark/ipaddr.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wojtekmaj/date-utils
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wojtekmaj/get-user-locale
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wojtekmaj/merge-class-names
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wojtekmaj/react-calendar
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wooorm/vendors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wraithgar/gar-promisify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xiph/opus/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xmldom/xmldom
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xtuc/acorn-import-assertions
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/xtuc/webassemblyjs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yahoo/serialize-javascript
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/cliui
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/require-main-filename
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/set-blocking
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/y18n
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yargs/yargs-parser.git
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yeoman/stringify-object
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yisibl/num2fraction
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeit/arg
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zeit/ms
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zenoamaro/react-quill
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/invariant
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/loose-envify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/v8-compile-cache
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zkat/json-parse-better-errors
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zkat/ssri
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zloirock/core-js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/zspecza/common-tags
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/philbooth/bfj
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/philbooth/check-types.js
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/philbooth/check-types.js/-/blob/89096fa712e9f7a2b14cea58be8836df081fd43b/COPYING
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/philbooth/hoopy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.com/philbooth/tryer
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.teamviewer.com/v15
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.teamviewer.com/v15/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hns-legacy.sb.avast.com
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eula
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2925623111.0000000000A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eulak
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2654552819.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/defs/avg-av/release.xml.lzma
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exe
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2618953946.00000000052FB000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2619081309.00000000052FF000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe7
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-du/release/avg_driver_updater_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-tu/release/avg_tuneup_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-vpn/release/avg_vpn_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2809201270.000000000348F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/1de6/62d6/a416/1de662d6a41687462bc259fb9e3ba374edf79947739ce997d3e
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2754817251.000000000348F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/4246/af29/4055/4246af29405597481f4d3e6f1e55cf71175e7762e69f97a3470
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2754817251.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2754817251.000000000348F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/ac47/c136/e574/ac47c136e574da442ad0961667930a5076c3082f98e0edcb8fb
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.000000000348F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/ed05/1b68/0240/ed051b68024077e7b870548a54887574ecfefa3b18159fc2ab8
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.000000000348F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/f376/e9af/363d/f376e9af363d39e60246c7dce9c8c9accb7da5dc8d23e548617
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2837083101.00000000034A4000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2809201270.00000000034A3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/f3d4/1563/ef59/f3d41563ef598f824db6dce8e182b3110696c20a868329c5bd8
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/setup/avg-av/release/avg_antivirus_free_online_setup.exe
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.00000000034A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.netk
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avast.com/inAvastium
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avg.com
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://identityprotection.avg.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ionicabizau.net)
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm-provider.ff.avast.com/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm.avcdn.net/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jmvalin.ca/demo/rnnoise/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jorgebucaran.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/
Source: teamviewer_Px-yDq1.exe, 00000000.00000000.2206369560.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://js.foundation
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://js.foundation/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://kemitchell.com/)
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.teamviewer.com/nav/license-activation-guidance
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://marcgoertz.de/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meeting.teamviewer.com/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meeting.teamviewer.com/.
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://my.avast.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/commondir
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/commondir/LICENSE?t=1664182327630
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/concat-map/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/concat-map/LICENSE?t=1663680695626
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/https-browserify
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/https-browserify/LICENSE?t=1663681508245
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/performance-now/license.txt?t=1660577553742
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/rollup-plugin-iconfont/LICENSE.md?t=1669742187028
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/text-table/LICENSE?t=1664186195403
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/typedarray
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://npm.runkit.com/typedarray/LICENSE?t=1664186075052
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/Arrays_in_NSIS
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/Base64_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/DialogsEx_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/Invoke_Shell_Verb_plugin
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/Linker_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/Nsis7z_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/NsisStartMenu_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nsis.sourceforge.io/UAC_plug-in
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ofcr.se/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openjsf.org/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.apple.com/source/mDNSResponder/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.org/licenses/BSD-3-Clause).
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.org/licenses/ISC.
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://opensource.org/licenses/Zlib)
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pair.ff.avast.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://paulmillr.com)
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://quicksupport.me/%1%
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/babel/babel/v6.26.0/LICENSE
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/facebook/regenerator/7c5d36207ad8118bfe934c5a72e0cc4bceb29d52/LICE
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/mattcg/language-subtag-registry/6d06daf44528a6d9d18baba0e4c61fb386
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.c
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.co=
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.com/policies
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.u
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s-nuistatic.avcdn.net/nui/avg/1.0.643/updatefile.json
Source: saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/
Source: saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/W
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml/
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/
Source: saBSI.exe, 00000007.00000003.2683207743.000000000090C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667943096.0000000000911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml
Source: saBSI.exe, 00000007.00000003.2657344323.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667782343.00000000051FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/
Source: saBSI.exe, 00000007.00000003.2683207743.000000000090C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667943096.0000000000911000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml
Source: saBSI.exe, 00000007.00000003.2657344323.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667782343.00000000051FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml/
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667943096.0000000000915000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683065519.0000000005207000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683155880.00000000051FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml/
Source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_main.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml/
Source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTORE
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json(
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json5
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json_
Source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonff_ext_update_url_PROXY_SYST
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsoni
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonr
Source: saBSI.exe, 00000007.00000003.2683155880.00000000051FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi
Source: saBSI.exe, 00000007.00000003.2655605803.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000091A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.0000000000914000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2778496417.0000000000919000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000091B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2651186100.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml
Source: saBSI.exe, 00000007.00000003.2655605803.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2780377809.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667812090.000000000092E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml/
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa
Source: saBSI.exe, 00000007.00000003.2683155880.00000000051FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary
Source: saBSI.exe, 00000007.00000003.2764053433.0000000005241000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/v1/pc/partner_custom_vars.xml
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa6
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saJ
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saP
Source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saUPDATER_URLupdater.exeWebAdvisor_Updater
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/say
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2805276706.0000000005BC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.ff.avast.com
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2633952955.0000000005341000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2938144129.0000000003461000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.ff.avast.com/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.ff.avast.comhttp://honzik.avcdn.net/settings_mgr::get_bundle_guid()
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/nsis/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://spdx.org/licenses/Apache-2.0)
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://submit.sb.avast.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tukaani.org/xz/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://unlicense.org
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://viruslab-samples.sb.avast.com
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/privacy
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/te
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/terms
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webrtc.googlesource.com/src/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webrtc.org/
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winqual.sb.avast.com
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winqual.sb.avast.comhttps://hns-legacy.sb.avast.comhttps://submit.sb.avast.comhttps://virusl
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/hjR
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/privacy/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.cU
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-consumer-products
Source: file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-consumer-productsL
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/privacy-policy
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/eula
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/privacyv
Source: file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula
Source: file_Px-yDq1.tmp, 00000004.00000003.2611553890.0000000006DD8000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612543991.0000000006DEB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933607701.0000000006DEC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DEC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933867914.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2708482808.0000000006DED000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684753189.0000000006DFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula/en-us/
Source: file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933867914.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684753189.0000000006DFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eulat.net
Source: file_Px-yDq1.tmp, 00000004.00000003.2684434182.0000000003923000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eulat.netG
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2928228731.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.000000000246B000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2736808171.0000000002446000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2717260823.0000000007623000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy
Source: file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684753189.0000000006DFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/
Source: file_Px-yDq1.tmp, 00000004.00000003.2611553890.0000000006DD8000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2612543991.0000000006DEB000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933607701.0000000006DEC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DEC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2708482808.0000000006DED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/_tG
Source: file_Px-yDq1.tmp, 00000004.00000003.2684434182.0000000003923000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/
Source: file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933867914.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684753189.0000000006DFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/fT
Source: file_Px-yDq1.tmp, 00000004.00000003.2662173197.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2933867914.0000000006DFD000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2684753189.0000000006DFD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/hU
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.1
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.c
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/t
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/ta
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/te
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/ter
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/term
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.1m)
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.h
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.ht
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.htm)
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.html
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/content/terms.en-gb.html/privacy-policy/79-8B2BC0F020CA
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/contentz
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/gI
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/gener
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.h
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.ht
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=doc
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/7
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/p
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/pri
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privF
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/priva
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privac
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privacy
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privacy-pol
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003BD9000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/S
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.html?tmpl=dox
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.booking.com/general.en.w
Source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: file_Px-yDq1.tmp, 00000004.00000003.2605688376.00000000039AA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2816688861.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797355553.00000000055B3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2817905115.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2797939274.0000000005258000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2764179506.0000000005571000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2818055839.0000000005259000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000016.00000003.3038352991.0000025064C47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002780000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000000.2210201348.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file_Px-yDq1.exe, 00000003.00000003.2275579656.000000007FCE4000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2272556380.00000000027C8000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000000.2277851235.0000000000575000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.innosetup.com/
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009AF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal.html
Source: file_Px-yDq1.tmp, 00000004.00000003.2684823421.00000000038F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html
Source: file_Px-yDq1.tmp, 00000004.00000003.2605804435.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html9/avg.zipI.zi
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html=Aa
Source: file_Px-yDq1.tmp, 00000004.00000002.2927698794.00000000038D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlB
Source: file_Px-yDq1.tmp, 00000004.00000003.2661913851.0000000003997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlextractlt
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlm
Source: regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlq
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/acorn-import-assertions/v/1.8.0#License
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/agent-base/v/6.0.2#License
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/async-each/v/1.0.3#License
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/async-throttle/v/1.1.0
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/async-throttle/v/1.1.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/geometry-interfaces/v/1.1.4#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/growly/v/1.3.0#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/jest-pnp-resolver/v/1.2.3#license-mit
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/rollup-plugin-iconfont/v/1.0.3
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/rollup-pluginutils/v/2.8.2#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/text-table
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/wbuf/v/1.7.3#license
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/yuv-canvas/v/1.2.11#Copyright
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opensource.org/licenses/bsd-license.php)
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.c8
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003BD9000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computers
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computersNj
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computersTmV
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003BD9000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/privacy
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/privacy#
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1
Source: file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1VA
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/privacy-policy
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/psf/)
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002780000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000000.2210201348.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file_Px-yDq1.exe, 00000003.00000003.2275579656.000000007FCE4000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.exe, 00000003.00000003.2272556380.00000000027C8000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000000.2277851235.0000000000575000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.remobjects.com/ps
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.speex.org/
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ssl.com/repository0
Source: TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/datenschutzinformation/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/dokumente
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/dpa-annex/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/dpa-annex/#annex-2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/dpa-annex/#annex-3
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/eula/#dpa
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/kundenservice
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#assistar
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#engage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#iot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#meeting
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#pilot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#remote-management
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/de/product-descriptions/#teamviewer-classroom
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/customer-support/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/documents/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/dpa-annex/#annex-1
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/dpa-annex/#annex-2
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/dpa-annex/#annex-3
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/eula/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/eula/#dpa
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/gdpr/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/privacy-notice
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/privacy-notice/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#assistar
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#engage
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#iot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#meeting
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#pilot
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#remote-management
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/en/product-descriptions/#teamviewer-classroom
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=116574
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=125377
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=165388
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=1653885=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=180010
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=261802
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=265448&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000002.3052399690.00000000028DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=271878Hinweis
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=279064VScripts
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=279064oSkripte
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=290947
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=293922
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=300792
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=364272)Naozaj
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=3642724Da
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=378443
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=382377_I
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=418720
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=440909&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=461825ZYour
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=462409
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=478178&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=514937
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=572005
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=592321&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=646190
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=737863
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=766963&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=773631
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=780538
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=790045
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=850268&utm_source=mainwindow&utm_medium=client&utm_content=wind
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=870706&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=879333
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=881911
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=918734&utm_source=moresolutions&utm_medium=client&utm_campaign=
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/link/?url=940942
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/meeting
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/meeting/telephone/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.teamviewer.com/ticket
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.webmproject.org/code/
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.winzip.com/win/en/eula.html&j
Source: file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009E1000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.winzip.com/win/en/privacy.html~mh
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,10_2_00405050
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_2f1c920d-6
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.catJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.catJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.catJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.catJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\tvmonitor.catJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

barindex
Writes many files with high entropy
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\Downloads\teamviewer.exe entropy: 7.9933049737Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe entropy: 7.99261107729Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\c03fec4d-c72d-42be-aa27-7b395636eb68 entropy: 7.9999157529Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\12fac158-629c-48a3-8e62-e176bebbb3b8 entropy: 7.99995168182Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\32ad3329-2954-40c9-87bd-ac3d83b260cc entropy: 7.99962117313Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\388c93c1-d0b9-4a82-b568-496d7fd69081 entropy: 7.99986670566Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\6f5f8478-e899-495e-83ae-2defd5d653fe entropy: 7.99864990699Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\setupui.cont entropy: 7.99945960987Jump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\7364a974-5bce-49f1-a616-762f62a206f2 entropy: 7.99936819868Jump to dropped file
Source: C:\Users\user\Downloads\teamviewer.exeFile created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe entropy: 7.99794260412Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles.7z entropy: 7.9999947809Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfilesx64.7z entropy: 7.99938803123Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z entropy: 7.99953353808Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe entropy: 7.99794260412Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\uimanager.cab entropy: 7.99959504638Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\uninstaller.cab entropy: 7.99935092903Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\updater.cab entropy: 7.99930681513Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\wataskmanager.cab entropy: 7.99983539171Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\wssdep.cab entropy: 7.99865937314Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\analyticsmanager.cab entropy: 7.99961438969Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\browserhost.cab entropy: 7.99953579752Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\browserplugin.cab entropy: 7.99922249191Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\downloadscan.cab entropy: 7.99976400125Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\eventmanager.cab entropy: 7.99956598882Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\logicmodule.cab entropy: 7.99960093777Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\lookupmanager.cab entropy: 7.99852985626Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\mfw-webadvisor.cab entropy: 7.99735105928Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\mfw.cab entropy: 7.99508058214Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\servicehost.cab entropy: 7.99608701279Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\settingmanager.cab entropy: 7.9994274548Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\taskmanager.cab entropy: 7.99954412419Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\uihost.cab entropy: 7.99651369261Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\setupui.cont entropy: 7.99945960987Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_product.dll.lzma entropy: 7.99989642885Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_rvrt.exe.lzma entropy: 7.99377130708Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\aswOfferTool.exe.lzma entropy: 7.99978706309Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe.lzma entropy: 7.9999178993Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_product.dll.lzma entropy: 7.99943192939Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_rvrt.exe.lzma entropy: 7.99377130708Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\dump_process.exe.lzma entropy: 7.99958464338Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\bug_report.exe.lzma entropy: 7.99985206343Jump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi entropy: 7.99707344308Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ipending.70faf5db entropy: 7.9996461815Jump to dropped file
Writes a notice file (html or txt) to demand a ransom
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile dropped: C:\Program Files (x86)\TeamViewer\TVExtractTemp\eula-en.html -> encrypted connections (handshake) and for the forwarding of data packets (routing) in connection with the use of the software (<strong>server services</strong>), as well as (iii) any further cloud-based services provided by teamviewer. the software, server services and other cloud-based services provided by teamviewer are hereinafter collectively referred to as <strong>services</strong>.</p><h3>c. hardware specific terms</h3><p>the hardware specific terms contain the terms and conditions that additionally apply to your purchase and/or lease of physical goods, including smart glasses, iot devices or similar items (<strong>hardware</strong>).</p><h3>d. product specific terms</h3><p>the product specific terms contain the terms and conditions that additionally apply to your use and purchase of certain teamviewer products described in this section (each, a <strong>product</strong>). the product specific terms include various links to the description of features, limits of use and syJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile dropped: C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt -> encryption key for your account secure because without them you may lose access to your data. you are solely responsible and liable for any activity that occurs under your account, including by anyone who uses your account. if there is any unauthorized use or access to your account, you must let us know immediately. we are not responsible for any loss caused by unauthorized use of or access to your account; however, you may be liable for any losses we or others suffer because of the unauthorized use. we do not have access to master passwords and cannot recover your encrypted data if you forget the master password for any password management feature or product. we offer both free and premium versions of our password and identity management software, and the free versions limit the maximum number of unique accounts (such as a website or application login) that you can store. if you have downloaded a premium version of the software at no cost during a promotion, then when the promotional period ends you will notJump to dropped file
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040634410_2_00406344
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040488F10_2_0040488F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_0040684614_2_00406846
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_00404C5914_2_00404C59
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_0040684617_2_00406846
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_00404C5917_2_00404C59
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpKey value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon versionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dll
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeSection loaded: icuuc.dll
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeSection loaded: icuin.dll
Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
Source: teamviewer_Px-yDq1.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile deleted: C:\Windows\Temp\nsnB93D.tmp
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,10_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,14_2_004033B6
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,17_2_004033B6
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: teamviewer_Px-yDq1.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file_Px-yDq1.tmp.3.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: installer.exe.7.drStatic PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 27965291 bytes, 132 files, at 0x2c +A "analyticsmanager.cab" +A "analyticstelemetry.cab", number 1, 975 datablocks, 0x1 compression
Source: TeamViewer_Resource_ar.dll.14.drStatic PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: TeamViewer_Resource_cs.dll.14.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_de.dll.14.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE ECOFF executable not stripped - version 0.101
Source: TeamViewer_Resource_el.dll.14.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_el.dll.14.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_es.dll.14.drStatic PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.100
Source: TeamViewer_Resource_id.dll.14.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_it.dll.14.drStatic PE information: Resource name: RT_STRING type: 370 XA sysV executable not stripped
Source: TeamViewer_Resource_it.dll.14.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeRegistry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\118.0.1 (x64 en-US)\Main Install Directory
Source: TeamViewer_Resource_he.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_ar.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_da.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_cs.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_hr.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_en.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_bg.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_fi.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_id.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_de.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_fr.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_es.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_it.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_el.dll.14.drStatic PE information: No import functions for PE file found
Source: TeamViewer_Resource_hu.dll.14.drStatic PE information: No import functions for PE file found
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs teamviewer_Px-yDq1.exe
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs teamviewer_Px-yDq1.exe
Source: teamviewer_Px-yDq1.exe, 00000000.00000003.2330819607.0000000002368000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs teamviewer_Px-yDq1.exe
Source: teamviewer_Px-yDq1.exe, 00000000.00000000.2206486609.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs teamviewer_Px-yDq1.exe
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: classification engineClassification label: mal42.rans.evad.winEXE@80/2012@0/83
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: teamviewer_Px-yDq1.exeReversingLabs: Detection: 21%
Source: teamviewer_Px-yDq1.exeVirustotal: Detection: 25%
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeFile read: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeJump to behavior
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\teamviewer_Px-yDq1.exe C:\Users\user\Desktop\teamviewer_Px-yDq1.exe
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp "C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp" /SL5="$20458,831488,831488,C:\Users\user\Desktop\teamviewer_Px-yDq1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe "C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp "C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp" /SL5="$40456,1559708,780800,C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /ga_clientid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\Downloads\teamviewer.exe "C:\Users\user\Downloads\teamviewer.exe"
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://download.it/?typ=1
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2028,i,935018131516826606,2306456977688268637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Downloads\teamviewer.exeProcess created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\icarus-info.xml /install /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeProcess created: C:\Program Files\McAfee\Temp3848859477\installer.exe "C:\Program Files\McAfee\Temp3848859477\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe start "McAfee WebAdvisor"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: unknownProcess created: C:\Program Files\McAfee\WebAdvisor\servicehost.exe C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp "C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp" /SL5="$20458,831488,831488,C:\Users\user\Desktop\teamviewer_Px-yDq1.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe "C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeProcess created: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp "C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp" /SL5="$40456,1559708,780800,C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7IJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\Downloads\teamviewer.exe "C:\Users\user\Downloads\teamviewer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://download.it/?typ=1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade Jump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeProcess created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2028,i,935018131516826606,2306456977688268637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeProcess created: C:\Program Files\McAfee\Temp3848859477\installer.exe "C:\Program Files\McAfee\Temp3848859477\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe start "McAfee WebAdvisor"
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,10_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,14_2_004033B6
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,17_2_004033B6
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeWMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeFile created: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmpJump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040205E CoCreateInstance,MultiByteToWideChar,10_2_0040205E
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,10_2_0040431C
Source: TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{1f6554c2-d7a7-40d9-b3be-1de5d37df66d}Installer
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2524:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{0e71c6a0-3828-42ba-8e37-07180bcc1157}suy
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4948:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3784:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeMutant created: \BaseNamedObjects\AnalyticsManager_CAD0E02E86CD4436B6318C111B9092AC
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeMutant created: \Sessions\1\BaseNamedObjects\TeamViewer_Win32_Instance_Mutex
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpMutant created: \Sessions\1\BaseNamedObjects\{0e71c6a0-3828-42ba-8e37-07180bcc1157}suy
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Local\646336dc85e7725af438297f242a9ac1
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\646336dc85e7725af438297f242a9ac1
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\b190b8d2aa8c485bb5bccfb546f0b73f
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpMutant created: \Sessions\1\BaseNamedObjects\{1f6554c2-d7a7-40d9-b3be-1de5d37df66d}Installer
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\c3dc6fed9dc8387adea10b50da62f454
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7012:120:WilError_03
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Local\53403a07e181d4b1390ac479a5fe5b0f
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_03
Source: installer.exeString found in binary or memory: wa-install.css
Source: installer.exeString found in binary or memory: wa-install.html
Source: installer.exeString found in binary or memory: wa-ui-install.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-cs-CZ.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-da-DK.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-de-DE.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-el-GR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-en-US.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-es-ES.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-es-MX.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-fi-FI.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-fr-CA.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-fr-FR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-hr-HR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-hu-HU.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-it-IT.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-ja-JP.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-ko-KR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-nb-NO.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-nl-NL.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-pl-PL.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-pt-BR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-pt-PT.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-ru-RU.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-sk-SK.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-sr-Latn-CS.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-sv-SE.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-tr-TR.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-zh-CN.js
Source: installer.exeString found in binary or memory: jslang\wa-res-install-zh-TW.js
Source: C:\Users\user\Downloads\teamviewer.exeFile written: C:\Users\user\AppData\Local\Temp\TeamViewer\tvinfo.ini
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpWindow found: window name: TSelectLanguageFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpAutomated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpAutomated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpAutomated click: Run
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeAutomated click: Accept - next
Source: C:\Windows\System32\sc.exeAutomated click: Accept - next
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpWindow detected: HYPERLINK "https://cassinilabs.com/privacy-policy/" End User License AgreementHYPERLINK "https://cassinilabs.com/privacy-policy/" Privacy PolicyThis will download TeamViewer to your computer click "Next" to continue.Una soluzione efficace per realizzare...Welcome to TeamViewer Download Manager&NextCancel
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeWindow detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?
Source: C:\Windows\System32\sc.exeWindow detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\24.0\Outlook
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\analyticsmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\analyticstelemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\balloon_safe_annotation.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\browserhost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\browserplugin.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\downloadscan.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\eventmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_complete.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_failed.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\icon_laptop.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\installer.exe
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jquery-1.9.0.min.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\l10n.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\logicmodule.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\logicscripts.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\lookupmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\main_close_large.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafeecerts.xml
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-mwb.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-nps.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw-webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\mfw.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\resource.dll
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\resourcedll.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\servicehost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\settingmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\taskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\telemetry.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uihost.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uimanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\uninstaller.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\updater.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-common.css
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-core.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-install.css
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-install.html
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-ui-install.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa-utils.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wataskmanager.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_check.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_check2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_close.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_close2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_install_error.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_logo.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wa_logo2.png
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\webadvisor.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\webadvisor.ico
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\wssdep.cab
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-TW.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-cs-CZ.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-da-DK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-de-DE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-el-GR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-en-US.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-ES.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-MX.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fi-FI.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-CA.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-FR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hr-HR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hu-HU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-it-IT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ja-JP.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ko-KR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nb-NO.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nl-NL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pl-PL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-BR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-PT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ru-RU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sk-SK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sr-Latn-CS.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sv-SE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-tr-TR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-CN.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-TW.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-cs-CZ.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-da-DK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-de-DE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-el-GR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-en-US.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-ES.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-MX.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fi-FI.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-CA.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-FR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hr-HR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hu-HU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-it-IT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ja-JP.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ko-KR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nb-NO.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nl-NL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pl-PL.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-BR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-PT.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ru-RU.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sk-SK.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sr-Latn-CS.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sv-SE.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-tr-TR.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-CN.js
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\resource.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\uihost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\updater.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\clipboard.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\npshandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\mwbhandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-controller-nps-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\stop-video-alert-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-nps-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-controller-mwb-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-mwb-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wb-rocket-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\browserhost.exe
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\aj_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\edge_onboarding.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\miscutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers_selector.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\ss_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\tests_logic.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\type_tag_utils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\usage_calculation.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\affid_monitor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wss.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor_v2.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util_selector.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\logic\providers\yahoo.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.chrome.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.firefox.extension.json
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\handlers.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\logger.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\postinit.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\priorityqueue.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\triggeracceptor.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uiarbitratorhelper.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uihandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\uithreadexithandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\reset_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\common_utils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\allow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow-right.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\packageutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\settingsdb.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\card_bg_image.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringutils.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\telemetry.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\celebration_white_bg_color.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\green_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\icn_mshield.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\installer_background.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\jquery-1.9.0.min.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close_icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dialog-balloon-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\loading-spinner.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_ss.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_wa.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\main_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_sideloaded_ext_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-lg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\keep_changes_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\logomark_white.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafeeicon.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-wa-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\open_sideloaded_ext_alert_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_0.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\minimize.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_3.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\msac.ico
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_ext_on_guide.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_on.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_1_3.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\spinner_large.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step1.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-checklist.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-woman.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-common.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-bg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-core.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-window.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-dialog.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-uninstall-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-utils.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_increase_bg_left.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_error.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg_v2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo2.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_check.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_good.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_downchevron.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_exclamation.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_red.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_questionmark.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_yellow.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_timer.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop-features.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\edge_search_events.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon-selected.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\amazon_upsell_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\checklisthandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\chrome_extension_push_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\cryptojack-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\ext_install_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\facebook.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-noxup.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-warningbackground.gif
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new_tab_main_logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\overlay_ui_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\securesearchhandler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon-selected.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_off.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_on.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-en-US.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\toast_impact_close.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\twitter.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\upsell_toast_handler.luc
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell-logo.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-risk.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-status.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-controller-checklist.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-tr-TR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-CN.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-TW.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-cs-CZ.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-da-DK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-de-DE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-el-GR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-ES.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-MX.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fi-FI.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-CA.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-FR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hr-HR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hu-HU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dwtoast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-it-IT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-options.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ja-JP.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ko-KR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast-bing.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nb-NO.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nl-NL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-danger.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pl-PL.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-risk.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-BR.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-PT.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-wss.png
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ru-RU.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.css
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.html
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sk-SK.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sr-Latn-CS.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sv-SE.js
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDirectory created: C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\warning-icon-toast.png
Source: teamviewer_Px-yDq1.exeStatic file information: File size 1742072 > 1048576
Source: teamviewer_Px-yDq1.exeStatic PE information: certificate valid
Source: teamviewer_Px-yDq1.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2835351545.0000000005BA1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2653994841.0000000005A6F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\linoy\Documents\GitHub\zbShield-Utils-CPP\zbShieldUtils\bin\Release\Helper.pdb source: file_Px-yDq1.tmp, 00000004.00000003.2676688582.0000000007700000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb/ source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb~ source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A17A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 0000000E.00000003.3012331829.0000000008C0E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3013060276.0000000009160000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 00000008.00000000.2613996083.0000000000A93000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_w32exe.pdbU source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, 0000000E.00000003.3011087202.00000000086CA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Service.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A17A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000000.2635641082.00000000002D1000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2713235270.0000000005DFE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000007.00000000.2606565391.00000000010CE000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Desktop.pdb source: TeamViewer_.exe, 0000000E.00000003.2997019856.0000000009366000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2757915508.0000000005C13000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 0000000E.00000003.3018411470.0000000009200000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 0000000E.00000003.3017790882.0000000008C6B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2784198049.0000000005CFD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: t:\untgz\Joel_plugins_src\dialogsEx\dialogs\Release\dialogsEx.pdb source: TeamViewer_.exe, 0000000E.00000002.3053267901.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2678219788.0000000005C78000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64exe.pdbR source: TeamViewer_.exe, 0000000E.00000003.2997019856.000000000A449000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49D0 push esi; retf 14_3_071B49D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B40C0 push esi; iretd 14_3_071B40C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B54C5 push esi; retf 14_3_071B54C8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B49E6 push eax; retf 14_3_071B49E8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_3_071B2A23 push edi; ret 14_3_071B2A24
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
Source: teamviewer_Px-yDq1.exeStatic PE information: section name: .didata
Source: teamviewer_Px-yDq1.tmp.0.drStatic PE information: section name: .didata
Source: is-MAUM5.tmp.2.drStatic PE information: section name: .didata
Source: file_Px-yDq1.tmp.3.drStatic PE information: section name: .didata
Source: saBSI.exe.4.drStatic PE information: section name: .didat
Source: avg_antivirus_free_setup.exe.4.drStatic PE information: section name: .didat
Source: installer.exe.7.drStatic PE information: section name: _RDATA
Source: avg_antivirus_free_online_setup.exe.8.drStatic PE information: section name: .didat
Source: icarus.exe.9.drStatic PE information: section name: .didat
Source: icarus.exe.9.drStatic PE information: section name: _RDATA
Source: icarus_ui.exe.9.drStatic PE information: section name: _RDATA
Source: dump_process.exe.9.drStatic PE information: section name: .didat
Source: dump_process.exe.9.drStatic PE information: section name: _RDATA
Source: bug_report.exe.9.drStatic PE information: section name: _RDATA
Source: TeamViewer.exe.14.drStatic PE information: section name: .didat
Source: TeamViewer.exe.14.drStatic PE information: section name: .rodata
Source: TeamViewer_Desktop.exe.14.drStatic PE information: section name: .orpc
Source: TeamViewer_Desktop.exe.14.drStatic PE information: section name: .didat
Source: TeamViewer_Desktop.exe.14.drStatic PE information: section name: .rodata
Source: TeamViewer_Note.exe.14.drStatic PE information: section name: .didat
Source: TeamViewer_Service.exe.14.drStatic PE information: section name: .didat
Source: tv_w32.exe.14.drStatic PE information: section name: .didat
Source: tv_x64.exe.14.drStatic PE information: section name: .didat
Source: tv_x64.exe.14.drStatic PE information: section name: _RDATA
Source: TeamViewerMeetingAddinShim64.dll.14.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\Base.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\asulaunch.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSnx.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\snxhk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnBS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnIS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnOS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\dll_loader.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\ashShell.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\AavmRpch.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswPropertyAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswProperty.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\BreachGuardSdk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\Boot.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswRegLib.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswidsagent.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswBrowser.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashUpd.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashQuick.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashShell.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashServ.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashBase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnIS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnOS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnBS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashTask.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswProperty.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswLog.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswEngSrv.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswEngLdr.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\sched.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ntp_time.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\streamback.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\CommChannel.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswDld.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAux.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\log.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswRvrt.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswIP.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswChLic.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\VisthAux.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswSqLt.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\CommonRes.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\anen.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\perfstats.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswW8ntf.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswPropertyAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_er.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_ga.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_burger.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_routing_rpc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEAntivirus.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_routing.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\serialization.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\process_monitor.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\task_performance_logger.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\tasks_core.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\burger_client.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\dll_loader.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\vaarclient.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\module_lifetime.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ffl2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\browser_pass.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\concrt140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AVGSvc.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\fltlib_wrapper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\shepherdsync.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\wsc_proxy.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswBrowser.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAMSI.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\firefox_pass.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\wsc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgBoot.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AavmRpch.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\nos.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\SupportTool.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvEmUpdate.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\mfc140u.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\mfcm140u.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAvBootTimeScanShMin.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\concrt140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEBrowser.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPECommander.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\libssl-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgNetHub.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\jsbridge.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvConsent.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvLaunch.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\HTMLayout.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgKbd.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswavdetection.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbuniv.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsh.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRvrt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSP.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgMonFlt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRdr2.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\protobuf.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgStm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswwinamapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswsecapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswremoval.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswpsic.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswdetallocator.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswVmm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avgToolsSvc.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\overseer.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\SetupInf.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\wxbase315u_vc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArDisk.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\uiLangRes.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArPot.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswShMin.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\wxmsw315u_core_vc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\shred.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEShell.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswhook.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\snxhk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAux.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-49I9G.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\Boot.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dllJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_mod.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\taskmanager.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswhook.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgNetHub.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEShell.exe.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\CommChannel.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\botva2.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswSqLt.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\dll_loader.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ntp_time.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\linker.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\wxbase315u_vc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\overseer.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswW8ntf.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeFile created: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_ui.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvLaunch.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashQuick.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeFile created: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashServ.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\HTMLayout.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\shred.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSnx.sys.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\lookupmanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\browser_pass.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TVWebRTC.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswEngLdr.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\UserInfo.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswPropertyAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\shepherdsync.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRvrt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\Downloads\teamviewer.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\firefox_pass.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\TvGetVersion.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AVGSvc.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\task_performance_logger.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashBase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\module_lifetime.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_er.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswDld.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\uninstaller.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\settingmanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswProperty.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\asulaunch.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\SetupInf.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswBrowser.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\SupportTool.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswProperty.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvEmUpdate.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswPropertyAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ffl2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\BreachGuardSdk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnIS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAv.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\servicehost.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswLog.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnBS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\Base.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\libssl-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswidsagent.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswBrowser.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\nsArray.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgSP.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswIP.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AavmRpch.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avgToolsSvc.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Windows\System32\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\Helper.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswRvrt.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\CommonRes.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpFile created: (copy)Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswEngSrv.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashShell.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\anen.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgRdr2.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashTask.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswChLic.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\ashShell.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\Downloads\teamviewer.exeFile created: C:\Users\user\AppData\Local\Temp\nse7C54.tmp\System.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\concrt140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\burger_client.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbuniv.sys.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\browserhost.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\snxhk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\wsc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEBrowser.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswShMin.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\Downloads\teamviewer.exeFile created: C:\Users\user\AppData\Local\Temp\nse7C54.tmp\TvGetVersion.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsArray.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\wxmsw315u_core_vc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnIS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\perfstats.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswremoval.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\vaarclient.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsExec.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\protobuf.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgStm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_ui.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\log.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\sched.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AvConsent.exe.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPEAntivirus.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswVmm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\VisthAux.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswwinamapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnOS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswRegLib.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_burger.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\updater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\concrt140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\jsbridge.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\uimanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\streamback.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\1033\uiLangRes.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\dll_loader.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\AavmRpch.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\uihost.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswavdetection.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsis7z.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpFile created: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\is-MAUM5.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswCmnOS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\mfc140u.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgKbd.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\installer.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgBoot.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\InstallOptions.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\nos.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\aswOfferTool.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsh.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArPot.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\System.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\WriteDump.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\aswCmnBS.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\tasks_core.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswsecapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\Downloads\teamviewer.exeFile created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_routing.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\mfcm140u.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\eventmanager.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\wataskmanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAMSI.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswAvBootTimeScanShMin.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgMonFlt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\UAC.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\resource.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\ashUpd.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\resource.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_routing_rpc.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswdetallocator.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\logicmodule.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\event_manager_ga.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeFile created: C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\bug_report.exeJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\System.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\RescueDisk\aswPECommander.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\serialization.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\aswpsic.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgArDisk.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\snxhk.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\process_monitor.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\fltlib_wrapper.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\wsc_proxy.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_rvrt.exeJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\nsArray.dllJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\System.dllJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_mod.dllJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\bug_report.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeFile created: C:\Windows\System32\icarus_rvrt.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_ui.exeJump to dropped file
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Windows\Temp\nscC342.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\aswOfferTool.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_product.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\dump_process.exeJump to dropped file
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_ui.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-cs-CZ.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-da-DK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-de-DE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-el-GR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-ES.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-MX.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fi-FI.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-CA.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-FR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hr-HR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-hu-HU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-it-IT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ja-JP.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ko-KR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nb-NO.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-nl-NL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pl-PL.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-BR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-PT.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-ru-RU.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sk-SK.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sr-Latn-CS.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-sv-SE.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-tr-TR.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-CN.txt
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-TW.txt
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile created: C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeFile created: C:\Program Files (x86)\TeamViewer\RollbackTemp\TV15Install.log

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\partmgr
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess created: C:\Windows\System32\sc.exe sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\Desktop\teamviewer_Px-yDq1.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeSystem information queried: FirmwareTableInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeSystem information queried: FirmwareTableInformation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2805276706.0000000005BC7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_A64%/ASWHOOK.DLL</DEST>
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2805276706.0000000005BC7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <PATH>%PRODUCT_INST_32%\ASWHOOKX.DLL</PATH>
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2805276706.0000000005BC7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_32%/ASWHOOK.DLL</DEST>
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2805276706.0000000005BC7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_64%/ASWHOOK.DLL</DEST>
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp TID: 7676Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp TID: 7672Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe TID: 8092Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe TID: 7288Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5796Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\McAfee\Temp3848859477\installer.exe TID: 5856Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe TID: 6996Thread sleep count: 274 > 30
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe TID: 6996Thread sleep count: 193 > 30
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe TID: 6996Thread sleep count: 101 > 30
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe TID: 6996Thread sleep count: 152 > 30
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exe TID: 4816Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgRdr2.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgNetHub.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\botva2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgbuniv.sys.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\browserhost.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\overseer.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\AvLaunch.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\HTMLayout.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswremoval.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TVWebRTC.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\protobuf.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgStm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgRvrt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\AvConsent.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswVmm.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswwinamapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\updater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\jsbridge.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\SetupInf.exe.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\uimanager.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\uihost.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswavdetection.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgKbd.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_Jump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsh.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\WriteDump.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswsecapi.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgMonFlt.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswRunDll.exe.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\resource.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\Temp3848859477\resource.dllJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exeJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\libssl-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswdetallocator.dll.ipending.70faf5dbJump to dropped file
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\WebAdvisor\logicmodule.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgSP.sys.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avgToolsSvc.exe.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\aswpsic.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dllJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeDropped PE file which has not been started: C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5dbJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeDropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_Jump to dropped file
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeMemory allocated: 1C56AEB0000 memory reserve | memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeMemory allocated: 1BD6AD70000 memory reserve | memory write watch
Source: C:\Program Files\McAfee\WebAdvisor\servicehost.exeMemory allocated: 1BD6AD90000 memory commit | memory reserve | memory write watch
Source: C:\Program Files\McAfee\Temp3848859477\installer.exeWMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : select Architecture from Win32_processor where Architecture=5 or Architecture=12
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeAPI call chain: ExitProcess graph end nodegraph_10-3278
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeAPI call chain: ExitProcess graph end nodegraph_14-3624
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeAPI call chain: ExitProcess graph end nodegraph_17-3555
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extractJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
Source: avg_antivirus_free_online_setup.exe, 00000009.00000003.2636170269.00000000033EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Copyright (C) 2011 VMware, Inc.
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}ZOR
Source: file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}
Source: file_Px-yDq1.tmp, 00000004.00000003.2612720352.00000000039BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efL
Source: file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A57000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.8
Source: file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}}
Source: file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc._
Source: teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.0000000000918000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2630778342.00000000008B1000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2619081309.000000000530C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2832462442.000000000344E000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 00000009.00000003.2937144198.00000000034A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW 2
Source: file_Px-yDq1.tmp, 00000004.00000003.2715004659.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}=AZ
Source: file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \ReasonLabs-EPP","VMwareP
Source: avg_antivirus_free_setup.exe, 00000008.00000003.2619081309.000000000530C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 00000008.00000003.2636295066.000000000530C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
Source: file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -vp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100&oip=26&ptl=7&dta=true\" -dp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100\" -i -v -d -se=true","r":["ReasonVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reeng
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -vp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100&oip=26&ptl=7&dta=true\" -dp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100\" -i -v -d -se=true","r":["ReasonVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}D
Source: file_Px-yDq1.tmp, 00000004.00000003.2715274018.0000000003BD9000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UNINSTALLPROGRESSFORM"ZB_RAV_Cross_Tri_NCB","o":"RAV_Cross"},"ps":{"i":"RAV_Triple_NCB/images/DOTPS-855/EN.png","dn":"RAV, VPN by RAV, Online Security, Safer Web","u":"https://shield.reasonsecurity.com/rsStubActivator.exe","p":"-ip:\"dui={userid}&dit={sessionid}&is_silent=true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -vp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100&oip=26&ptl=7&dta=true\" -dp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100\" -i -v -d -se=true","r":["ReasonVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}3s
Source: file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -vp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100&oip=26&ptl=7&dta=true\" -dp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100\" -i -v -d -se=true","r":["ReasonVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvn":["HKCR\\ReasonPersistentStorage\\AvUninstallTime"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/1117/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"pv":"1.34","v":3}},{"ad":{"n":"","f":"ZB_booking_v1","o":"Booking_com"},"ps":{"dn":"Booking.com","i":"Booking/images/DOTPS-405/booking_v1/EN.png","u":"Booking/files/DOTPS-551/booking.com.zip","p":"/VERYSILENT","r":["\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13D4CD54-EA09-4FDB-B979-8B2BC0F020CA}_is1"],"cp":"https://www.booking.com/general.en.html?tmpl=docs/privacy-policy/","ctu":"https://www.booking.com/content/terms.en-gb.html","ov":61,"pv":"1.28","x":11,"v":4}}],"c":""}
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00405FFD FindFirstFileA,FindClose,10_2_00405FFD
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,10_2_0040559B
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00402688 FindFirstFileA,10_2_00402688
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,14_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004064C1 FindFirstFileW,FindClose,14_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeCode function: 14_2_004027FB FindFirstFileW,14_2_004027FB
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,17_2_0040596F
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004064C1 FindFirstFileW,FindClose,17_2_004064C1
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeCode function: 17_2_004027FB FindFirstFileW,17_2_004027FB
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp FullSizeInformationJump to behavior
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess token adjusted: Debug
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeProcess token adjusted: Debug
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeProcess token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /ga_clientid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488
Source: C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\icarus-info.xml /install /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe c:\windows\temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pttvrlghuecvfh6sys1hvro5yg0iq7ikgsz1rchfef8w5s8p6lwokbyicczmhqvwgojaclzrts7i /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:c:\windows\temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7IJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Users\user\Downloads\teamviewer.exe "C:\Users\user\Downloads\teamviewer.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://download.it/?typ=1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exeProcess created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeProcess created: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
Source: TeamViewer_.exe, 0000000E.00000003.3008017697.000000000D110000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SharedMem_SetLogLevel: %u -> %u******* assertion failed: 'release', line %i, err %i******* assertion failed: 'setev', line %i, err %i******* assertion failed: '(type == State_x64) || (type == State_w32)', line %i, err %iSetDirectXHookStatus %u -> %uStarting Single Window******* assertion failed: 'hwnd', line %i, err %iStopping Single Window******* assertion failed: 'unhooksc', line %i, err %iStarting Update HookProgmanSHELLDLL_DefViewSysListView32Stopping Update Hook******* assertion failed: 'hdc', line %i, err %i******* assertion failed: 'ctos1 && ctos2', line %i, err %i******* assertion failed: 'wrect', line %i, err %i
Source: TeamViewer_.exe, 0000000E.00000003.2997019856.0000000009366000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SysShadowCAppSelection_Win::GetMetroRects() GetAppVisibilityOnMonitor(%1%) failed with hr=%2$xProgmanCAppSelection_Win::OutgrayTVRegion(): AlphaBlend failed!CDesktop::run() CoCreateInstance(AppVisibility) failed with hr=%1$xCAppSelection_Win::IsMetroAppVisible() GetAppVisibilityOnMonitor(%1%) failed with hr=%2$xCAppSelection_Win::IsMetroLauncherVisible() IsLauncherVisible() failed with hr=%1$xshellexperiencehost.exeCAppSelection_Win::AddStartMenuToMetroRects() IsLauncherVisible() failed with hr=%1$x-
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\mainlogo.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\WebAdvisor.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\AVG_AV.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\finish.png VolumeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\icarus.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exeQueries volume information: C:\ProgramData\AVG\Icarus\Logs\event_manager.log VolumeInformation
Source: C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exeCode function: 18_2_00007FF663F9C16C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,18_2_00007FF663F9C16C
Source: C:\Users\user\Downloads\teamviewer.exeCode function: 10_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,10_2_00405D1B
Source: C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts11
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		1
Disable or Modify Tools		11
Input Capture		1
System Time Discovery		Remote Services11
Archive Collected Data		Exfiltration Over Other Network Medium1
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
Data Encrypted for Impact
Default Accounts12
Command and Scripting Interpreter		1
DLL Search Order Hijacking		1
DLL Search Order Hijacking		1
Obfuscated Files or Information		LSASS Memory1
Gather Victim Host Information		Remote Desktop Protocol1
Man in the Browser		Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without Authorization1
System Shutdown/Reboot
Domain Accounts1
Scheduled Task/Job		11
Windows Service		1
Access Token Manipulation		1
DLL Side-Loading		Security Account Manager4
File and Directory Discovery		SMB/Windows Admin Shares11
Input Capture		Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local Accounts1
Service Execution		1
Scheduled Task/Job		11
Windows Service		1
DLL Search Order Hijacking		NTDS38
System Information Discovery		Distributed Component Object Model1
Clipboard Data		Scheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon Script12
Process Injection		1
File Deletion		LSA Secrets1
Query Registry		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.common1
Scheduled Task/Job		33
Masquerading		Cached Domain Credentials221
Security Software Discovery		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup Items1
Modify Registry		DCSync14
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job14
Virtualization/Sandbox Evasion		Proc Filesystem2
Process Discovery		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
Access Token Manipulation		/etc/passwd and /etc/shadow2
System Owner/User Discovery		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)12
Process Injection		Network Sniffing1
Remote System Discovery		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron1
Regsvr32		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1333246 Sample: teamviewer_Px-yDq1.exe Startdate: 27/10/2023 Architecture: WINDOWS Score: 42 225 Antivirus detection for dropped file 2->225 227 Antivirus / Scanner detection for submitted sample 2->227 229 Multi AV Scanner detection for submitted file 2->229 231 Writes many files with high entropy 2->231 13 teamviewer_Px-yDq1.exe 2 2->13         started        16 TeamViewer_.exe 2->16         started        18 svchost.exe 2->18         started        21 servicehost.exe 2->21         started        process3 dnsIp4 153 C:\Users\user\...\teamviewer_Px-yDq1.tmp, PE32 13->153 dropped 23 teamviewer_Px-yDq1.tmp 3 13 13->23         started        155 C:\Windows\Temp\nscC342.tmp\nsExec.dll, PE32 16->155 dropped 157 C:\Windows\Temp\nscC342.tmp\nsArray.dll, PE32 16->157 dropped 159 C:\Windows\Temp\nscC342.tmp\System.dll, PE32 16->159 dropped 27 schtasks.exe 16->27         started        179 69.192.108.161 AKAMAI-ASUS United States 18->179 181 127.0.0.1 unknown unknown 18->181 file5 process6 dnsIp7 197 3.162.115.26 AMAZON-02US United States 23->197 129 C:\Users\user\AppData\Local\...\is-MAUM5.tmp, PE32 23->129 dropped 131 (copy), PE32 23->131 dropped 133 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 23->133 dropped 29 file_Px-yDq1.exe 2 23->29         started        32 conhost.exe 27->32         started        file8 process9 file10 161 C:\Users\user\AppData\...\file_Px-yDq1.tmp, PE32 29->161 dropped 34 file_Px-yDq1.tmp 5 42 29->34         started        process11 dnsIp12 183 95.168.168.24 LEASEWEB-NL-AMS-01NetherlandsNL Netherlands 34->183 185 172.67.75.124 CLOUDFLARENETUS United States 34->185 187 108.138.82.87 AMAZON-02US United States 34->187 103 C:\Users\user\Downloads\teamviewer.exe, PE32 34->103 dropped 105 C:\Users\...\avg_antivirus_free_setup.exe, PE32 34->105 dropped 107 C:\Users\user\AppData\Local\...\saBSI.exe, PE32 34->107 dropped 109 4 other files (3 malicious) 34->109 dropped 233 Writes many files with high entropy 34->233 39 avg_antivirus_free_setup.exe 1 3 34->39         started        44 teamviewer.exe 34->44         started        46 saBSI.exe 9 8 34->46         started        48 chrome.exe 34->48         started        file13 signatures14 process15 dnsIp16 199 142.251.167.102 GOOGLEUS United States 39->199 201 34.117.223.223 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 39->201 203 23.52.164.133 AKAMAI-ASUS United States 39->203 135 C:\...\avg_antivirus_free_online_setup.exe, PE32 39->135 dropped 245 Query firmware table information (likely to detect VMs) 39->245 50 avg_antivirus_free_online_setup.exe 28 39->50         started        137 C:\Users\user\AppData\...\TvGetVersion.dll, PE32 44->137 dropped 139 C:\Users\user\AppData\...\TeamViewer_.exe, PE32 44->139 dropped 141 C:\Users\user\AppData\Local\...\System.dll, PE32 44->141 dropped 247 Writes many files with high entropy 44->247 55 TeamViewer_.exe 44->55         started        205 23.222.5.155 TISCALI-IT United States 46->205 207 104.18.21.226 CLOUDFLARENETUS United States 46->207 209 54.244.227.179 AMAZON-02US United States 46->209 143 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 46->143 dropped 57 installer.exe 46->57         started        211 2 other IPs or domains 48->211 59 chrome.exe 48->59         started        file17 signatures18 process19 dnsIp20 189 104.79.85.95 AKAMAI-ASUS United States 50->189 111 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 50->111 dropped 113 C:\Windows\Temp\...\icarus_mod.dll, PE32 50->113 dropped 115 C:\Windows\Temp\...\icarus.exe, PE32+ 50->115 dropped 123 9 other malicious files 50->123 dropped 235 Query firmware table information (likely to detect VMs) 50->235 237 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 50->237 239 Writes many files with high entropy 50->239 61 icarus.exe 50->61         started        117 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 55->117 dropped 119 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 55->119 dropped 121 C:\Users\user\AppData\...\TvGetVersion.dll, PE32 55->121 dropped 125 65 other files (58 malicious) 55->125 dropped 241 Writes a notice file (html or txt) to demand a ransom 55->241 243 Uses schtasks.exe or at.exe to add and modify task schedules 55->243 66 schtasks.exe 55->66         started        68 schtasks.exe 55->68         started        70 conhost.exe 55->70         started        127 21 other malicious files 57->127 dropped 72 installer.exe 57->72         started        191 192.184.68.134 QUANTCASTUS United States 59->191 193 192.184.68.166 QUANTCASTUS United States 59->193 195 59 other IPs or domains 59->195 file21 signatures22 process23 dnsIp24 215 34.160.176.28 ATGS-MMD-ASUS United States 61->215 217 23.196.181.36 AKAMAI-ASUS United States 61->217 223 2 other IPs or domains 61->223 163 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 61->163 dropped 165 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 61->165 dropped 167 C:\Windows\Temp\...\icarus_product.dll, PE32+ 61->167 dropped 175 18 other malicious files 61->175 dropped 253 Query firmware table information (likely to detect VMs) 61->253 255 Writes many files with high entropy 61->255 74 icarus.exe 61->74         started        79 icarus.exe 61->79         started        81 conhost.exe 66->81         started        83 conhost.exe 68->83         started        219 34.211.161.85 AMAZON-02US United States 72->219 221 44.240.196.74 AMAZON-02US United States 72->221 169 C:\Program Files\McAfee\...\wssdep.dll, PE32+ 72->169 dropped 171 C:\Program Files\McAfee\...\downloadscan.dll, PE32+ 72->171 dropped 173 C:\Program Files\McAfee\...\wssdep.dll, PE32 72->173 dropped 177 17 other malicious files 72->177 dropped 85 sc.exe 72->85         started        87 regsvr32.exe 72->87         started        89 sc.exe 72->89         started        91 5 other processes 72->91 file25 signatures26 process27 dnsIp28 213 23.202.53.64 AKAMAI-ASUS United States 74->213 145 C:\Windows\System32\icarus_rvrt.exe, PE32+ 74->145 dropped 147 C:\...\snxhk.dll.ipending.70faf5db, PE32 74->147 dropped 149 C:\...\gaming_hook.exe.ipending.70faf5db, PE32 74->149 dropped 151 245 other malicious files 74->151 dropped 249 Query firmware table information (likely to detect VMs) 74->249 251 Writes many files with high entropy 74->251 93 conhost.exe 85->93         started        95 regsvr32.exe 87->95         started        97 conhost.exe 89->97         started        99 conhost.exe 91->99         started        101 regsvr32.exe 91->101         started        file29 signatures30 process31

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
teamviewer_Px-yDq1.exe22%ReversingLabsWin32.PUA.InstallCore
teamviewer_Px-yDq1.exe25%VirustotalBrowse
teamviewer_Px-yDq1.exe100%AviraPUA/OfferCore.Gen

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\is-MAUM5.tmp100%AviraPUA/OfferCore.Gen
C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\is-MAUM5.tmp100%Joe Sandbox ML
C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe0%ReversingLabs
C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TVWebRTC.dll4%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TVWebRTC.dll1%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll0%VirustotalBrowse
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll0%ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://openjsf.org/0%URL Reputationsafe
https://download.it?typ=10%Avira URL Cloudsafe
https://www.booking.0%Avira URL Cloudsafe
https://www.booking.c0%Avira URL Cloudsafe
http://www.cnri.reston.va.us)0%Avira URL Cloudsafe
https://download.it?typ=10%VirustotalBrowse
https://www.booking.0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://clients2.google.com/service/update2/crxdregsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    https://github.com/npm/move-fileTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
      		high
      https://webcompanion.com/termsfile_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/indutny/select-hoseTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          https://github.com/browserslist/browserslistTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://github.com/crypto-browserify/buffer-xorTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://clients2.google.com/service/update2/crx_regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                https://github.com/webpack-contrib/source-map-loaderTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/jonschlinkert/fill-rangeTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/npm/fsTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://www.booking.com/general.en.html?tmpl=docs/7file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/silverwind/default-gatewayTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://gitlab.com/philbooth/hoopyTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            http://clients2.google.com/service/update2/crxvregsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/hughsk/from2TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://honzik.avcdn.net/defs/avg-av/release.xml.lzmaavg_antivirus_free_online_setup.exe, 00000009.00000003.2654552819.00000000034A3000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://community.teamviewer.com/English/kb/articles/108794-system-requirements-for-teamviewer-engagTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://github.com/chalk/slice-ansiTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.teamviewer.com/link/?url=271351$PridaeTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://github.com/moxystudio/node-cross-spawnTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/nodejs/string_decoderTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://www.booking.cfile_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://clients2.google.com/service/update2/crxhregsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/inspect-js/is-symbolTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/reduxjs/reduxTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://clients2.google.com/service/update2/crxCregsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://openjsf.org/TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://www.booking.com/content/terms.en-gb.htm)file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://github.com/es-shims/Array.prototype.reduceTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://github.com/babel/babelTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.teamviewer.com/en/product-descriptions/TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://download.it?typ=1file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A3F000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296553226.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2925623111.0000000000A38000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A46000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2741305958.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000002.2921169236.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2717260823.00000000075CB000.00000004.00001000.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • 0%, Virustotal, Browse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://github.com/jonathantneal/postcss-gap-propertiesTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/wesleytodd/setprototypeofTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://community.teamviewer.com/German/kb/articles/26239-welche-betriebssysteme-werden-fuer-teamvieTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://github.com/react-dropzone/attr-acceptTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://github.com/sindresorhus/import-localTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.booking.com/content/terms.en-gb.htmlfile_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2713845224.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2685023190.0000000000A30000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2740933044.0000000000A4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.booking.com/general.en.html?tmpl=docs/pfile_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/jslicense/spdx-license-ids/tree/v3.0.12#licenseTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://github.com/sindresorhus/caller-pathTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/mafintosh/flush-write-streamTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/sindresorhus/p-each-seriesTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://login.teamviewer.com/nav/license-activation-guidanceTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/amasad/saneTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.teamviewer.com/link/?url=461825ZYourTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://github.com/TehShrike/deepmergeTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.teamviewer.com/link/?url=666256TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/i18next/i18next-resources-to-backendTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/postcss/postcss-color-grayTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://github.com/indutny/node-ip/tree/v1.1.8#licenseTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://github.com/libuv/libuvTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://nsis.sf.net/NSIS_Errorteamviewer.exe, teamviewer.exe, 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmp, teamviewer.exe, 0000000A.00000000.2659158723.0000000000409000.00000008.00000001.01000000.00000014.sdmpfalse
                                                                                                      		high
                                                                                                      https://github.com/npm/normalize-package-dataTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://github.com/eslint/eslintTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/crypto-browserify/publicEncryptTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://github.com/devongovett/browserify-zlibTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exeTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://github.com/STRML/react-grid-layoutTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://github.com/inspect-js/is-number-objectTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.teamviewer.com/de/product-descriptions/#assistarTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.booking.file_Px-yDq1.tmp, 00000004.00000003.2297162222.0000000000A34000.00000004.00000020.00020000.00000000.sdmp, file_Px-yDq1.tmp, 00000004.00000003.2296429919.0000000000A2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      • 0%, Virustotal, Browse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      https://github.com/danethurber/webpack-manifest-pluginTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://github.com/Rich-Harris/is-reference.gitTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/protocolbuffers/protobufTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/browserify/console-browserifyTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://github.com/watson/dns-txtTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://github.com/hapijs/topoTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/jshttp/on-headersTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/sindresorhus/callsitesTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.ssl.com/repository/SSL.com-Enterprise-Intermediate-codeSigning-RSA-4096-R1.crt0teamviewer_Px-yDq1.exe, 00000000.00000003.2208463994.000000007FE33000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.exe, 00000000.00000003.2207970820.0000000002877000.00000004.00001000.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000003.2325139622.0000000000961000.00000004.00000020.00020000.00000000.sdmp, teamviewer_Px-yDq1.tmp, 00000002.00000002.2328491039.0000000003708000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml/saBSI.exe, 00000007.00000003.2657344323.00000000051FE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000007.00000003.2667782343.00000000051FE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/jfromaniello/selfsignedTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://github.com/sinonjs/commonsTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/jridgewell/sourcemap-codecTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/jsdom/ababTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://github.com/nodejs/nan#wg-members--collaboratorsTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://www.teamviewer.com/link/?url=737863TeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://github.com/TooTallNate/node-https-proxy-agent/tree/5.0.1#licenseTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://sadownload.mcafee.com/saBSI.exe, 00000007.00000003.2683207743.000000000092E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://frontlinedocs.teamviewer.com/solutionoverviewTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://www.mcafee.com/consumer/en-us/policy/legal.html9/avg.zipI.zifile_Px-yDq1.tmp, 00000004.00000003.2605804435.0000000003997000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://github.com/sindresorhus/define-lazy-propTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://clients2.google.com/service/update2/crx%regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&osTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://clients2.google.com/service/update2/crx#regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.com/shrpne/postcss-page-breakTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://www.cnri.reston.va.us)TeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        		low
                                                                                                                                                                        http://median-a1.iavs9x.u.avast.com/iavs9x/avast_one_essential_setup_online.exeavg_antivirus_free_online_setup.exe, 00000009.00000003.2836178666.0000000005B98000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/crypto-browserify/md5.jsTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe7avg_antivirus_free_setup.exe, 00000008.00000003.2619134220.00000000052EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://clients2.google.com/service/update2/crx4regsvr32.exe, 00000027.00000003.3193907352.0000000002ED9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/jonschlinkert/map-visitTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz)PlatnoseTeamViewer_.exe, 0000000E.00000003.2997019856.000000000B0ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://d2nko69k18f2wb.cloudfront.net/installer/737209/825485955765064.teamviewer_Px-yDq1.tmp, 00000002.00000003.2325172878.00000000008C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://github.com/eslint/doctrineTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://github.com/FB55/domutilsTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/es-shims/Object.hasOwnTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/csstools/postcss-preset-envTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://github.com/chalk/ansi-stylesTeamViewer_.exe, 0000000E.00000003.2876357773.0000000008776000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high

                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                172.253.62.154
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                142.251.163.106
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                142.251.16.132
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                3.162.115.26
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                151.101.1.91
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		54113FASTLYUSfalse
                                                                                                                                                                                                172.253.63.155
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.122.84
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                130.211.23.194
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                104.20.218.77
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                23.196.181.36
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                104.79.85.95
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                172.253.115.101
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                104.22.52.86
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                34.211.161.85
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                35.190.80.1
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.62.147
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                54.244.227.179
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                52.85.151.59
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                142.250.31.95
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                35.71.131.137
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		237MERIT-AS-14USfalse
                                                                                                                                                                                                142.251.111.99
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                1.1.1.1
                                                                                                                                                                                                		unknownAustralia
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                104.26.2.70
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                3.216.245.48
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		14618AMAZON-AESUSfalse
                                                                                                                                                                                                172.253.122.149
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                34.149.135.28
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                                23.196.61.56
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                172.253.63.94
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                18.67.76.19
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                142.251.167.138
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                142.251.16.101
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                23.222.5.155
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		8612TISCALI-ITfalse
                                                                                                                                                                                                172.253.63.147
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                52.73.171.96
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		14618AMAZON-AESUSfalse
                                                                                                                                                                                                172.253.122.94
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.63.154
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                239.255.255.250
                                                                                                                                                                                                		unknownReserved
                                                                                                                                                                                                		unknownunknownfalse
                                                                                                                                                                                                172.253.63.99
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.67.74.191
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                172.253.115.155
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                108.138.82.87
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                172.253.62.157
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                104.26.3.70
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                141.95.98.64
                                                                                                                                                                                                		unknownGermany
                                                                                                                                                                                                		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
                                                                                                                                                                                                141.95.98.65
                                                                                                                                                                                                		unknownGermany
                                                                                                                                                                                                		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
                                                                                                                                                                                                142.251.167.102
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                104.26.14.127
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                23.52.164.133
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                142.251.16.156
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                142.251.167.149
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                142.251.16.157
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.122.155
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.122.156
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                95.168.168.24
                                                                                                                                                                                                		unknownNetherlands
                                                                                                                                                                                                		60781LEASEWEB-NL-AMS-01NetherlandsNLfalse
                                                                                                                                                                                                69.192.108.161
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                44.240.196.74
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                141.95.33.111
                                                                                                                                                                                                		unknownGermany
                                                                                                                                                                                                		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
                                                                                                                                                                                                172.253.62.97
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                192.184.68.166
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		27281QUANTCASTUSfalse
                                                                                                                                                                                                104.16.57.101
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                96.17.65.118
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                142.251.163.94
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.253.115.95
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                216.239.36.181
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                23.202.53.64
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16625AKAMAI-ASUSfalse
                                                                                                                                                                                                142.251.163.132
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                172.67.75.124
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                104.18.21.226
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                13.32.195.219
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                                                                34.160.176.28
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                                52.44.0.179
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		14618AMAZON-AESUSfalse
                                                                                                                                                                                                52.223.22.214
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		8987AMAZONEXPANSIONGBfalse
                                                                                                                                                                                                34.117.223.223
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                172.253.115.139
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                192.184.68.215
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		27281QUANTCASTUSfalse
                                                                                                                                                                                                104.22.74.216
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                192.184.68.134
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		27281QUANTCASTUSfalse
                                                                                                                                                                                                172.253.115.132
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                35.153.13.157
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		14618AMAZON-AESUSfalse
                                                                                                                                                                                                162.19.138.118
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		209CENTURYLINK-US-LEGACY-QWESTUSfalse
                                                                                                                                                                                                104.26.15.127
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                Private

                                                                                                                                                                                                IP
                                                                                                                                                                                                192.168.2.6
                                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                                General Information

                                                                                                                                                                                                Joe Sandbox Version:38.0.0 Ammolite
                                                                                                                                                                                                Analysis ID:1333246
                                                                                                                                                                                                Start date and time:2023-10-27 14:33:59 +02:00
                                                                                                                                                                                                Joe Sandbox Product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 14m 52s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                                                                Number of analysed new started processes analysed:42
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample file name:teamviewer_Px-yDq1.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal42.rans.evad.winEXE@80/2012@0/83
                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                • Successful, ratio: 75%
                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                • Successful, ratio: 74%
                                                                                                                                                                                                • Number of executed functions: 146
                                                                                                                                                                                                • Number of non-executed functions: 71
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                                                Warnings

                                                                                                                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                • Execution Graph export aborted for target installer.exe, PID 3968 because there are no executed function
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                                                • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                                                                                Simulations

                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                14:35:58Task SchedulerRun new task: TVInstallRestore path: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" s>/RESTORE

                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                IPs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                104.20.218.77http://097689.260mb.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • www.statcounter.com/counter/counter.js
                                                                                                                                                                                                http://reservaellineapersona.atsnx.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • www.statcounter.com/counter/counter.js
                                                                                                                                                                                                hxxp://outlook3655%5B.%5Dvastserve%5B.%5Dcom/login%5B.%5Dlive%5B.%5Dcom_login_verify_credentials_outlook%5B.%5DhtmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • www.statcounter.com/counter/counter.js
                                                                                                                                                                                                151.101.1.91file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  http://lovekizoar.liveGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    https://caribtix.com/event-details?eid=90622&mc_cid=c4132bb49f&mc_eid=UNIQIDGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      https://iongterm-offer.lovely-bright.bond/676f/amazing-2bd-2ba-christchurch-central-city-christchurch-8013/eb8886Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        https://paroquiaguiacuiaba.com.br/wp-admin/a#gbushnell@rdgusa.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          https://filehippo.com/download_xumouseGet hashmaliciousRedAlertBrowse
                                                                                                                                                                                                            https://andbu.resourcequickbook.click/?oik=mqpevbWFyeS5oYXR6QG1pbm5lc290YWVuZXJneXJlc291cmNlcy5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                              picasa-3.9.141.303-installer_8atA-M1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                picasa-3.9.141.303-installer_8atA-M1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  victoria-ssd-hdd_xI-yRO1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    http://bounce.dialogue.coGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      http://dialogue.coGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        https://www.jcogs.org/track.php?id=8234c36f03c645e3a0436ca93afbfaa0&color=8c8c8c&url=https://ams3.digitaloceanspaces.com/eths2673jw8291/QW2154765445b-32c6-49b0-83e6.htm#YnJlbmRhbi5tYWhvbkBrYmMuaWU=Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          https://temp-rgsxywerhhbzwdbcugyp.webador.com/?_gl=1*19q69zb*_ga*MjExMTI4Njk5My4xNjc0ODI4ODUx*_ga_E6PZPGE4QM*MTY3NTA2OTYzMC41LjEuMTY3NTA3MTU1OC4wLjAuMA..Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            https://temp-rgsxywerhhbzwdbcugyp.webador.com/?_gl=1*19q69zb*_ga*MjExMTI4Njk5My4xNjc0ODI4ODUx*_ga_E6PZPGE4QM*MTY3NTA2OTYzMC41LjEuMTY3NTA3MTU1OC4wLjAuMA..Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              https://www.enclosed-docs.net/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                microsoft-edge_gXo7-D1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  microsoft-edge_gXo7-D1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    microsoft-edge_gXo7-D1.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                      Domains

                                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      FASTLYUShttps://usps.uspskkk.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.64.84
                                                                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                                      • 151.101.65.21
                                                                                                                                                                                                                                      https://www.fio.cz/bank-services/internetbanking-apiGet hashmaliciousSTRRATBrowse
                                                                                                                                                                                                                                      • 151.101.1.229
                                                                                                                                                                                                                                      https://bestandssm.xyz/product_details/3974767.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.0.155
                                                                                                                                                                                                                                      https://r20.rs6.net/tn.jsp?f=001fnceSdmaaNUV8eetNpehU13V_dlSdoIQLlSufkjJkyQiliqH1cIB0BjsFPuQdFat3HilYNkCYbPtxcvJ8VOMI_mlwpez1RwkL9XLAWIUDo6hyO0cRWP0TJshPtbPNOe0wiOb9xrLFJ324D_FnHBMJoIOENtEryYM&c=&ch=&__=/asdf/enNhZmFyQGZhcmFoZXhwZXJpZW5jZXMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.65.229
                                                                                                                                                                                                                                      https://r20.rs6.net/tn.jsp?f=001fnceSdmaaNUV8eetNpehU13V_dlSdoIQLlSufkjJkyQiliqH1cIB0BjsFPuQdFat3HilYNkCYbPtxcvJ8VOMI_mlwpez1RwkL9XLAWIUDo6hyO0cRWP0TJshPtbPNOe0wiOb9xrLFJ324D_FnHBMJoIOENtEryYM&c=&ch=&__=/asdf/enNhZmFyQGZhcmFoZXhwZXJpZW5jZXMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.1.229
                                                                                                                                                                                                                                      http://fightinggullyroadwines.com.au/shop/2017-Aglianico-Beechworth-p140185982Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.65.21
                                                                                                                                                                                                                                      https://cloudflare-ipfs.com/ipfs/QmcJr7uDEi8UA3xStQsp51VrbV18LTPts7u1rBvEveqpt2/index2kim1610.html#meainfo@energy.state.md.usGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.2.137
                                                                                                                                                                                                                                      https://pub-2598caa00dcf4c658bf8753f6761f962.r2.dev/compki.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.2.137
                                                                                                                                                                                                                                      http://47.102.120.37/pc/index.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.193.26
                                                                                                                                                                                                                                      https://pub-4fdbb77a22ae415dbd5e34989a2a8e5d.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.66.137
                                                                                                                                                                                                                                      SWbDGRCFU4.exeGet hashmaliciousAmadey, Babadeda, Glupteba, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                      • 151.101.2.133
                                                                                                                                                                                                                                      http://dmihgm.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.2.133
                                                                                                                                                                                                                                      https://steancomnutity.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.129.229
                                                                                                                                                                                                                                      https://steampowerad.top/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.1.229
                                                                                                                                                                                                                                      https://longhaired-locrian-box.glitch.me/kalo.shtmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.65.229
                                                                                                                                                                                                                                      Remittance.htmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.130.137
                                                                                                                                                                                                                                      https://moli.nl-ams-1.linodeobjects.com/link.html#Y2hhZC5jb2hlbkBjYXBlbGxhc3BhY2UuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 151.101.66.137
                                                                                                                                                                                                                                      https://metaobservation.com/98561234617931/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 151.101.2.137
                                                                                                                                                                                                                                      CLOUDFLARENETUShttps://usps.uspskkk.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 172.64.151.101
                                                                                                                                                                                                                                      https://meta-violation-2e2b8.web.app/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.26.9.44
                                                                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                                      • 1.1.1.1
                                                                                                                                                                                                                                      http://hubbardcon.comGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.17.2.184
                                                                                                                                                                                                                                      bexj1tfMZF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 172.67.165.77
                                                                                                                                                                                                                                      bexj1tfMZF.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                                      • 172.67.165.77
                                                                                                                                                                                                                                      https://take.quiz-maker.com/poll4967948x2A0045Cb-152Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.26.3.190
                                                                                                                                                                                                                                      saham.apkGet hashmaliciousIrataBrowse
                                                                                                                                                                                                                                      • 172.67.136.157
                                                                                                                                                                                                                                      saham.apkGet hashmaliciousIrataBrowse
                                                                                                                                                                                                                                      • 172.67.176.15
                                                                                                                                                                                                                                      https://r20.rs6.net/tn.jsp?f=001zhtTQPxU58q5ZLgeQOgQthqjZn4aCT7k6VLt-CGvyK60Sb45i37H_6BRJIJSY0rc4c3yADcURNqMUSu_nLLkDRikJRo1vEM-NPNMDIVhsaY01deiFtr-6Ttc3o2J5AR7lUJlj8sK4Z5Qm9x231O0J9Q3-C0mZos4&c=&ch==&__=/asdf/cml0YS5zYW50b3NAbm92b2JhbmNvLnB0Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.16.126.175
                                                                                                                                                                                                                                      uM5nD8x8pc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                      • 1.12.59.177
                                                                                                                                                                                                                                      Fiyat_teklifi_Istegi_23070_PER_1000_Adet_#U2026scanneed_00101.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 162.159.135.233
                                                                                                                                                                                                                                      saham.apkGet hashmaliciousIrataBrowse
                                                                                                                                                                                                                                      • 104.21.88.38
                                                                                                                                                                                                                                      saham.apkGet hashmaliciousIrataBrowse
                                                                                                                                                                                                                                      • 104.21.34.131
                                                                                                                                                                                                                                      saham.apkGet hashmaliciousIrataBrowse
                                                                                                                                                                                                                                      • 172.67.141.243
                                                                                                                                                                                                                                      http://bthgruop.com/Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.17.3.184
                                                                                                                                                                                                                                      https://bestandssm.xyz/product_details/3974767.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.19.166.65
                                                                                                                                                                                                                                      https://r20.rs6.net/tn.jsp?f=001fnceSdmaaNUV8eetNpehU13V_dlSdoIQLlSufkjJkyQiliqH1cIB0BjsFPuQdFat3HilYNkCYbPtxcvJ8VOMI_mlwpez1RwkL9XLAWIUDo6hyO0cRWP0TJshPtbPNOe0wiOb9xrLFJ324D_FnHBMJoIOENtEryYM&c=&ch=&__=/asdf/enNhZmFyQGZhcmFoZXhwZXJpZW5jZXMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.17.2.184
                                                                                                                                                                                                                                      https://r20.rs6.net/tn.jsp?f=001fnceSdmaaNUV8eetNpehU13V_dlSdoIQLlSufkjJkyQiliqH1cIB0BjsFPuQdFat3HilYNkCYbPtxcvJ8VOMI_mlwpez1RwkL9XLAWIUDo6hyO0cRWP0TJshPtbPNOe0wiOb9xrLFJ324D_FnHBMJoIOENtEryYM&c=&ch=&__=/asdf/enNhZmFyQGZhcmFoZXhwZXJpZW5jZXMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • 104.17.2.184
                                                                                                                                                                                                                                      AMAZON-02USwinzip28-home.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 52.85.150.135
                                                                                                                                                                                                                                      https://usps.uspskkk.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 13.249.39.83
                                                                                                                                                                                                                                      file.exeGet hashmaliciousAmadey, Babadeda, Mystic Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                                      • 99.84.191.128
                                                                                                                                                                                                                                      TfDRPk2e2h.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                      • 44.237.172.188
                                                                                                                                                                                                                                      mLf8TFyZ7u.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                                                                                                      • 13.248.169.48
                                                                                                                                                                                                                                      pkZ5uRHF7Y.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                      • 54.126.35.195
                                                                                                                                                                                                                                      9jOZGah54d.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 34.243.160.129
                                                                                                                                                                                                                                      jujWdzZQJK.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                      • 54.72.82.193
                                                                                                                                                                                                                                      egE6WTlcV7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 54.247.62.1
                                                                                                                                                                                                                                      https://bestandssm.xyz/product_details/3974767.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 13.249.39.106
                                                                                                                                                                                                                                      8mgZbXQeL1.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                                                      • 18.158.249.75
                                                                                                                                                                                                                                      http://fightinggullyroadwines.com.au/shop/2017-Aglianico-Beechworth-p140185982Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 54.239.153.168
                                                                                                                                                                                                                                      Application_Form_Bonobos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 3.135.132.32
                                                                                                                                                                                                                                      Application_Form_Bonobos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 13.249.98.93
                                                                                                                                                                                                                                      https://kuaraenergy.com/.o365.php?url=https://videokicks.com/BM2ak17k17Fe5ydy9s3Rhri2Psx0qbs3Rgdy9s3RWO3BM2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 99.84.191.81
                                                                                                                                                                                                                                      https://cloudflare-ipfs.com/ipfs/QmcJr7uDEi8UA3xStQsp51VrbV18LTPts7u1rBvEveqpt2/index2kim1610.html#meainfo@energy.state.md.usGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 52.85.151.31
                                                                                                                                                                                                                                      dwA3Y86oKf.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 130.178.41.200
                                                                                                                                                                                                                                      ecJKNzTEUg.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                      • 13.225.136.171
                                                                                                                                                                                                                                      http://47.102.120.37/pc/index.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 3.114.224.181

                                                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                                                      ⊘No context

                                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                                      (copy)

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2457016
                                                                                                                                                                                                                                      Entropy (8bit):7.708667186018291
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:6qe3f6aje0NQq5rISAGF6KDaaAexGENRbUgPVlDlp:TSiUNNC7exGa/xlbLP/hp
                                                                                                                                                                                                                                      MD5:EE66976DF0A5C903F5A718ABF3E8AC85
                                                                                                                                                                                                                                      SHA1:318A2ECA8E968701A07F3865D6023B3933E5C30F
                                                                                                                                                                                                                                      SHA-256:0A9F97CF2F9CA211C6986EF572C852B48098D3C6C28020229334AC788339A32D
                                                                                                                                                                                                                                      SHA-512:FB756836AE30F0480ED98F32B409A81B3E0CEDA2A93267A1729497791F9CE7993BF7F72719949AB1130D442F390882CA24CD968BA6A64E47693D089BD529ABBB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...n.._.................P...........^.......p....@.................................R.%...@......@...................@....... ..6....p...H...........O%..-...................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\RollbackTemp\TV15Install.log

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1199
                                                                                                                                                                                                                                      Entropy (8bit):5.12286022951852
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:HyC+zzDkwHyNKwDngZHZP7gEHZP6gTHZPQMAQMIf191u4aMcu4aMZu4aMzGEeCMR:HyC+zcwHyNjngZHx7gEHx6gTHxqafNuk
                                                                                                                                                                                                                                      MD5:DE7BDA80319AC8380C0A4361954FDD6F
                                                                                                                                                                                                                                      SHA1:8E4199945BF9D6E0D4DE66CE62CCB5BC3B1D615A
                                                                                                                                                                                                                                      SHA-256:7B3537ADCC8FE9D46CC723DBDB8C8C4264301B2D5B37D32791A1A17726FC5308
                                                                                                                                                                                                                                      SHA-512:CD1DFB24A52DD38BFF48816C9D295BE16291B3C395CEC20123C85D3EC3B96853F0F42FDA6B5D05118CD3292742E3E148EECACEE499B353841C6263BBA92EEEA1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:2023-10-27-14-36-02 ..2023-10-27-14-36-02 TVRollbackInstallation(): Rollback installation.....2023-10-27-14-36-02 ..2023-10-27-14-36-02 RollbackDrvChanges(): Rollback all driver changes.....2023-10-27-14-36-03 RollbackDrvChanges(): No driver entries to restore...2023-10-27-14-36-03 ..2023-10-27-14-36-03 RollbackRegChanges(): Rollback all registry changes.....2023-10-27-14-36-03 RollbackRegChanges(): No registry entries to restore...2023-10-27-14-36-03 ..2023-10-27-14-36-03 RollbackFileChanges(): Rollback all file changes.....2023-10-27-14-36-03 RollbackFileChanges(): No file entries to restore...2023-10-27-14-36-03 ..2023-10-27-14-36-03 CleanUp(): Clean up.....2023-10-27-14-36-03 CleanUp(): Unload previously loaded user registry profiles.....2023-10-27-14-36-05 CleanUp(): Install restore task successful removed...2023-10-27-14-36-05 CleanUp(): Warning! Backup key could not be removed...2023-10-27-14-36-05 CleanUp(): Backup directory C:\Program Files (x86)\TeamViewer\Ro

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42543224
                                                                                                                                                                                                                                      Entropy (8bit):7.997942604118609
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:b5bTkNde3NvoxYDk49MvgsV7FzV83hUcvPYRYntnwHu/olv1qR:bGedowMRFzV8xZvP+YntnwHiR
                                                                                                                                                                                                                                      MD5:2E185F8A6622BC3062254F6F195ACC81
                                                                                                                                                                                                                                      SHA1:B99F246AFB7749FDE563CBD37F217FE5D2A80585
                                                                                                                                                                                                                                      SHA-256:F46F2978F32714C142B92569173FC68B2DC1374D988F6F041F7EAE0190C5BF9E
                                                                                                                                                                                                                                      SHA-512:CF9C58DD76E40C132BB7ACC057026AD41282639CBF27EBF27C7296C52C9AAB64AED08663CE82A31A9DB6035BE6F23CCB0EA021C228556E7B94BF15A27585A3E9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P..*_...P...P..OP..*_...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................'.....@..........................................P..@...........@...8/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\CopyrightFULL.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3595388
                                                                                                                                                                                                                                      Entropy (8bit):5.197547640892696
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:kaGDnvcS2msm3mTukDzutu2CmnbPmHmb3vHSL3xOgufVPLQ/0HoL9mcVKq8kJYwR:ODnRGSRBVq/uarQaKj8
                                                                                                                                                                                                                                      MD5:1947EA5BF7587F1EF50B65AA724D6108
                                                                                                                                                                                                                                      SHA1:712FC1D598DF20E6E234A5F1410E8681E954AFFD
                                                                                                                                                                                                                                      SHA-256:2E7BE879E05B2F6E3D87759F1B73C88D1F72C407BE448CD7E1A285BC5D41A737
                                                                                                                                                                                                                                      SHA-512:0EAD8DEF904D6257E7F52C35F4ECB46552CD31047636E10181F7BA1C17E87B76976A6125382A9F84F930F1F350DDB1DDFF301D49AC1EDE95A474593432ACF7B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:##########....@ampproject/remapping@2.2.0....https://github.com/ampproject/remapping....License type: Apache-2.0...... Apache License.. Version 2.0, January 2004.. http://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.... 1. Definitions..... "License" shall mean the terms and conditions for use, reproduction,.. and distribution as defined by Sections 1 through 9 of this document..... "Licensor" shall mean the copyright owner or entity authorized by.. the copyright owner that is granting the License..... "Legal Entity" shall mean the union of the acting entity and all.. other entities that control, are controlled by, or are under common.. control with that entity. For the purposes of this definition,.. "control" means (i) the power, direct or indirect, to cause the.. direction or management of such entity, whether by

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1310
                                                                                                                                                                                                                                      Entropy (8bit):4.963079132684424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:nRLN+HfIPXHfMuubDUHeLNIWfpInUH2LpjLFAON+HfIPXHfROubDUHV5yn:C/IPX/ib2CISABm/IPX/RXb26
                                                                                                                                                                                                                                      MD5:E5121693356198A36982BABB96272404
                                                                                                                                                                                                                                      SHA1:EFF3A59DE3B562BED53FD08C5C91FAE739109D4A
                                                                                                                                                                                                                                      SHA-256:8E24B8D8D0305962542DBB21492ACA797F20D624ED4B0194105FBFE52E1CDBEB
                                                                                                                                                                                                                                      SHA-512:A862949D782607961882AAA62D1CA03BF86C61E8DD902E92AE7BF784E9B225F99613D843B16AE94EBDDA2E30B5568E202C16784CE09309B92922CE7D00EF1E55
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<Filters>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85D1C7ECB046}".. name = "TeamViewer_XPSDriverFilter1">.. <Input guid = "{4d47a67c-66cc-4430-850e-daf466fe5bc4}" comment="IID_IPrintReadStream"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream"/>.. </Filter>.. <Filter dll = "PDFRenderFilter.dll".. clsid = "{CD087E95-A362-4A50-B233-20DC89DED268}".. name = "MS XPS to PDF">.. <Input guid = "{b8cf8530-5562-47c4-ab67-b1f69ecf961e}" Comment ="IID_IXpsDocumentProvider"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream" />.. </Filter>.. <OptionalFilterServiceProvider dll="XpsRasterService.dll"/>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Generic INItialization configuration [DriverRender]
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):287
                                                                                                                                                                                                                                      Entropy (8bit):5.371163047122097
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:/5KsGXMfVCzpIcPxYDXQyW59bCO2MngN+jAJh6O4BVAZVhe81W8l2y:bHfkzpha8dnCOztKh6tKe8xh
                                                                                                                                                                                                                                      MD5:A578F666C0CB526085384D35C536B5D9
                                                                                                                                                                                                                                      SHA1:F019631640D4BAA684CD589696CDCF1F8252F302
                                                                                                                                                                                                                                      SHA-256:9C8859987D13AE53C5B206A7D59660C7754A7940185B599AC97E1E806551730F
                                                                                                                                                                                                                                      SHA-512:E0FBF7054A32B5C370E98A644AEC0478CC68FE5018E7B7720574E5E656C8B61FD51E712A20289DD72B38A9560D7D8633156CCF4E4302390BC180EFF1D2983729
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:[DriverConfig]..DataFile=TeamViewer_XPSDriverFilter.gpd..PrinterDriverID={4949F9E6-DB2F-47B7-9489-56815A5847C8}..RequiredFiles=UNIRES.DLL,PDFRENDERFILTER.DLL,STDNAMES.GPD,MSXPSINC.GPD..DriverCategory=PrintFax.Printer.Virtual..UserPropertyBagScope=Queue....[DriverRender]..XpsFormat=XPS..

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):66209
                                                                                                                                                                                                                                      Entropy (8bit):4.11237765266599
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:3E513+/TLYbpmS1Gx5M7ytzk9wjKS0ff8sEOxPOwhKGhBmAAGFD4iaKhvmOaoGJd:Cv8
                                                                                                                                                                                                                                      MD5:B58E72E75C1CF590FA2722ECDA95F64A
                                                                                                                                                                                                                                      SHA1:651B69DAADE01DBFD7CB470B24D1C3EF2369B821
                                                                                                                                                                                                                                      SHA-256:9C77255FA10B116C1E5D1F8AB7D12A956455AD7610905DBD05EFD6FCE465C11F
                                                                                                                                                                                                                                      SHA-512:6A44613F66B93DD671546042FBD0FBE2A4B78C78AC3127E69AD8794FC53AD45F2D889E6FB59D3DA5E302B9EC3CDB787818E3DDC503A47707B9FF16B7BBE5A265
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:*%..*% Copyright (c) TeamViewer GmbH..*%..*% All rights reserved...*%....*GPDFileVersion: "1.0"..*GPDSpecVersion: "1.0"..*GPDFileName: "TeamViewer_XPSDriverFilter.GPD"..*Include: "StdNames.gpd"..*Include: "msxpsinc.gpd"..*ModelName: "TeamViewer Printer"..*MasterUnits: PAIR(1200, 1200)..*PrinterType: PAGE..*MaxCopies: 999..*PrintSchemaPrivateNamespaceURI:"http://www.teamviewer.com/printschema/2018"....*%******************************************************************************..*% Orientation..*%******************************************************************************..*Feature: Orientation..{.. *rcNameID: =ORIENTATION_DISPLAY.. *DefaultOption: PORTRAIT.... *Option: PORTRAIT.. {.. *rcNameID: =PORTRAIT_DISPLAY.. }.... *Option: LANDSCAPE_CC270.. {.. *rcNameID: =LANDSCAPE_DISPLAY.. }..}....*%******************************************************************************..*%

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1507
                                                                                                                                                                                                                                      Entropy (8bit):5.236509327317478
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:f2O7xJoF+hiEvHf+My83n8rELHfVoHfusb9ooHfhHfr7BHfVoHfusb9ooHfpHfra:uO9dhiEv/+4X1/Vo/uHo/h/PB/Vo/uHD
                                                                                                                                                                                                                                      MD5:2C5FD2866B91861275917ADB4CED33E2
                                                                                                                                                                                                                                      SHA1:E76DEB1717D3B1610A769571943A9C5C5A00699A
                                                                                                                                                                                                                                      SHA-256:B7F148ED1BA6293F323E9834182D64E8756D414FF8A5B9B826E3EE2986E0B259
                                                                                                                                                                                                                                      SHA-512:EFAAB915AD8BFA769073B4CE1FEA689FF379216D04204F8B21CFC6AA41413A94EA08E19A61613DCA29649F36E82B854861397E5E1F7C450AF7A1B656A0547267
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:;..; Copyright (c) 2022 TeamViewer GmbH..;..; All rights reserved...;..[Version]..Signature="$Windows NT$"..Class=Printer..ClassGuid={4d36e979-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_XPSDriverFilter.cat..ClassVer=4.0..DriverVer=04/13/2022,1.2022.413.641....[DestinationDirs]..DefaultDestDir = 66000....[SourceDisksNames]..1 = ,,,\....[SourceDisksFiles.x86]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x86..TeamViewer_XPSDriverFilter-manifest.ini = 1....[SourceDisksFiles.amd64]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x64..TeamViewer_XPSDriverFilter-manifest.ini = 1....[Manufacturer].."TeamViewer"=TeamViewer,NTamd64.6.1....[TeamViewer].."TeamViewer Printer" = TeamViewer_XPSDriverFilter.gpd,,TeamViewer_XPS_Printer....[TeamViewer.NTamd64.6.1].."TeamViewer Printer" = TeamViewer_XPSDriverFilte

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12658
                                                                                                                                                                                                                                      Entropy (8bit):7.077237390641632
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:28vvoHISmpMCRsGyV2uR8OL7yKnUi8rFWQFgy50Nr7OxX01k9z3Azsx+ZPb9Vt9r:2Yo3U/4CFR+y50ZSxR9zusx+x3
                                                                                                                                                                                                                                      MD5:74134E66B593D16717C8124B0DEFA42B
                                                                                                                                                                                                                                      SHA1:5FA1072B57FCE09C70904464602C1FB7AD07BDAA
                                                                                                                                                                                                                                      SHA-256:3D4201227D709C49B77031C8BEFFBFDB09337AD6E0A171A7E058B0E0B04320F6
                                                                                                                                                                                                                                      SHA-512:B3A07AF69F7F0F0163CA275C153A2155BA69D7AE5371D3390F57D6448B9B17DBA60EAA3394344F8588E0102F6EC3DE72DE8E1AB6F94B5A03F2A6C192BBD9837E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0.1n..*.H........1_0.1[...1.0...`.H.e......0..3..+.....7.....$0.. 0...+.....7...../.'._LDJ.z....!...220505065722Z0...+.....7.....0...0....R6.5.1.B.6.9.D.A.A.D.E.0.1.D.B.F.D.7.C.B.4.7.0.B.2.4.D.1.C.3.E.F.2.3.6.9.B.8.2.1...1..g0E..+.....7...17050...+.....7.......0!0...+........e.i......G.$...#i.!0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...g.p.d...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.2.5.B.8.8.3.5.7.E.0.9.2.0.8.C.8.1.E.C.5.4.4.A.5.C.9.5.2.5.B.F.D.0.9.4.C.4...1..o0M..+.....7...1?0=0...+.....7...0...........0!0...+........y.[.5~. ...TJ\.%...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):773552
                                                                                                                                                                                                                                      Entropy (8bit):6.562891536553011
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:E2qWLii0HeFTzBTqtO/zKSeAWgSd6kLsjJLPJC5Wdp24XgI7wK3l+aG7X:5qvxwdqtO/zFbWZ6WsjJzJ52Y7wK3l7i
                                                                                                                                                                                                                                      MD5:D47FE8D92AF08C8FCA8E1C71DA05CEC5
                                                                                                                                                                                                                                      SHA1:F53C8DEF485712748315BEFEB631453B594FC67F
                                                                                                                                                                                                                                      SHA-256:698FED30F5715BAA387C89D043FB0E1C8A1C4F4C8F837510DA292A943ED778ED
                                                                                                                                                                                                                                      SHA-512:DCCDC640981B68C3DDA4F949DAEED12F39C08E456588DE6BDD061CFE7BC7AEB18EC237E0358B6D6F368BC74F9B939D712363B2556BD9321C43900435BFAE6256
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................3..d.....d.....d.........................."..].....].....].&......N....].....Rich...........PE..d.....Vb.........." ................................................................G.....`............................................................. ....`...V.......I..............p.......................(.......8............ ...............................text...$........................... ..`.rdata..J.... ......................@..@.data....P.......:..................@....pdata...V...`...X..................@..@_RDATA...............j..............@..@.rsrc... ............l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TVWebRTC.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5090616
                                                                                                                                                                                                                                      Entropy (8bit):6.771941354944089
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:s4BUSqGWyZlp3lL8O94sxLHst8sbwDw3k3OkG4Og:rUuPlVeQvxL3sbYw/4B
                                                                                                                                                                                                                                      MD5:4F39058E117BFBBC8541001C6A8F039D
                                                                                                                                                                                                                                      SHA1:5821C042A54F7D55972461170D3C8C5A89D65CBB
                                                                                                                                                                                                                                      SHA-256:B40D19D16BB2BB17D589B2F22877E12E5E7FAA9C1680FBAEA200DE165A2047B2
                                                                                                                                                                                                                                      SHA-512:AA6B087EE2773FF3D6B2A80DF967857B3A12EA6A0EEA2BC6F3BC0398ECFC7DE3878826FACDE115EF307FC7299F702E39F575360B762883832C5087A9C0136EDC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........a..2..2..2...3..2...3..2...3..2...3..2...3..2...3..2...3..2..2..2..2..2...3..2...3..2...3..2...3..2..P2..2..82..2...3..2Rich..2................PE..L......c...........!......=..(........5.......=...............................N......zN...@A........................`*I.P....*I......0K.x............~M.8/...@K.t...0wE.T....................xE......wE.@.............=.d............................text.....=.......=................. ..`.rdata...}....=..~....=.............@..@.data...$....@I......,I.............@....rsrc...x....0K.......J.............@..@.reloc..t....@K.......J.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):68979000
                                                                                                                                                                                                                                      Entropy (8bit):6.676217552171922
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1572864:w7t3zCtF4IcnHYy+nWar8eN4pTjKv8HXTepMdwsjcpL0CXGm38WHLc:w7t3zCtnos8Wrc
                                                                                                                                                                                                                                      MD5:66F4AEDD14F7266A78820AAC47CA1650
                                                                                                                                                                                                                                      SHA1:0B57FB3D987137364A107D19F984A352E087EBE9
                                                                                                                                                                                                                                      SHA-256:F6A8825F72E806D7A02A5F13370A84257AC7E83E581879E34BA4935784803243
                                                                                                                                                                                                                                      SHA-512:814752411BBC819E7179D1FF245FA9F370AE6467F0D183767024D1E12A7FEC03234F22A465D2172FD559A99997EF144768F15AD4C6C7D93C8CBAC03D9FC4F409
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......u..>1..m1..m1..mW.pm8..mc..l$..mc..l-..m..pm3..m.lr..mc..lI..m.l4..mk=@mj..m.l0..m1..m...m.l...m.l...m.l5..m^.&m3..m.l...m.lm..m1..mu..m.ls.m.rm0..m1..m0..m.l0..mRich1..m................PE..L......c.....................D>.....`k............@..........................`J...........@..................................P..<....................Z..8/...`..H.,..cr.T....................dr.......'.@...............\...........................text...S........................... ..`.rdata..n...........................@..@.data.....m......D?..\..............@....didat..D...........................@....rodata.@...........................@..@.rsrc...............................@..@.reloc..H.,..`....,..b..............@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13089592
                                                                                                                                                                                                                                      Entropy (8bit):6.694955888317387
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:Vet3zCtTo7mYHyBV9Hg2fwfhASiVy8KT6VFVZ2d:Vet3zCt2yBTgMZVdKu/0
                                                                                                                                                                                                                                      MD5:8F594D61E6676B31C2A8027009C2FAF7
                                                                                                                                                                                                                                      SHA1:EA6C791B4FBCCC5E0795168704CC9C7BB12245C4
                                                                                                                                                                                                                                      SHA-256:F414A0BF358A4CCBF40460F5BB66B0014FF5377A7C6DA1689116AF2FBC762D86
                                                                                                                                                                                                                                      SHA-512:655A148A337AF27E2A2D757ADD6A7042E56EA27CB6F921D82BCCAA9C1586F59F2717318ECD6AC23DD216FCA55F4656BA56840F37AFC22B0A422E7314EC71E366
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........jR|..</..</..</.d./..</.~8...</.~?...</.W./..</`y?...</.~9...</`y8...</`y:...</`y=...</.../..</`y;...</p~9.3.</..=/u.</`y9.i.</..</..</p~8.5.</p~5...</p~./..</.../..</p~>...</Rich..</................PE..L......c.....................JA......wz...........@..........................`......3.....@.....................................<....P...f..............8/..........$(..T....................(......h...@...........................................text.............................. ..`.orpc...f.......................... ..`.rdata...B4......D4.................@..@.data...T....0...v..................@....didat.......0.......z..............@....rodata.@....@......................@..@.rsrc....f...P...h..................@..@.reloc..............................@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):583992
                                                                                                                                                                                                                                      Entropy (8bit):5.394185534545222
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:Cx5VvMavmKubBsKvJo438Vss57jqWJJcVKAOGaBdQC/joyx4:c5VvMkmKemKvW43xsnf/fBCCrV4
                                                                                                                                                                                                                                      MD5:32A57AE38F98057204574961A19E1BF6
                                                                                                                                                                                                                                      SHA1:9B7BD3A5067E49C1C8FF67DC3BB55BD9D48B3209
                                                                                                                                                                                                                                      SHA-256:106A44E1552B7C743CF843DB03867A7E36B9802A7E3E0E935BFC5FC1693C2491
                                                                                                                                                                                                                                      SHA-512:DA5D3083CF3A04A5EA1F2065CF2C76E1FD6CFCCC5EBFC0BDD086EC897BEAB4D2614BC10F471003C0E6941665F3CC3EB841931919082B42C7CEC8BF4788B8C8EF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.^1..0b..0b..0b.3c..0b.5c..0bE.4c..0bE.3c..0b&..b..0bE.5cO.0b.4c..0b.1c..0b..1b..0b.9c..0b..b..0b..b..0b.2c..0bRich..0b........................PE..L..."..c............................PK............@..................................6....@.....................................(....`..@{..............8/.......+......T...........................8...@....................... ....................text...J........................... ..`.rdata..............................@..@.data...."... ......................@....didat.......P......................@....rsrc...@{...`...|..................@..@.reloc...+.......,..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):373048
                                                                                                                                                                                                                                      Entropy (8bit):4.345058752164607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:8gtVHSTV+To6JCPChUsHZjHJzkpwleiVflN6gwTPc/Z/xj:mT1t8VcCflN6kT
                                                                                                                                                                                                                                      MD5:02D3C639E7D422E1D8E6936A7F797275
                                                                                                                                                                                                                                      SHA1:8BF10A2E3993230B767B6BEEA4DE03026331E30E
                                                                                                                                                                                                                                      SHA-256:A02232F4E48FD48FB84CC05CC4F3B72E9C8E38C7488552D803918E1D89F35676
                                                                                                                                                                                                                                      SHA-512:2E9CCF6EE75996971323065BE2D220310CFFB20728E3639BAC4B7CB9D3FC6F5C32A316B599FEA2B95218048F36E87073A187A8AFA1B5B0C7C079B73FBFBEE04F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!......................................................................@.......................................... ..@}..............8/...........................................................................................rdata..............................@..@.rsrc...@}... ...~..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..0B...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):436024
                                                                                                                                                                                                                                      Entropy (8bit):4.286072879353572
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:GJlkXz9bF1NycbAWJDZpRx01jr0fVbY0yf/59BolUII7psM8DUnxt2hpAJujRay5:IZW48Q44Y
                                                                                                                                                                                                                                      MD5:5CED8F1E52ECBE75C1F927BDEAFA5F5B
                                                                                                                                                                                                                                      SHA1:D2DF205F6380533131B120A63B1B2CB1757659E5
                                                                                                                                                                                                                                      SHA-256:A402D9A614777C7E6AB9C2D06B19CCD2654FEAE918B2869888E2875B41844178
                                                                                                                                                                                                                                      SHA-512:6754D028EB19FC04699113806DC6D19BDB82F57F647E950433C46C220598BAA84758506E06FF3BD78B9115B80285741101C035AB56D7771B47C0A50D57E076CC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........v......................................................0o....@.......................................... ..8s...........x..8/...........................................................................................rdata..............................@..@.rsrc...8s... ...t..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..(8...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):405816
                                                                                                                                                                                                                                      Entropy (8bit):3.956963226826557
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:KvmkkALenmGnHqbaqOC/LbDusMettIgNWP6ZLKVjMaWg5iCqV9Zwx1xUv0JAEkGJ:592M6ulbDVjVUTvrp/224i+gc
                                                                                                                                                                                                                                      MD5:94AC456373E7334BD829B394B294576C
                                                                                                                                                                                                                                      SHA1:50AE007B9144A7DFA1FD4055D70C82242EBA9F46
                                                                                                                                                                                                                                      SHA-256:3D8747A74C1F64EDD8D336374D25E8A00FD3482BEC38A9A2C79A33FAAAEA94DB
                                                                                                                                                                                                                                      SHA-512:40DE928A5905FC19BBECD95EDE25A6F35B4CA22C605CA56413E0348CB7A58734A67F740A649DDF1BB53CBDA82FB2B0D947B24872AAC5845BE45DA2B221F63B54
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!......................................................... ......zF....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):399160
                                                                                                                                                                                                                                      Entropy (8bit):3.7059203218097765
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:PZSx5ApUNPMfDWGZOGCY5OC6PjrncQcI7HeDzxxa+/CDf/EXfX/wXc/i3cGNee6a:BCf2Rxr6
                                                                                                                                                                                                                                      MD5:A9B0F072E93EDDAF2F94D79E6F257D7A
                                                                                                                                                                                                                                      SHA1:1C742850D2AB56200614E73CDDF606D163526E80
                                                                                                                                                                                                                                      SHA-256:534B8F7914331B8836D2B77D538109AAA08086E40F907261A41505B68708D971
                                                                                                                                                                                                                                      SHA-512:DFA151DBD3BF380DBCC8C6A0693148F4B5DE6310CD6580565C66D84DF48096F406F6BD73308820010498D9F90F79BFBB0836A96506F636C0026D5BF5B626C066
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.....................................................................@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):445752
                                                                                                                                                                                                                                      Entropy (8bit):3.689687129591618
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:SaVLPNsHDdz4ZXP7C07PwqHyCumBtUOFXyzTF6yfO6k1vofx9fuxMcKjXSSnNCxx:xwA0gSMtalfYfV
                                                                                                                                                                                                                                      MD5:79FDB9E77EC703317693773DF168D01F
                                                                                                                                                                                                                                      SHA1:66E90C999E96A4947C1401D48F7A9F2C755E5ECD
                                                                                                                                                                                                                                      SHA-256:A35D042A05FF628A59591475B0F3EFF66AE3595E7C2F912A26D157061CF681FF
                                                                                                                                                                                                                                      SHA-512:58938452CAC04A65895917AB73962C05341B249CFE3D2DF761C8F712D2A497574093C972A00C49039E8BC7266A81A566FC1EC64091E2F19CDA16596DDEF6D3AC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L...{..c...........!......................................................................@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....{..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..x]...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):475448
                                                                                                                                                                                                                                      Entropy (8bit):4.403197302977147
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:l/ycVlyTZk1NK/UgMLcETKdXAKpl4bINU1HF78zocrJkdd2wNZvsAXFF8YbfCUOi:tyrgQSCPNdVDMe4PcTAVJtxve0s7Q
                                                                                                                                                                                                                                      MD5:9DFDA2B3BC28EA6F8A611216F4F1B91E
                                                                                                                                                                                                                                      SHA1:69E6C1F445F873BA17B26E0531A7B20B9F1B3641
                                                                                                                                                                                                                                      SHA-256:EE020EC63FC06A0FDCDD292F50646147C021147A591F32BF4456E1962C651616
                                                                                                                                                                                                                                      SHA-512:8B9206A09BD9ECA9345B7B0BA8645630CE8B1CB69C34E91023E66CC300BB0E6EA0971DAED12C8C3E7F641396886BD83396BC7C7D6FCE14683C9EB0C5210838FF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........................................................0............@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):390456
                                                                                                                                                                                                                                      Entropy (8bit):3.6932550616187703
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:NNWku3rPR4S/jI0lS0V73p4ras+oG+7ShJmk8CcysegtnyaF0hla/Bx:Dmt0G0SKvCceq4w
                                                                                                                                                                                                                                      MD5:5FF9548B5D167422BAFD89BBB3BDE09E
                                                                                                                                                                                                                                      SHA1:951B9297142474EC7242CB0FC9F8D67332513D21
                                                                                                                                                                                                                                      SHA-256:C31985BDEB9AFC85335EFC5E37EA6EFB36B7D92C84DF5675701FD4037CDDFCB0
                                                                                                                                                                                                                                      SHA-512:2A371F9FA8351BCAC4657B2D5810C48D6E007A6A8DA1CA954225B9AA87895D0FD59E2A7EF856D856B3A08B2AE2F11F340D41F5FE85E10387160E94A7CCDA53D3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!................................................................J.....@.......................................... ..8...............8/...........................................................................................rdata..............................@..@.rsrc...8.... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):444216
                                                                                                                                                                                                                                      Entropy (8bit):3.622047472184712
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:YKAAUVcbRh20035Ams5OU90QdLd1xwrzDIUJtCuy7frJunhUj/jSdFqVNBw:Hi
                                                                                                                                                                                                                                      MD5:6E1899B98ABCE456B88869D641B0C040
                                                                                                                                                                                                                                      SHA1:969CF182F3927DA1C105DAA1EFA90AD4A8706B12
                                                                                                                                                                                                                                      SHA-256:2544C18DBE6FAD95BB0E4F2702FA25D23E489E02A3FE2C772EA8C6B5BC2C05C9
                                                                                                                                                                                                                                      SHA-512:72509633E256845E999A86CB572D16B56C863DEFA570768C2C920946FCC68D5E94FE1761BDE4EC40BFCF9C589A06DA94D7A5BBD5745A1F9178423A85B3B89E44
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!................................................................D.....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...W...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):401720
                                                                                                                                                                                                                                      Entropy (8bit):3.6836122203115673
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:PJuCEKHxkRVW2ZoXSPyyJTGmwzvTdeusgLwWQ7df:53sf
                                                                                                                                                                                                                                      MD5:B6079241D41F543785FCE3111F6682BC
                                                                                                                                                                                                                                      SHA1:5812D1A150C8935DA63AE5B674A57CAB61158B56
                                                                                                                                                                                                                                      SHA-256:4615C9CE566D9F0E568CBD31DE8780FBAD250489C053FF77988B9EC25E0F123E
                                                                                                                                                                                                                                      SHA-512:5B020223183919EC23692978F809221CF32B394A9DCC43EFB3F4150EF57945474E87F3DA22D20F7587C8018D0BA382C1EBB82BB1AB263E006E12ED457E84EFB4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L.../..c...........!................................................................".....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@..../..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):462648
                                                                                                                                                                                                                                      Entropy (8bit):3.6540109834522134
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:muFX9cTB6xYE4QmVAzZ2z6KoyelbbkEp5s6RDwnxMhNe/0xv:kUh3T8z6KoFzVwnHY
                                                                                                                                                                                                                                      MD5:F2FA380EA7684EDF804CFFF832575520
                                                                                                                                                                                                                                      SHA1:686D12E09DAC783FA1CCBBC3A667D2E8F9962240
                                                                                                                                                                                                                                      SHA-256:F2880CEB26F1903F4EF537E504746AC622BD7A004D2BAB58DE2ED5C4534B78BF
                                                                                                                                                                                                                                      SHA-512:8B190CE8687CB9ECA2491AFAB372B9C7A1EAF4C07187C228D2A2772382A4807C74806A7508BD08FA49A6BE06170612B573E1A603C55EF0EA14EDE9C6F7635252
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                      • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!................................................................R.....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):327992
                                                                                                                                                                                                                                      Entropy (8bit):4.474478772452174
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:WYVZ49QexXH1RDQQLjQOu1rpnrXVO4k5Kwittst0MNNzKH5B30XQ2st5gZPDJM6i:NX4VXVRDQQLjQOu1rFMitd8Q2sQZ4eQ
                                                                                                                                                                                                                                      MD5:08C06A2E7FAE4082DD39F58DFC99A694
                                                                                                                                                                                                                                      SHA1:36BC246B82F640ABB4438EF2275579E93E36D2BB
                                                                                                                                                                                                                                      SHA-256:A830D5FC352A53FCCE40AFBF21DC36967763EBC91B030F954A3E42E3802E74A1
                                                                                                                                                                                                                                      SHA-512:6E26BC2441FAA8788A4872BD5BB4886DEDF8BCD6AA8D33F3943E40AE61F7909AD047A25F258D91620047A9DD02EBF5FD9298CF5C38C379AE8F989E40957030FF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.................................................................&....@.......................................... ..8...............8/...........................................................................................rdata..............................@..@.rsrc...8.... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):424248
                                                                                                                                                                                                                                      Entropy (8bit):3.753947904763123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:P6wUYAKzt3zu38ZhvlL9aLE+CSBjOfYM3mYgZZx1XifYLWb0WoTn3zSUYby153/Q:DNt3isZh9LWwSooxdVs
                                                                                                                                                                                                                                      MD5:EB4E5AE3ECB7B4A4FFA4BBC318AF4B4A
                                                                                                                                                                                                                                      SHA1:F5FE6A813F5340DAF9895FDE6F5BC0A8B39E92D9
                                                                                                                                                                                                                                      SHA-256:0FA292CEA8C0E7413E5D75582C47C079CD4EFFC1ECA6A6885201E1DE7405C888
                                                                                                                                                                                                                                      SHA-512:928AA64F421EC6081B2B212C7DDD6C9E2CE0F83F9931B7B2618CF4EE7D7F8A35B0921BF197643FB7A8B4DB03CB6679829376B864E369ACFA29025F6264E00622
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........H...............................................p............@.......................................... ...E...........J..8/...........................................................................................rdata..............................@..@.rsrc....E... ...F..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):436024
                                                                                                                                                                                                                                      Entropy (8bit):3.8330771769402943
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:g2vaDYxtVtcuehcMLhg5RTQ98xcKpYNtOqPsEUQih6vIOk/l2mPyirc745ZQR3w2:QnyT5ryXdXv0ZExs/gH8+
                                                                                                                                                                                                                                      MD5:F9D1128B6633B25A48D571691F8BB009
                                                                                                                                                                                                                                      SHA1:8D3FF9EFB85FD17239020049EC32D738B4ED8C91
                                                                                                                                                                                                                                      SHA-256:DABC00FF9D648754A6C88843267A57E736C5BF30897B891206CCE35D09732C21
                                                                                                                                                                                                                                      SHA-512:6B3408E46DE79E490D3A76826B68568759ABCBC2DC77EDC165F8A56079EFE2F342F67E0E57953760225695CCE5E1940436FEF06C342057AD35E2135AA4FAB452
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........v............................................................@.......................................... ...s...........x..8/...........................................................................................rdata..............................@..@.rsrc....s... ...t..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...8...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):407352
                                                                                                                                                                                                                                      Entropy (8bit):3.6601558375540844
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:HY5QF2jme/C+SlcQQjqn1I9vDyzOo09vm++pnGWgYbIXazON/5x5:4C7ny9vc00ot
                                                                                                                                                                                                                                      MD5:86D17DCB358567D25FB722E1920051E0
                                                                                                                                                                                                                                      SHA1:1554EF14B7A1E9F4CA5446B4A3EAAE4821DFD287
                                                                                                                                                                                                                                      SHA-256:156D232BACECB5761878CCC5D17D22AD42E64760FFDAD7BE91B906C7904C0AEE
                                                                                                                                                                                                                                      SHA-512:7486B9336FB91016766D7DE0CE8C339A9FAE5916C25B8B3A492F184BC31D32D55779C63BBC225C0F230E55F5E5C5B9F65785387E8F531ABBACBAFDDEC8D99A15
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........................................................0............@.......................................... ..H...............8/...........................................................................................rdata..............................@..@.rsrc...H.... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..8....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):440632
                                                                                                                                                                                                                                      Entropy (8bit):3.6293527606198106
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:vRQTAUQ3aM09YXGX4Bp398RTMylu3oMRTAvKbyi1RIpgd/eMtdVPWZPAPGT528S0:ApuXXBJ9aJModi1vx8dD
                                                                                                                                                                                                                                      MD5:53B3176F7B234D8468F0A0CDFC6104F4
                                                                                                                                                                                                                                      SHA1:6A04F39309FCBB539C64A3457C503DD830925951
                                                                                                                                                                                                                                      SHA-256:D10E3EE4B04B215607AD95B8AD2EBD792A3482B9D4AAA984B8C619284C8971EF
                                                                                                                                                                                                                                      SHA-512:3A9204FF52055C70714AE63FC0DAB27DA622D51C30FA80A4550853EA924F238315967B7512CB1C90C6BAF315CC4094C5468E61505B97D963EB629E5E0373974C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!......................................................................@.......................................... .................8/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...J...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):248632
                                                                                                                                                                                                                                      Entropy (8bit):5.535441853927395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:V6iYjviSV5gCE9J+ZfVCQGQ8lzzHWZqZAxXak+bdhBnA2oDdO+r37VqBXJ1VQFXb:7lGadhGoB8l7/
                                                                                                                                                                                                                                      MD5:448E4E282AC5BF843DA0544712D4A036
                                                                                                                                                                                                                                      SHA1:545282C5CAFA4F5BD069033F27A866E3F2D6E2EE
                                                                                                                                                                                                                                      SHA-256:AB9A7668E54697436259A5206103D7375F6975C43FCC08293B672609B144ADE4
                                                                                                                                                                                                                                      SHA-512:89CDAEB89EDA176AC063289DC7CB6554A8893D5A12DDBFFC9ADD8787CECB73EF3EEFCE544BD4B7CC835B7D0E71ED37A45186828201F5BD3C5A80C913D2350673
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!................................................................e.....@.......................................... .................8/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...[...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):241976
                                                                                                                                                                                                                                      Entropy (8bit):5.663112515071947
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:yAjBwzC01nycmrT0KvMe3neU2/d5BbTQvui/PVWYSjQzSdlFpWqdlsA/dxx:LwicmD/qsAJ
                                                                                                                                                                                                                                      MD5:09BDF7A9B9C533454395B02B1CAD613E
                                                                                                                                                                                                                                      SHA1:08793977338A76E3279E91601BCB1636254FA9EB
                                                                                                                                                                                                                                      SHA-256:7D86CD7A8CC40688AE4839706A8BFBFE7E133F2295D1DCCA7252267626B8B6CA
                                                                                                                                                                                                                                      SHA-512:6756E220DF30615BE2021FE5BED8D2B0378BE3E822D0B5D6F71CCE0529C448F00B14AEF7EB4B84F7FE4BFC15378AE3E60E1F99AE28F95999F65E9CB3A2289DE2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.................................................................!....@.......................................... ...|..............8/...........................................................................................rdata..............................@..@.rsrc....|... ...~..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..pA...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):430904
                                                                                                                                                                                                                                      Entropy (8bit):3.8342746931828686
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:x3OD5tPJjv9XKodQRyJ18rp2NjFgXjLZB3fUEGc2Zovll0BgxTup2jhNfzXAVWsK:Ig7pH+8Jr
                                                                                                                                                                                                                                      MD5:4708EB0A5A5A42398D16EAEB41826C41
                                                                                                                                                                                                                                      SHA1:F6EF8CFEBB1FBB69B067F202BE05925348D25D83
                                                                                                                                                                                                                                      SHA-256:4E824B4F7445E83E529B0BF814CFC75BBC257E4A8822EA42E5AA0C0131EE97AB
                                                                                                                                                                                                                                      SHA-512:1D973157756368A7619C5593AA14B6FBFF1AB205E8A0E4C9C7F11558CFC15DFECE9DB82661045F35ACAE70E76C58209407CBEDB11933D3C10DA68BB1C1BB3944
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........b............................................................@.......................................... ..@^...........d..8/...........................................................................................rdata..............................@..@.rsrc...@^... ...`..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..0#...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):431928
                                                                                                                                                                                                                                      Entropy (8bit):3.641860963842408
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:98oPhx7/EbVv8fpn5NsEUNw/rMegteH/QURrF6yWVYx9jUrptardGaT8FxaKTJvj:GoPc4Wh3knNaLDmI8K
                                                                                                                                                                                                                                      MD5:A437FC7A3E198F8CEE0E6F0600BC1A08
                                                                                                                                                                                                                                      SHA1:EF88E5F5B0A44E19786069538738C95BCEC8BFCE
                                                                                                                                                                                                                                      SHA-256:941682035010FB8399D309752A1653070B789C82B999449CE136541AD2BB76B1
                                                                                                                                                                                                                                      SHA-512:E680DB0D5F06F13F2443E62B77A903583CAD4D30224BF391A2E12F09415DF21A91A916151380453DDD3D685ABDC1BA6BAC00C43B7089BEFF72574E8AB960D756
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........f.......................................................K....@.......................................... ...b...........h..8/...........................................................................................rdata..............................@..@.rsrc....b... ...d..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...'...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):396088
                                                                                                                                                                                                                                      Entropy (8bit):3.6975389965876513
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:5xWq/qVbfX/bPJGQPo1vhctT/2fhzxA9elvbN5ZQNU/J2JZw19FlyhnEn0bgzeIY:sV1sDa
                                                                                                                                                                                                                                      MD5:EBA6F8755B4D9E31862D1AA7525340F2
                                                                                                                                                                                                                                      SHA1:349EA5CF55D51494F5084C084A66539648C4999B
                                                                                                                                                                                                                                      SHA-256:2D03AA4ADA5E63F5E4FE611DB1CF7E4199A1C287742B7DCB0AE02E20AB7FBAFF
                                                                                                                                                                                                                                      SHA-512:BA8F9C6705E0B87180CAB8A12B17E589BE47CF2CB5CB3F48D4892FB1D941FFF318987FD9958050AD8617432AEF52B1B1CC616B4302B4EED57BE18A135C7A8471
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L...5..c...........!................................................................P.....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....5..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):432952
                                                                                                                                                                                                                                      Entropy (8bit):3.894092482437777
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:zT46Qw21IPRJeznbx5kbZdLHyIsKlLuD4+P/tpEgqVypVE/guxT:HvtIK9uD42tsVTl
                                                                                                                                                                                                                                      MD5:B0FBCFAC3AD48E9BEB4F0632502202AB
                                                                                                                                                                                                                                      SHA1:67677CA033FC10555E5130E6BD956E20F2DD5BB9
                                                                                                                                                                                                                                      SHA-256:B6F7967B8858B30AD1ACB8219BD51CAE1F4B0053494DD2EA7B5951A721FA81D1
                                                                                                                                                                                                                                      SHA-512:99E9455DFDAB2A5BAF2B7218AC0DEAA5D0C7F1D69CFFD16711B92B22F3AAB00F8E103E71DB83A8592BBAF030F271AD77004C5C34335227A5127BA41E23869931
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........j......................................................".....@.......................................... ...f...........l..8/...........................................................................................rdata..............................@..@.rsrc....f... ...h..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...+...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):426296
                                                                                                                                                                                                                                      Entropy (8bit):3.675035664492228
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:P3RaYpJijRlkBLlNRLOMgpELWfl9bHEVY/pxxm:ri4bR4bA
                                                                                                                                                                                                                                      MD5:B8918854F9157E6ACAE43543C532BDA2
                                                                                                                                                                                                                                      SHA1:A3D3C2A655B7CAC18D2F4C5A7F8881A522FD5D87
                                                                                                                                                                                                                                      SHA-256:7CFBDC4C471B95E03A8F0ED875DD0AA66BFC5E6D059FF1A8380B271A103098AE
                                                                                                                                                                                                                                      SHA-512:22110F57A1367957F6CFFEA75DBAA1649E8A8BBD60A05C8B38CC4AEC00505F92497FB39B43F7993CD32D47944D8056E75A978C95A85357F70BA2E8041F34B049
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........P...............................................p......l.....@.......................................... ..PL...........R..8/...........................................................................................rdata..............................@..@.rsrc...PL... ...N..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):450360
                                                                                                                                                                                                                                      Entropy (8bit):3.7675024749057484
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:J+lPVGAavOri/5zxapeXmhiqT9zmZwcOHFRCC4qi3gXXjt9dNlA8lwbI14IV9dqa:Jck2
                                                                                                                                                                                                                                      MD5:180EFE7BA1C0CD558FFD0FE08DC8ED72
                                                                                                                                                                                                                                      SHA1:FB046D6DF8843C74E284B14AE701E894DB5DA76D
                                                                                                                                                                                                                                      SHA-256:FBC289F9AD43A96890E4390E213EBD15E6AFC8C1D93D3C8A790D2C8DA330D4DB
                                                                                                                                                                                                                                      SHA-512:813FA7DBE297DF39E2B5E3896845C662DA625CF38CDB419A083B41B55828BB8E176EBC2A70200033FFAB2D5A301C83F6CF1EA1B33CCB4E4ECBEED1011F093987
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.................................................................3....@.......................................... ..P...............8/...........................................................................................rdata..............................@..@.rsrc...P.... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..@o...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):432952
                                                                                                                                                                                                                                      Entropy (8bit):4.356693802308424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:T7aE8o2d4i/INBgWOHd2y5jsgj2eaqh/6y1wOSgXLIXvQTGMi9/jxk:esXoL1KW
                                                                                                                                                                                                                                      MD5:63DC901DDF9F5CA3A20A175DFB06D889
                                                                                                                                                                                                                                      SHA1:C78729EFBEC2167C8945FFCDB1CF4822A9C913AD
                                                                                                                                                                                                                                      SHA-256:AF3FCB5185BC6A61D15C61E99DA3EF1AA1A99CD2E975BF44B62392BF422989B7
                                                                                                                                                                                                                                      SHA-512:D9C697BE2BC9CE0E270B36B64962B47727A009F24D658E383B789B47C9569A110FCBC5A7042EA8B0B948CF827550A66C2425BB5767E6D97BA5C0660859A1C295
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........j......................................................Yr....@.......................................... ..`f...........l..8/...........................................................................................rdata..............................@..@.rsrc...`f... ...h..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..P+...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):418616
                                                                                                                                                                                                                                      Entropy (8bit):3.895044183735032
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:1M5V+CzkliVLjg2VjcfO5Bi7Db9vQeLF4WxQbIr3S4WG/zNktc6RYqzDaY45lPqt:Ol/VVSEPhBaDR+
                                                                                                                                                                                                                                      MD5:69763182E049BD882AC4B8DA55BB1B0F
                                                                                                                                                                                                                                      SHA1:E2106363DD70BCCC07DC89FE13DAE9E8BAAE6606
                                                                                                                                                                                                                                      SHA-256:93F4BC88D4C7BFF02D333C1104908728245BB1945DBA3D27DC35493F3747D6B2
                                                                                                                                                                                                                                      SHA-512:7E24A579C1F9EF6EFF3972526F338BF27BFD79131571AF36BE95A75AAD55E4CB005759782F9620732FCBE99A0B56E67F7BBD5A08BB1E38F477A976D71047CFC0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........2...............................................P............@.......................................... .../...........4..8/...........................................................................................rdata..............................@..@.rsrc..../... ...0..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):418616
                                                                                                                                                                                                                                      Entropy (8bit):3.7562558460280995
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:RC9/izAG69tuVAEAZcMMv4ZKU+0stvzNuVzm2/S5HOGch/cnfCW5AkAqI1od3lX6:sI8ev4ZdEzUYnD6kHfXpWI0P
                                                                                                                                                                                                                                      MD5:60F836C5DB48711E8F42E336F2DA7B12
                                                                                                                                                                                                                                      SHA1:91CC46B4AFF1EF86EA9A32702AB9E68C99B2CC7F
                                                                                                                                                                                                                                      SHA-256:DF7CD2571190CD402D1DB7403738B946751E7DACF1F19C58DC2C595AAB307FD8
                                                                                                                                                                                                                                      SHA-512:41C2A9ED02166C45D0CBF7216437ED17253480046BEF9D5B36BA3BE9A6B4600CBDE2D7BB6185CBC8C16F47969CACE77E569C196C5EE5ADBB699B668673DF2AFF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........2...............................................P......a.....@.......................................... ..P/...........4..8/...........................................................................................rdata..............................@..@.rsrc...P/... ...0..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):398648
                                                                                                                                                                                                                                      Entropy (8bit):3.7390600266748577
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:AdCb1/DX8qvRbADY1E47G97IFZjhUB2G7UwhBZabm4NO51gaGPYV+tvHtVL3akMi:fbyr679Jmi87m
                                                                                                                                                                                                                                      MD5:1497950E8BEEDA165D998610027B1328
                                                                                                                                                                                                                                      SHA1:775AEFEDB502708D8AA97E2FEEC8AE2EBD97DA0F
                                                                                                                                                                                                                                      SHA-256:6E42E63333FF47B8C3FDD24E98629F8ED25EA0682FB3EC6BABA02B20B1F066FB
                                                                                                                                                                                                                                      SHA-512:4CC22F5E8E712D35988D7C0DC2FE53267E26FF5AD7FE38AE49D8B336BF48F281C29716C3589095828B2B78B88B68E05C32529B42FFC34FA1D315A9C5416532C5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L...;..c...........!................................................................}=....@.......................................... ..8...............8/...........................................................................................rdata..............................@..@.rsrc...8.... ......................@..@....;..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):387384
                                                                                                                                                                                                                                      Entropy (8bit):4.547156384869077
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:yCj4dPboG1dn8jw/O49eBhBS79p7iS1zFMniI3AeQ9skf/rxU:IcGqQI3kW
                                                                                                                                                                                                                                      MD5:77FC1F261F3CABF47172CD1AF90B384E
                                                                                                                                                                                                                                      SHA1:65EB01633AF7D3C66A3C50CFF6A8F81E27918F42
                                                                                                                                                                                                                                      SHA-256:14701B9CCAF49E580707B1E23594BACF2493BCDE80CAD63CBE4444B7B8A9ED03
                                                                                                                                                                                                                                      SHA-512:FF79E8306BC39A9139147FD57B77B8A0E58B1718341DD500B23ECDA84023D3B760C1A047FEBA84B17744F01EB5FB0FEAF116C90C83C7CEB20EB7FF4ED6FE2DF3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!................................................................{.....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...z...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):404792
                                                                                                                                                                                                                                      Entropy (8bit):3.907542397991233
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:PHrtZ2h5ooD6RrQrxO9VE2SLcyCpNvsnn+tJHfmklPoNArCsJIS8YEEiLh0xnQwJ:cavsnYo8Olh9GAzvHz9m
                                                                                                                                                                                                                                      MD5:1E6E407A46B37ED69E6BACF3474F8203
                                                                                                                                                                                                                                      SHA1:287AF816D852354FB43FA7BD31CF54E0070B50FA
                                                                                                                                                                                                                                      SHA-256:D69784BAB94C3AFB3A1C7CFEF90F89F6511B77B8646A7D9C505A95D2AD001C21
                                                                                                                                                                                                                                      SHA-512:6C11D6B6EF6CF89BF9A45F7D5B68CE4D9F6712C6473EFEF994CCE89EC3B4095E6F330A4D3D64E8685F09EF457CDC89A8585E81475392E9CDA73350F0D1BA1420
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!......................................................... ......_<....@.......................................... .. ...............8/...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[.......rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):428856
                                                                                                                                                                                                                                      Entropy (8bit):4.378895893608721
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Q08hbhNKXsO5rygULJPKYkjgUgzHFXRL7fe/7UVitNbwyjC+ybMvi7jFWq0UqRZV:Mj7DLXlEUc
                                                                                                                                                                                                                                      MD5:CDBDA843DACABC66C27C6945416E5CFF
                                                                                                                                                                                                                                      SHA1:756EFDCD35F711A30820F42F5B4DCA5505AEC1E7
                                                                                                                                                                                                                                      SHA-256:CA183B93226FB7B85AEAEAF3607858F59211B92B3AD362EC4675F30C5CE66C3A
                                                                                                                                                                                                                                      SHA-512:A2E4BFFA844BD7BADC5687DBC37ADD4FE2DD145320380AF646C4C514421E8B076DDADF7888F81C4BFEA4E582C3DFC2744B534BE63D31261DE5654E9BEC911B61
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........Z............................................................@.......................................... ...V...........\..8/...........................................................................................rdata..............................@..@.rsrc....V... ...X..................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):435000
                                                                                                                                                                                                                                      Entropy (8bit):4.196500593254464
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:eBKzgvD0wmk8tkyfT2Md5s2ZMCsSWHUn6A5aC:rndaC
                                                                                                                                                                                                                                      MD5:F883C53A74FAA45424179543FD7F7FA9
                                                                                                                                                                                                                                      SHA1:3F79FD9271FB6E3352A9DB5784618D39639EFA28
                                                                                                                                                                                                                                      SHA-256:17B2ED22B05B5CE80AF915E20ED1CAC7A6E01BDA775557FECF7DC0742A8ACFEE
                                                                                                                                                                                                                                      SHA-512:BCAC48E7940809FC255808AF691C41E8D123DC6445449C46655624843BFEF000117D30F4F7D86B251DC54DA69338140BEB6585263A3F6F6550D3533EFED5518E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L...#..c...........!.........r............................................................@.......................................... ...n...........t..8/...........................................................................................rdata..............................@..@.rsrc....n... ...p..................@..@....#..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...3...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):189240
                                                                                                                                                                                                                                      Entropy (8bit):6.0627097771790694
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:C5CqwN8oYnk9UjI7JD4GAXRrYtQftU++4HqfgelDrXX/rxK:3UncUjI7MRJb+4iPXs
                                                                                                                                                                                                                                      MD5:75E26F8D793BB14CE5D0DF745152EF8A
                                                                                                                                                                                                                                      SHA1:329D1EB51A7F8F5E93DA8BDECA007FADC7C0ED7D
                                                                                                                                                                                                                                      SHA-256:CC1ED75B8051E424D0D10ED04098722D3F8BECB0DBAEBBFA22D781C4830C0CF5
                                                                                                                                                                                                                                      SHA-512:94E5DB1D804AD1E80C47E3B81948EFB489D22A9C5EBC24421F7CB6857E994B8557E138B74F82E4D65DC2027269C523FA2EBD7B59E4AC4DA73C8ADD53F466AE02
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!......................................................................@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...s...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):190264
                                                                                                                                                                                                                                      Entropy (8bit):6.105784045632321
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:jV+Mnek/qz7J+bvCwBNMGDkyP5MGsTjQOhkz5ofG/Ou/OxXr:FecO89NDkyP5MGwQOhiZOuEr
                                                                                                                                                                                                                                      MD5:B0E182AFE512DC4B66364B833D2A6523
                                                                                                                                                                                                                                      SHA1:E3837F03A2A7DF6A6279FB6F650D2BF4D3D81756
                                                                                                                                                                                                                                      SHA-256:09556031F2D9B7ADA6D7C3BEEDF09E0131D83EB3A8B3A2312F3F2FF41DD984DB
                                                                                                                                                                                                                                      SHA-512:F44144BF8D0FFF7E325D7B36B7A2AA83953CF81A333F6CEED13EA88476D687240D6C92CE2312B4912BE664AB930158DBBE8D075C310E5242A6500E108F0B2703
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L...)..c...........!......................................................................@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....)..c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... ...;...rsrc$01.....[...x...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15162168
                                                                                                                                                                                                                                      Entropy (8bit):6.595193656430526
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:y6MfrqrF+h3QgGLk6/6ozDL7IBsXgDmGx0d/FGMlIG7JVVFVH7CU:HvrFiQgG76oLEig1xMFIG7b5t
                                                                                                                                                                                                                                      MD5:64E9A35EE2597974D0D711C94A680ED8
                                                                                                                                                                                                                                      SHA1:11CB82546A275C6988971845DA2EE9358C3B48BF
                                                                                                                                                                                                                                      SHA-256:A2AD62FA493BFE3965B35E2A40F3B19D4ECC33EA1FD13A42254727D392F12062
                                                                                                                                                                                                                                      SHA-512:AE2E3A6154181E16DA13FC0AA9AC224E0E1E6149138DAED97135C366BEDD5671D73D1307470BCF99721959DFE0C3AC4F2BE51606093BD44A3B118E9ACAF7F5DA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......z.h>..;>..;>..;...:..;X..;8..;l..:-..;l..:'..;...;<..;...:'..;l..:K..;...:?..;...:=..;dE,;...;>..;@..;...:...;>..;{..;...:...;...:...;...:..;...;?..;>.v;?..;...:?..;Rich>..;........PE..L......c......................P...................@.......................................@..................................h..(....`..H............,..8/.........../..T....................0..........@....................J.......................text............................... ..`.rdata....:.......:.................@..@.data................n..............@....didat.......P......................@....rsrc...H....`......................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17583416
                                                                                                                                                                                                                                      Entropy (8bit):7.745574233156446
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:393216:sS/sDWTKEcyAfg6gSeUtcibNzYrkbI1MJTCkImgEghuo8:sS3krg6gSejUNzYQWXlU/
                                                                                                                                                                                                                                      MD5:98E95DC742DBE4AFADF55394C3A862FF
                                                                                                                                                                                                                                      SHA1:DF65EA0D88C82C6573B3AF2DBDECF70988CCCCEE
                                                                                                                                                                                                                                      SHA-256:363360575570B592D1356541B811A1C0621D9656884C122CC7CC616EC2B3B694
                                                                                                                                                                                                                                      SHA-512:7EEB9BF5529211BF365A541B0649389A9F4F74823F84AD57ED3D4A91CE5D88AE2C6F5B283E8D9DB0018BC24551E0EEECA4257AA88B6265FB204F4C45E934D3CC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ij..-...-...-....~,.,...-.D.*....~..,...Rich-...........PE..L......c...........!.........................................................@.......L....@.......................................... ..................8/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.......c........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .......rsrc$01.........#...rsrc$02............................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\WriteDump.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):704824
                                                                                                                                                                                                                                      Entropy (8bit):5.907753307290139
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:75d10da8Q9wj+uHO76bdJbOomEdbJjwV5Rhz29L:Vd10da8QIO7qOMbpwTRhq1
                                                                                                                                                                                                                                      MD5:2DA110C078B43B5A9D27407069A74557
                                                                                                                                                                                                                                      SHA1:0A85E12187791BDDF37EA6105528D2E342EF0381
                                                                                                                                                                                                                                      SHA-256:C998E74F828BDAABBA85965695847C2E388910A669505532FBF03FA1CA154E62
                                                                                                                                                                                                                                      SHA-512:57125E33E4D306CAEE0B967B927192DC0BE96B19DC33C9F6A4245540F9448DFCA0B1316D85A89A8BCD0F618BE1BB2B9A9776BDA5483777E6C0CC1B6E2DA39818
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.9m..W>..W>..W>.T?..W>.R?..W>B.S?..W>B.T?..W>.R?..W>!..>..W>.S?..W>B.R?L.W>.V?..W>..V>..W>.^?..W>..>..W>...>..W>.U?..W>Rich..W>........PE..L......c.................X...F...............p....@.................................E.....@.................................<...(.......hf..............8/.......A...T..T...................@U..........@............p...............................text....V.......X.................. ..`.rdata..._...p...`...\..............@..@.data...$:.......,..................@....rsrc...hf.......h..................@..@.reloc...A.......B...P..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\dpa-de.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (905), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15074
                                                                                                                                                                                                                                      Entropy (8bit):4.911131043830491
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:JCSoXD721RKmx0Wz0eYM2rm/0jfga+UM1FCbe6RlQfJFe6PZ08hUDcv6vA:/RHc22M1FCbhjQfJ46PZ0kUDcv6vA
                                                                                                                                                                                                                                      MD5:B70A5B47D26CA9D0F9AA22E2711C1197
                                                                                                                                                                                                                                      SHA1:7FB55063B5D3920F7723CDF056EF98F570A64EE9
                                                                                                                                                                                                                                      SHA-256:BF2D3C9723AF4B682A50666B1D223CAC469CC8991979F5098BF3002B2BECB73D
                                                                                                                                                                                                                                      SHA-512:0870B611DBE343266848767D34C0263C4FF9842E99EC29E2DC6E70B756272C8803AF7024C98DC62F5D4DB9DCBF5FA856FF507D084F9DAEF650A4E5FF31AD137D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html><html lang="en"><head>..<meta charset="utf-8">..<style>..body {.. font-family: Helvetica, sans-serif;.. font-size: 12px;..}....h1 {.. font-size: 18px;.. text-align: center;..}....h2 {.. font-size: 16px;..}....h3 {.. font-size: 16px;..}....h4 {.. font-size: 14px;..}....h5 {.. font-size: 12px;..}.....preamble-box {.. background-color: #eef1f2;.. border-radius: 5px;.. padding: 10px..}.....preamble-box h2 {.. margin: 0px;..}.....preamble-box p:last-child {.. margin: 0px;..}....</style>..</head>..<body>......<div><h1>TeamViewer<br>Auftragsverarbeitungsvertrag (AVV)</h1>.. <div>.. <div>.. <h3><strong>1. Allgemeines</strong></h3>.. <p>F.r die in jeweiligen <a href="https://www.teamviewer.com/de/dpa-annex/" target="_blank" rel="noopener noreferrer"><u>Anlage 1</u></a> dieser Vereinbarung beschriebenen Verarbeitungst.tigkeiten, bei denen TeamViewer als Auftragsverarbeiter des Kunden auftritt, vereinbaren die Parteien bis auf Weiteres die folgenden Regelungen zu

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\dpa-en.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (913), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14497
                                                                                                                                                                                                                                      Entropy (8bit):4.792057620187339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:RzqzaeWyh/ivuhYB+CY6463YNxerPNDrsalXcAPT:Nyh/Qubqfr2alXh
                                                                                                                                                                                                                                      MD5:ADF0C73014D41F05A37FAD58AFEF0D5A
                                                                                                                                                                                                                                      SHA1:F4E35B622C6C230885B7CD9A5EF083810A90F9AE
                                                                                                                                                                                                                                      SHA-256:18EB7F34A5BA5941A31F8510F48C9644897228BA62BDB8092E603E2E34A0451C
                                                                                                                                                                                                                                      SHA-512:2CD0143DDFD2BC533C688DA981D9620080A80C73B79D6F83B2E6AFC96C6A823582F07DB4459C90905CCA4699A23C9C00BC238FDCAF47B31485FEB0ED0B637020
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html><html lang="en"><head>..<meta charset="utf-8">..<style>..body {.. font-family: Helvetica, sans-serif;.. font-size: 12px;..}....h1 {.. font-size: 18px;.. text-align: center;..}....h2 {.. font-size: 16px;..}....h3 {.. font-size: 16px;..}....h4 {.. font-size: 14px;..}....h5 {.. font-size: 12px;..}.....preamble-box {.. background-color: #eef1f2;.. border-radius: 5px;.. padding: 10px..}.....preamble-box h2 {.. margin: 0px;..}.....preamble-box p:last-child {.. margin: 0px;..}....</style>..</head>..<body>......<div><h1>TeamViewer<br>Data Processing Agreement (DPA)</h1>.. <div>.. <div>.. <h3><strong>1. General</strong></h3>.. <p>For the data processing activities described in the respective <a href="https://www.teamviewer.com/en/dpa-annex/#annex-1" target="_blank" rel="noopener noreferrer"><u>Annex 1</u></a> of this agreement, where TeamViewer acts as the Customer.s Processor, the parties agree to the following provisions on the commissioned processing of pers

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\eula-de.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (2661), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):114046
                                                                                                                                                                                                                                      Entropy (8bit):4.976687966962153
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:zCLcAp3ivff/Ct9O3RT2EqEsZcvcr8mCt3zwpiVFJYyJp38RhSbX49OBgtUDUhfV:znvH49GjqEsB4dhVFpUhYUlL
                                                                                                                                                                                                                                      MD5:17FD6F4C05E85A48E9200C832854CBA5
                                                                                                                                                                                                                                      SHA1:9768FD98BD8C633CB4C00626EC6E457682304440
                                                                                                                                                                                                                                      SHA-256:302CA7E0AD293B170D3D52345B40844A8308C6FDE945E84A99EB9EC858F086FA
                                                                                                                                                                                                                                      SHA-512:42091A75848A9D6BE0EE6E6CF9BB0A5D9458C0FE48C1617F27012EAB49987BB151C22D4510212FA82469F74A696532E95155DD8DDD96A36AAFFB29A8139045F8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html><html lang="en"><head>..<meta charset="utf-8">..<style>..body {.. font-family: Helvetica, sans-serif;.. font-size: 12px;..}....h1 {.. font-size: 18px;.. text-align: center;..}....h2 {.. font-size: 16px;..}....h3 {.. font-size: 16px;..}....h4 {.. font-size: 14px;..}....h5 {.. font-size: 12px;..}.....preamble-box {.. background-color: #eef1f2;.. border-radius: 5px;.. padding: 10px..}.....preamble-box h2 {.. margin: 0px;..}.....preamble-box p:last-child {.. margin: 0px;..}....</style>..</head>..<body>......<div><h1>TeamViewer<br>Endbenutzer-Lizenzvereinbarung</h1><div class="preamble-box"><div>....<div>.....<h2>EULA . Pr.ambel</h2>......</div>...</div><div>....<div>.....<p>BITTE LESEN SIE DIESE TEAMVIEWER ENDBENUTZER-LIZENZVEREINBARUNG (<strong>.EULA.</strong>) SORGF.LTIG DURCH.</p>..<h3>Nutzungsbedingungen</h3>..<p>Die EULA ist ein modularer Vertrag, der die Bedingungen des Vertragsverh.ltnisses zwischen der TeamViewer Germany GmbH, Bahnhofsplatz 2, 7

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\eula-en.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (2397), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):104877
                                                                                                                                                                                                                                      Entropy (8bit):4.855869617254611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:0S4NH2syNCoQWvNUHVPq6pjRrz0Rm0CuJgbRy:0SGgCh3QOrRy
                                                                                                                                                                                                                                      MD5:1268136BF2D3116D74B646DA5333BB88
                                                                                                                                                                                                                                      SHA1:7BC089A3FADCB1CC4CD64C5984687F1FAEAFF3AB
                                                                                                                                                                                                                                      SHA-256:B9F41D44DC44A5C0C60D2EFD479C5D2243929E58C733613FA643072AD2914501
                                                                                                                                                                                                                                      SHA-512:9E1BDF0F078CE400A35A11311083A5D6BF3A31269F94F93DA6C6B5FF287F1CD0E6FD6B1AE8D7668B0792A01C2DA6917672100C682A0F7FDED6A66BBDDE0BF99C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html><html lang="en"><head>..<meta charset="utf-8">..<style>..body {.. font-family: Helvetica, sans-serif;.. font-size: 12px;..}....h1 {.. font-size: 18px;.. text-align: center;..}....h2 {.. font-size: 16px;..}....h3 {.. font-size: 16px;..}....h4 {.. font-size: 14px;..}....h5 {.. font-size: 12px;..}.....preamble-box {.. background-color: #eef1f2;.. border-radius: 5px;.. padding: 10px..}.....preamble-box h2 {.. margin: 0px;..}.....preamble-box p:last-child {.. margin: 0px;..}....</style>..</head>..<body>......<div><h1>TeamViewer<br>End-User License Agreement</h1><div class="preamble-box"><div>....<div>.....<h2>EULA . Preamble</h2>......</div>...</div><div>....<div>.....<h3>Terms of Use</h3>..<p>PLEASE READ THIS TEAMVIEWER END USER LICENSE AGREEMENT (.<strong>EULA</strong>.) CAREFULLY.<br>..The EULA is a modular contract that governs and defines the terms of the contractual relationship between TeamViewer Germany GmbH, Bahnhofsplatz 2, 73033 G.ppingen, Germa

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17720
                                                                                                                                                                                                                                      Entropy (8bit):6.948601485419926
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:eLiB60m2qZSf+VIYiWLzL9SbxPxh8E9VF0Ny5pgdtt9:eLE60m2x/YiWgxPxWELOt9
                                                                                                                                                                                                                                      MD5:168DCF19905DC535F4FD4E3901266FAB
                                                                                                                                                                                                                                      SHA1:C824D98A1D20341B7F7658CEEA98EC3158938ECE
                                                                                                                                                                                                                                      SHA-256:A9D2D1A5E7DC939E4C80FF68968F364F3612F2959AC24E5B89547DE0D80229E7
                                                                                                                                                                                                                                      SHA-512:2966824F75F1EAF4961CB0B4EC92CC8F943BA0765368A00743BCF753C6126F916AF08EF33452493B8236F9CC99F341814EDD310687F5B16F815ECA218C6D3C4A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..c.........." ..0..............,... ...@....... ...............................v....@..................................+..O....@..................8/...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..0....................*.......................................0..b.......~.....~......(.....(......o.......(.......o.....0.~....(....,..(....&.~....(....,..(....&.(....&.*..........%1.0......(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......`...#Blob...........G..........3..................................................-...........................0.......f...|.f...].f.....f.....f.....f.....f...7.f.........B.....

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):355640
                                                                                                                                                                                                                                      Entropy (8bit):6.539611801425175
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:GQdHKTWQnVeWWGx3OD/eSsgp71rEcoM3yI/N8Cte87ZQ0czH1lJw8g0mh6l4VQgb:GsQnVeWW0Z871rEcDy2hfrlf0rp5Lo
                                                                                                                                                                                                                                      MD5:58BBFD58663DCD40FBDA081FDB38D18A
                                                                                                                                                                                                                                      SHA1:E20DD5409B69F5CEF4FC0006A13537B5ED021EBE
                                                                                                                                                                                                                                      SHA-256:A3C4164AEAC06445A7BE25DE937FC89DD925DC5542E86A506B0980F081B15677
                                                                                                                                                                                                                                      SHA-512:4A8CE63911EAF6C57C9C83FCB4F151E2331D890D4C98BAC4D10C209590F6694D0AD6EC4F886176D5B5EB1B5B79D84F8889E2794FABE1A5B7580E708123CC4AC3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^..c...........!.....4...........R... ...`....@.. ....................................@.................................PR..W.......`............>..8/...`....................................................... ............... ..H............text....2... ...4.................. ..`.reloc.......`.......6..............@..B.rsrc...`............8..............@..@.................R......H.......8....f..........4....\............................................(t...*..{....*"..}....*....0...........(....o*......(+...*..(....*6..t}...(....*.....*.0..3.........o{...(|....ow.......3...t....o....(....+.s,...z.*..0.. .......s.......{....o......({...o|....*.0............3..*.,..-..*.o-...,..o-...-..*.o.....o....(....*.o-...,..*.o/...,..o/...-..*.o.....o....(....*.o/...,..*.o0...,,.o0...-..*.o1....o1......*.o.....o....(....*.o0...,..*.o2...,..o3...-..o4......o2...,.

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):135480
                                                                                                                                                                                                                                      Entropy (8bit):6.547331536232609
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:4yod1lCdzq/nqbNiYVUHfer00CScZOD8FK3igju2/fx9:4Fd1l0cWNh6UyOwF4v
                                                                                                                                                                                                                                      MD5:3F42237A270B048A0220CA4BCC4700F4
                                                                                                                                                                                                                                      SHA1:00E1E789CCF833EAD252D133B242F3B1C2A6E726
                                                                                                                                                                                                                                      SHA-256:FF6FEBE93FF478D4B89F7B0AA43E87F62FF37A922E49281D29692134C6F942BE
                                                                                                                                                                                                                                      SHA-512:518866F50FFED31376B1E9811A63AB06F939A58D5BBF2D77C2FBFBB89EF7E954C15125E6B573176C4BBE4350870A3ADD4E0E6FEE33497823909A44075665E9E1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................X.......................................Y................................5.....]...........Rich...........PE..L...W..c...........!.....*...........w.......@.......................................$....@............................................P...............8/......T.......T...........................`...@............@...............................text...p(.......*.................. ..`.rdata...}...@...~..................@..@.data...............................@....rsrc...P...........................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):179512
                                                                                                                                                                                                                                      Entropy (8bit):6.231894829949134
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:2asCVpUuBFPUEmCW721GWasCtZRmBEoaDlxiwXe/NRvG90avF43EHpioG/px/:Fs+F55W7wGWalfmBn3GecFw7L
                                                                                                                                                                                                                                      MD5:D15B382E004011EAFC7668061FA3D4E1
                                                                                                                                                                                                                                      SHA1:DF78916C9DD3ABF29582C26DB2B528F5581C4AF4
                                                                                                                                                                                                                                      SHA-256:2F9B42031879C699439B5CBF8451ECC092C6700117CF16F5FAD83B3A28A14B61
                                                                                                                                                                                                                                      SHA-512:AB7B553AF84213C28B67C0764F05FBC8B2F3238A2CE1353EBA98E0A606459D33C8489E64B88799EF57BE457A641ACB3B7923C8AF204766010DE64FA12B5E5D01
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......*...n..Ln..Ln..L..Mk..L..M.L<.Ma..L<.Mg..L<.M@..L..Mc..L..Mb..Lp.$Lm..Ln..L...L..Mj..L..Mo..L..Mo..L..HLo..Ln. Lo..L..Mo..LRichn..L................PE..d...T..c.........." .....x...$............................................................`.........................................0N.......O..........X...............8/..............T...........................p...8............................................text....w.......x.................. ..`.rdata..f............|..............@..@.data....$...`.......H..............@....pdata...............\..............@..@_RDATA...............v..............@..@.rsrc...X............x..............@..@.reloc..............................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):472376
                                                                                                                                                                                                                                      Entropy (8bit):6.9201855031792565
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:fjLPpQp64W/4oW/xSQALzXiu5dG05qjTGPdAAa:fjLPpQppy4oW/xSQs+GPd0
                                                                                                                                                                                                                                      MD5:3CA9C53393CA69641AFC513F4CA6A01D
                                                                                                                                                                                                                                      SHA1:9897BEE054279A9D2B89B28FF768D072499BBF4C
                                                                                                                                                                                                                                      SHA-256:C6473FE199DF52D7B331FA579C10885F490E7521B2E1DAD5CDF3C9CFD769B56E
                                                                                                                                                                                                                                      SHA-512:0B4BFCCF9BD0041B2732F214E20DB61DE8663461D15104CEA44535FC06EB24A34BE00A189475A6A89B4857728CFCFF8536F90C9A89FC35F409A2CD272139143E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D......................R.....R.....R................................$.........Rich...........PE..L...K..c...........!.....V..........`........p...............................`.......@....@A........................p...t..............................8/... ...;......T...........................P...@............p...............................text....T.......V.................. ..`.rdata..T_...p...`...Z..............@..@.data....$..........................@....shared.$...........................@....rsrc...............................@..@.reloc...;... ...<..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):353080
                                                                                                                                                                                                                                      Entropy (8bit):6.598258216168929
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:zAV5qCM62XyAlc1vrW2HIYaphqHoYV9WLhzxmEmzqATvjw0AOUoiCUm7W:zAV5qCM62CwcRW2HlQgHoYV9WLhz4EmC
                                                                                                                                                                                                                                      MD5:000556B6E8C0C14200611D65692741AB
                                                                                                                                                                                                                                      SHA1:F2771468EA1DFE77DF97155B3FCC3E924ED9F649
                                                                                                                                                                                                                                      SHA-256:AFF63F09919FCCE5CE16BDC3F50C4823BC6A4D14808A3F8A2D341177AB265FBA
                                                                                                                                                                                                                                      SHA-512:708D5F2AD089106888CB346AEB15C5BE61C128345D283A2F6C204C2E6B80A98EFEE7F97B48B9D2384B16337FDE94AACC983EF60889C649E429C95407B886C5DD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e...e...e.......j..........7...t...7...s...T...g.......}...7...=.......f...e..........z.......d...e.m.d.......d...Riche...........PE..L...M..c..........................................@..................................8....@.....................................(....@...............4..8/...P..81......T...............................@....................... ....................text............................... ..`.rdata..>C.......D..................@..@.data....#..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..81...P...2..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):605496
                                                                                                                                                                                                                                      Entropy (8bit):6.6233077056612935
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:SA+ScZNiaQMFjlUvCHLjynrry/e/z6fljX2QaeRh5HkT1tQ/9BD8MVm:SA+SUNiU5KtM9O
                                                                                                                                                                                                                                      MD5:987A193FD54CCC4A97870B3E64CEDF50
                                                                                                                                                                                                                                      SHA1:6FEE826A80BEE942FCF3EE323A71A636466F1E8D
                                                                                                                                                                                                                                      SHA-256:A3B9AE9D29CBEC102755FDD955DA63C2FEE7EC01C5836D0EF4B00CDECC80C054
                                                                                                                                                                                                                                      SHA-512:132783AAC22C07D0B6C6EB6C9C4855A6BD23807A922407A2B3F3CC641978C64C6BD5D67076D558A0CF4C1E520286CFFF2CFEF3B8DCA97AD549122DDBF49C5470
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.. ...s...s...s..r...s..r...sM.r...sM.r...sM.r...s..r...s..r...s...s...s..r...s..r...s..ps...s..r...sRich...s................PE..d...S..c.........." ................p.....................................................`A............................................t...4........p..........$T......8/..........`...T...............................8............................................text............................... ..`.rdata..N...........................@..@.data...(1..........................@....pdata..$T.......V..................@..@_RDATA.......P......................@..@.shared.H....`......................@....rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):416568
                                                                                                                                                                                                                                      Entropy (8bit):6.397539806654306
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:xYRkV/3AfDmU09C8JTuoj6FsdDuzq9I6e4vQkhFMsohjYRp5Pwzmt:xkao6Jioj6FsdD99Y43ssoSRXPYmt
                                                                                                                                                                                                                                      MD5:1F2B4ED83B34465C729CBB340A91FAB3
                                                                                                                                                                                                                                      SHA1:DB018A3ECB96E83A5C06F6CF04697A9E8B64D904
                                                                                                                                                                                                                                      SHA-256:E17DC5758CEF28BBCE332CE36ED8487813425909C1C306BEFC159DC84367516B
                                                                                                                                                                                                                                      SHA-512:BD4E253FE4DB44ECBF9330B82EBD58EE9B66B99A418E045102694033ECDC05FB739A9A76B6E8B47F78C0FB583402D70B42EB43FA8F10452F591064BB7AA0B888
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......iu..-...-...-....f......a..=....a..%...K{../....f.. ....f..9....a..w....f......-........a..2....a..,...-.j.,....a..,...Rich-...........PE..d...U..c.........."......"...$...... ..........@..........................................`.....................................................(............0...2...,..8/...........s..T....................t..(....a..8............@......D... ....................text....!.......".................. ..`.rdata..j....@.......&..............@..@.data...44..........................@....pdata...2...0...4..................@..@.didat.......p......................@..._RDATA..............................@..@.rsrc...............................@..@.reloc............... ..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles.7z

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):39393682
                                                                                                                                                                                                                                      Entropy (8bit):7.999994780901746
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:VIxbkCYIcHz7Xpcrd+LySQX3Mh2FcVaoHWtFb08sQ8UyD7nCWTFx2:V0wCTqpMILyh3M0sWtFwpfmEz2
                                                                                                                                                                                                                                      MD5:9AE40A0ACE3449AC04FC0C9DEE27B788
                                                                                                                                                                                                                                      SHA1:A01A132D022C130B98506E57211FC8670963C57E
                                                                                                                                                                                                                                      SHA-256:4089CCBB2A143059CEB458CCFDB40DBE00FCAD49AF5886D94E51BE7B58D6FF75
                                                                                                                                                                                                                                      SHA-512:08FFE3093376F182FFC8CBC730150D3A16AC596F8497C308CE1AE46C4FF1BD118CCD490690AD9DB1E8E76184E519CFC2CDE12B8BBC957360F8CF8E396F467ADB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:7z..'....8I.M.Y.....%........;jo...E...(.Y...%@j6\..Q9.__.W......Sv0......!..<g...B...~J....P...w...t.&}.g..........}"...&?..q:Y@O%*..(.2.......v......C....-<..[C..D]'.#D..k..K...f.yw.T..r.2L.....8]...-Vh'...M.W.......R.-..K.k....3..J.E.[=...n.3....y...0.....L.N".*...mS.,~..U.~X.P.C...........7.........G..B=..}.....Z.....4'...kFq.a.x@.Zq.Y.../....~..I...ld}..!...0xl.H=...kp.,..J....a.....>.b,.xhb..L.6T...A..2.v..$..%...GO...S....W..4...............[...G_..!..r.w.{.....:o....c.3..ga1..Z..H...u..RHz2N......O.0.J~.2..i.].U6...b.....uZ..d.o.g.oC.....Z?.7......D...C....F....}..".P..w..........vS^.E.h..*aH...fr.BT@.....<.<.....K...$..ib~BjU...:.p.....b.sW.*.;.(...3O.d.e6.c.g7.d.w.7.......q.8...m.?.Ay..t...a@o..3G.^.......^....M./.t....!...`..)._N.g^.aO4..........hX..meI.)A.i.Q..i..y..}.&....v..1...$.3.AhZ~'.......df..|..i..T....Z"..]..z..T.....Yr....1E.q.[.............}/.;........JL.`.5G1V..5.~8...bd.o....]4M...?z/..XTo.....jL0.ZK21....=./...

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):364559
                                                                                                                                                                                                                                      Entropy (8bit):7.999533538079261
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:sF/r31fRSYFtbAtnX98TKt1f4ymTN0fvez0bMYJlcBHALHmULTs:sFb1ftC6TKt1fWJqveobMYJlcBHuXLI
                                                                                                                                                                                                                                      MD5:7D3C4D35B2FD799BDE70A93EC0D896B1
                                                                                                                                                                                                                                      SHA1:165B7194C79E94DC9EFBFBB70C1C86DB0EEAA72B
                                                                                                                                                                                                                                      SHA-256:9A635FB1A0360CBA6674763B010050AEBFA4F5F3986C38070DB1C531BBAB8F65
                                                                                                                                                                                                                                      SHA-512:CEAC699DDE8697917E0301726B514534680B839941BCEDC34085C0F24CAC542121788F5D3E7096113985EA5DC9D44821CC530E0BB8E4A6D9148BD944A4EBEF3E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:7z..'...N/.........$.......|..[....&....FnP..p<......o..:.D.y.2...;N...$.....R%.$.+.y.4N.T...I..!...W.iX.u..>c.......>....hU.}V...!E.......>1...`.........-\?.&S....9...A.(1.O[kOK..|.a.=.`XK..%..9F.S8..|.D=.5.b.z....]....?..........SV1.Pj.W.....z....<*P....DU\..._7.Z..W..W..cL...Me..@*j.0=]I.....Y...Va.J.Lu.)B.1.@+0...)e.....[.x."!.UX.........P!../7.$..."R.....j. 3.Pxp.W...JN...5../.?G9b.C..>...=y7. ..~TV.......T.y.......{#.Hm[k.x0..WB|..=..7sY.f..t...fs...e...V!.g..6s./,n.D?..`.t..H...^jPv....>...]K./...,ej_..D,....T..)..h[##..i...'b...e......7.$.od'.5.K.K.V.G..[....CUn.Y.*...*...J.....$...y.-J^....V.,...,.\../...g....:....i.kp8%..i....Y..x.....m..Ne..........~.i..+..G:B....#`.-^.+..%gS-L..P).Zz.....8.s........Bx.... ..>h.2...2..J....~l..G.z....).b.C.^Rtd.....s-.b..3:Hb.qXG...f.0 =.^...5..q.&.z.8.g....d.76.....&..==.....[]./0.....).:7P..y.w.F4...jr#..;.....*L>z.j.`Q...6.X.J.....6..R......b.........@.....9P.._..,..Y.c#+..I.bS.(.C..F..!

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfilesx64.7z

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):288162
                                                                                                                                                                                                                                      Entropy (8bit):7.999388031233724
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:+S2Sr+h5nl9t1h+NJ6r6HnXt35aIetZKy3rO+jB6unq3VSPqCug:j6h5nlxh+NJ3Fot6unq3j8
                                                                                                                                                                                                                                      MD5:1125B77C6DD4B753951B260521C495BA
                                                                                                                                                                                                                                      SHA1:73C6AC9C046C9E54F7CA77A18F17EB419313B549
                                                                                                                                                                                                                                      SHA-256:4A01F6F79C385D7C34C443BA57FE432FBB816A4C0AE5B5149258FDF37AF11A48
                                                                                                                                                                                                                                      SHA-512:B0FACE1DC33DD7436D7E0F746FA290124499499B7D1F05A580B3F1B0770036DCE0FF9BE55DE772BEF901934825BAE7BE4B56E874E562D067548BD4BCD47CC3AC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:7z..'....1.u^e......$.........S... .(.....H.U......6.PXGp..F.5J..E=I..2..A/@.%....P)..H..Sp..u>=C..C...N).......(..."ZZS ....W..@[_f%...$..E!..a..B...v...L.'.`.~.b..F.._Rbc2......^.s..D@.?..8,z_S.xY...............YJ0gzd...J..*.jYl......DD.. .'M...C.....h~.6.....r...K?-.m..]."........5..Q5*!b......7...^......s.....g2j.S.'.;.K.3'.s.=^b...)%2.'...~=...!...m>JmGS~D.......s...P..._...G...h...%..M......#.[.B...Y.N8..J,..H+O2.....d......R.Q..R.t.....qU.3i.[..z7...NcB>Tig.*..\K5.,.P4y....}..w.....j<..O9.....[A.-..]...L8.K..B..LT.H3.bF./.FaX...."wD..ss.N.I....7......]m,.m{.E.7b..6..R;Z..^Q....o{.+.)g.a.....C....|.,...3...).xQ..}..D. ?........ H5..4X.r...K...X..u.H].o&..nU..E..a.T.$.....f....3...Vr/._;..Cw.`+..@&d..}..-;)..d1j q.t.S...Y%}[K....]:.sP........x.F.2NU%..<.>VE..9$_KP.....H.w.7......H...lg7.."^.`K0....8.....1........8t....F...}.i..N....i....S..^.`.g..42...:..`{.V..7...V...f..,...C.m04...I.j.d...h...D9.}.hPQ......Q.N2!..K.I.*.jB9.....x.q...;.....S

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):855400
                                                                                                                                                                                                                                      Entropy (8bit):5.455524115046654
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:33bkgafbYoniTTIIKnCDHYzeJQP7IRuaL:nbkDUoniTTIpCDHYzVkRv
                                                                                                                                                                                                                                      MD5:05C11CD92572CF85051892C277C6DA09
                                                                                                                                                                                                                                      SHA1:A266B2D2ADE3A9919F6C4EBFF8F2B03D271F0BDA
                                                                                                                                                                                                                                      SHA-256:4F1637639EFB4D3A5A9AFECB1C0F3CB353A17EF79DE6042CFCECCE78EB162E00
                                                                                                                                                                                                                                      SHA-512:6A1599379AC6C125171D9E705DCBFD715F96F52313773C4168F3D4D4B6B5A263FC79C728E9341393DCB3F06F388B4AE29DAACE83F55F08997C39D16F6831BF87
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P..*_...P...P..OP..*_...P..s...P...V...P..Rich.P..........PE..L....z.W.................d...........2............@.................................e.....@.............................................@...........0...8/...........................................................................................text...{c.......d.................. ..`.rdata...............h..............@..@.data...............~..............@....ndata...0...P...........................rsrc...@...........................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.inf

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1775
                                                                                                                                                                                                                                      Entropy (8bit):5.282965170818026
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:+vsh8Q2XFbsf0z6Joq7mgHwuMgHPgHxGFWlFVfXj/g:+vM4QI6JoimIMsCGFWlFZE
                                                                                                                                                                                                                                      MD5:5C05880E0ED65FAC3A4DFB7B6802B898
                                                                                                                                                                                                                                      SHA1:55EA8DAC7093123E26584A49012517818C0F586D
                                                                                                                                                                                                                                      SHA-256:60FA2925C589AC38BAB74713E1B0BB2A205A8C825D614B971FC3426991CD86CA
                                                                                                                                                                                                                                      SHA-512:5176504DE06E6F8249815F8F8472ED7C9A26003E92ECD80299DA8B611A630A1BA8179419CDF50F02B78A19CAF221D6E0AE59452B224DC55FEEF72A93CD4D147D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:; Copyright 2010 TeamViewer GmbH All rights reserved...[Version]..Signature="$WINDOWS NT$"..Class=Monitor..ClassGUID={4d36e96e-e325-11ce-bfc1-08002be10318}..Provider= TeamViewer GmbH..DriverVer=02/01/2017,1.02.0000..CatalogFile=TVMonitor.cat....[SourceDisksNames]..3426 = %SourceName%....[SourceDisksFiles]..TVMonitor.sys = 3426....[DestinationDirs]..DefaultDestDir = 10..MonitorFunction_Files_Driver = 12....[Manufacturer]..%MfgName% = Driver_Mfg,NTAMD64....[Driver_Mfg.NTAMD64]..%Driver_DeviceDesc%=Driver_DDI, *PNP09FF....[Driver_DDI.NT]..CopyFiles=MonitorFunction_Files_Driver....[Driver_DDI.NT.Services]..Addservice = MonitorFunction, %FLG_ADDREG_NOCLOBBER%, MonitorFunction_Service....[MonitorFunction_Service]..DisplayName = %MonitorFunction_SvcDesc%..ServiceType = %SERVICE_KERNEL_DRIVER%..StartType = %SERVICE_DEMAND_START%..ErrorControl = %SERVICE_ERROR_NORMAL%..ServiceBinary = %12%\TVMonitor.sys..LoadOrderGroup = Extended Base....[MonitorFunction_Files_Driver]..TVMonito

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18336
                                                                                                                                                                                                                                      Entropy (8bit):6.275348584247018
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qumQmspn15C9l0HDRRdrauc056CAyIKGNsuIeInYe+PjPtrwnc8ijtlAur9ZCsp5:qmF100Hzdrau/NAyoauQnYPLWUUHeMt
                                                                                                                                                                                                                                      MD5:B7CA6668278FBAE3FBD649285F8CCC35
                                                                                                                                                                                                                                      SHA1:DD5CD2FB0E6818EB56268F0D6E72D0F5AC74AEF4
                                                                                                                                                                                                                                      SHA-256:78318C6A8AE65FB3AFE6BA06CF1BDA69903390E250950D3BF78895CD79AFD4D8
                                                                                                                                                                                                                                      SHA-512:7305B979ABBEF7BEB4789261E9FC0EBDE00415BB00ECEEE2289CD1FCF91467CCC7C84ED77E7F5CD042243508B5FC8C3384EA59D6A1A17497781110FE5238103C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%.S%.S%.S%.s%.Z]I.P%.Z]O.Q%.Z]Y.W%.Z]P.R%.Z]N.R%.Z]K.R%.RichS%.................PE..d...)x.Y..........".................d`.......................................................................................................`..(....p.......@.......(...............!............................................... ...............................text............................... ..h.rdata..t.... ......................@..H.data... ....0......................@....pdata.......@......................@..HPAGE....z....P...................... ..`INIT....x....`...................... ....rsrc........p.......$..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5852
                                                                                                                                                                                                                                      Entropy (8bit):4.8898985616021315
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:q2i3bD2JlgdmibjR+iAz4C7bZ7xTMPTtQ2rtu3DcNSjXKjvKY8kz7s7wfQTXvMYk:ri3WJlgdmibjR+iAUC7bQPu6o3DcNSju
                                                                                                                                                                                                                                      MD5:65FA1C2E7127E7B7D42A712574BE0877
                                                                                                                                                                                                                                      SHA1:2BEA89F8A0D9A867C6BB7711F51ECB7ECDB0F988
                                                                                                                                                                                                                                      SHA-256:07C7CFF907E6BCC9C3B587728C055DF6DE9F5089AC1C4BAB4014A8993A5FF788
                                                                                                                                                                                                                                      SHA-512:27BDC76B443DABC72FE7EA9338716B3BD4520858A2CB40BB4F4C00E1FA423F3A2FD339E305C68A81AC8474B794FE8BA5AC7DD07FDC9FBAE52D48E2AC37DB5874
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:; ****************************************************************************..; * Copyright (C) 2021 TeamViewer Germany GmbH *..; ****************************************************************************....[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net....; This version number should match the version..; number given in ..\version.m4... DriverVer = 10/08/2020,9.24.6.601....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer Germany GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn, NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, root\teamviewervpn ; Root enumera

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11362
                                                                                                                                                                                                                                      Entropy (8bit):7.226829297386891
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:7CVuem4CysSE/pWkjyKDUFWQFmkwehG2ZUnQJeX01k9z3Ay1/cY9i:WMTWRFR8zIG2teR9zt1/ti
                                                                                                                                                                                                                                      MD5:802E5987532856FF421BC9D47358ACA7
                                                                                                                                                                                                                                      SHA1:7E893A8869FB0AA59A666EE229AAB62FB86E0814
                                                                                                                                                                                                                                      SHA-256:52112FD70A547C6F1885A9761C3051775CFAB9B65A12D83527DAAF57A1E696A7
                                                                                                                                                                                                                                      SHA-512:92417D3A3940018975922440C9585BC4E7E571E7EE8AA9B29FA9612606926C3FBBAD05BA1479B86018A80AB322EB0F81CFC52F13AB93644DED5C13B743A4780D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0.,^..*.H........,O0.,K...1.0...`.H.e......0..+..+.....7......0...0...+.....7.....z.....:C..j...q...220727152305Z0...+.....7.....0...0....R3.B.5.1.B.1.0.9.A.0.1.9.4.0.E.9.6.0.C.C.2.2.7.F.6.A.D.D.B.7.1.D.D.6.6.D.1.B.4.D...1..}0E..+.....7...17050...+.....7.......0!0...+........;Q....@.`.".j...m.M0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...i.n.f...0....RA.3.B.7.7.F.D.7.3.E.8.D.4.1.9.F.0.2.1.B.5.2.0.2.B.2.F.2.E.6.6.6.1.6.D.A.6.A.7.C...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+............>.A...R....f..j|0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0h..+.....7...1Z0X.

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):618840
                                                                                                                                                                                                                                      Entropy (8bit):6.386929854212784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:XcDDFMusol2sm5q7Nv64O+tA3nHJEII351QHAEOoPCt:qFpl2Xo16BJEIM510OY
                                                                                                                                                                                                                                      MD5:93A8FAEA83EEFE43BDEADBCE228D9B1C
                                                                                                                                                                                                                                      SHA1:6580A39E0D25490F58F569222E6118C23DEE0F6D
                                                                                                                                                                                                                                      SHA-256:CC6126518973FAA1329271864CFFE6187434A3D042EDE8BC3A687551FAAE5099
                                                                                                                                                                                                                                      SHA-512:2C045CFA6E9109A96BE19759312415073132F986A1F9DD85223C8BDCA20AD10521065490A9B8BBD27A2C3BDF1561F35ED28444C1888A660DCD79B2677DF0E302
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mq0\..^...^...^..b]...^..b[...^..bZ...^.[eZ...^.[e]...^.o.....^.[e[.^.^..b_...^..._...^..bY...^..e[...^..e^...^..e\...^.Rich..^.................PE..d....#.b.........." .....d..........................................................X.....`A........................................pT..h....T..<................X..."..XO..............8.......................(... ...8...............`...4Q.......................text...Lb.......d.................. ..`.rdata...............h..............@..@.data.......p...d...L..............@....pdata...X.......Z..................@..@.didat.......`......................@..._RDATA.......p......................@..@.reloc..............................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2422
                                                                                                                                                                                                                                      Entropy (8bit):5.329206041713171
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:x+FhiEAG2GZIVsomMGVWtbAM62fUifVwqgPbKJn0Fjeu70Fpn0Fpa70FLe4CAo0f:x+zinG5ZIVstMXtsM62fUif1gGJ0Ku7V
                                                                                                                                                                                                                                      MD5:C0FBB65A476B99B714AA70B3C3C814B0
                                                                                                                                                                                                                                      SHA1:3B51B109A01940E960CC227F6ADDB71DD66D1B4D
                                                                                                                                                                                                                                      SHA-256:D5CE8E9FD946EF69DE18DEC95AD489DE1E5A37C305E23D40D0814AD14C2F2EA7
                                                                                                                                                                                                                                      SHA-512:D0F364744BF4E7055F164713890A032E5423B01EEB7217100C8846C2F92F82C339DD3F05A159AD9845D1216FFA351DCD995C0360C69B9B7033EF3F5909EE3F08
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:;..; TeamViewer_VirtualDeviceDriver.inf..;....[Version]..Signature="$Windows NT$"..Class=System..ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_VirtualDeviceDriver.cat..DriverVer = 07/27/2022,13.39.25.986..PnpLockDown=1....[Manufacturer]..%ManufacturerName%=Standard,NTamd64....[Standard.NTamd64]..%DeviceName%=Device_Install, root\TVVirtualSmartCardReader....[SourceDisksFiles]..TeamViewer_VirtualDeviceDriver.dll=1....[SourceDisksNames]..1 = %DiskName%....; =================== UMDF Device ==================================....[Device_Install.NT]..CopyFiles=UMDriverCopy..Addreg=LogParams_AddReg....[Device_Install.NT.hw]....[Device_Install.NT.Services]..AddService=WUDFRd,0x000001fa,WUDFRD_ServiceInstall....[Device_Install.NT.CoInstallers]..AddReg=CoInstallers_AddReg ....[Device_Install.NT.Wdf]..UmdfService=TeamViewer_VirtualDeviceDriver,TeamViewer_VirtualDeviceDriver_Install..UmdfServiceOrder=TeamViewer_VirtualDeviceDriver..UmdfMethodN

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5391
                                                                                                                                                                                                                                      Entropy (8bit):4.832043523407305
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:s2iQJD2WlsdGebjR+iAz4C7bZ7xpRStQ2rtu3DcNSjXKjvKY8ks7nuwfQTXv/zof:FiQQWlsdGebjR+iAUC7bpR6o3DcNSj6e
                                                                                                                                                                                                                                      MD5:447FC733747DB11CD4492AE01C5652FE
                                                                                                                                                                                                                                      SHA1:2A70DCD391464CB8D3736322E07E966E105D396E
                                                                                                                                                                                                                                      SHA-256:A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
                                                                                                                                                                                                                                      SHA-512:238099DB072AF55445D421E941944ABE8A6F52A124A26CAE84C1DD52FFFAFC4DAC5586D0C7407B461CD0DB8E771E1DBB6CA34AEE84581B24347F401410B2AFE5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:; ****************************************************************************..; * Copyright (C) 2007 TeamViewer GmbH.. *..; ****************************************************************************......[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net.. DriverVer=11/27/2007,2.10.00.0000....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn,NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, teamviewervpn....;---------------------------------------------------------------..; Driver Section (Don

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10645
                                                                                                                                                                                                                                      Entropy (8bit):7.272624114612594
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:H64PyG0o6orbfUG3afdjIafdjShjFivhE:jnrbVafdjIafdjcjFiJE
                                                                                                                                                                                                                                      MD5:5CFFE65F36B60BC151486C90382F1627
                                                                                                                                                                                                                                      SHA1:F2A66EAE89B4B19D4CAB2AC630536AF5EEEEF121
                                                                                                                                                                                                                                      SHA-256:AA7C09A817EB54E3CC5C342454608364A679E231824F83BA5A2D0278EDCC1851
                                                                                                                                                                                                                                      SHA-512:1BD48EF66F8714E7E9591043D03BD69A30881ED3D0F2463B15750A3282DF667FFB076B3A92358EECEDAE0E54485B07D702667E8FE0AF64C52BE04DB47145920B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0.)...*.H........).0.)~...1.0...+......0.....+.....7......0...0...+.....7.....^FZ..t.K.........071228163009Z0...+.....7.....0..^0....R2.A.7.0.D.C.D.3.9.1.4.6.4.C.B.8.D.3.7.3.6.3.2.2.E.0.7.E.9.6.6.E.1.0.5.D.3.9.6.E...1..O0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...i.n.f...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........*p..FL..sc".~.n.]9n0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.7.C.A.9.7.9.F.2.2.A.E.3.2.A.2.6.8.5.5.1.C.A.1.9.6.2.C.D.9.5.2.F.D.E.2.3.8.6.9...1..W0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........".2.hU...,.R..8i...L0..H0

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):35112
                                                                                                                                                                                                                                      Entropy (8bit):6.279693420486803
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:/a/ZSDKMhnknetMdlHJRXz0yjSDomtN6l5cJQGftSSXakqEqLXb9:C/ZWnkn0uTRXz00Ss1m1YvEq/9
                                                                                                                                                                                                                                      MD5:F5520DBB47C60EE83024B38720ABDA24
                                                                                                                                                                                                                                      SHA1:BC355C14A2B22712B91FF43CD4E046489A91CAE5
                                                                                                                                                                                                                                      SHA-256:B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
                                                                                                                                                                                                                                      SHA-512:3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10136
                                                                                                                                                                                                                                      Entropy (8bit):7.111963563245086
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:xpkA4I/yo2JC6vyyKwnsFWQF3lrIzLMmDWqnajKs57wczb:J52lrnsFRJlrEQmDWlGs53
                                                                                                                                                                                                                                      MD5:87F9F85E95F9FBE3846E145CEC886E42
                                                                                                                                                                                                                                      SHA1:BAA55A0CFA3DBAAC1D082C4A2FEE1DA43DEABCF1
                                                                                                                                                                                                                                      SHA-256:CC2359A2FBF7962B3DF4D88D75A878A393F8C2694465D629F67593C107F94B0C
                                                                                                                                                                                                                                      SHA-512:D80DEC2C15FF05B9E6468BF5841BB024F48B0EB6822E932D65EED024B4A8FAE352AFE370E798CEE9AA2C06773E2163E849AF40B14C3B7D2C3657186F61278FBF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..u..+.....7.....f0..b0...+.....7.......~.?..A./:.d.)...211208152411Z0...+.....7.....0.. 0....R2.B.E.A.8.9.F.8.A.0.D.9.A.8.6.7.C.6.B.B.7.7.1.1.F.5.1.E.C.B.7.E.C.D.B.0.F.9.8.8...1..+0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........+....g.w....~...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.D.C.6.4.0.E.9.9.5.E.4.2.7.5.6.B.D.C.2.E.5.9.3.9.A.7.0.4.1.3.D.6.5.4.A.2.3...1..=0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........y..@..'V...pA=eJ#0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l.

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):46936
                                                                                                                                                                                                                                      Entropy (8bit):6.656488161316276
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:XD0lMrZrZwFu/xdw9/oxBwNNyElQWmjI11YiWJ1hP4n2u41z2:6MT1ZyFoElQWAI11772H2
                                                                                                                                                                                                                                      MD5:6317A1890582D5ABB3E3E3EE6B217411
                                                                                                                                                                                                                                      SHA1:78F44D94212467FC61B98EFBDA91F2BC701E1A39
                                                                                                                                                                                                                                      SHA-256:3A09C3A24EC480BA4AD466760996E0F3CED30C1499ABDA32DA6EAD9DE5D08836
                                                                                                                                                                                                                                      SHA-512:6241DC81EF29736972D2E8CE3FE0C52371445CF80E5EBF22630D9F29B1953470A0F2C15A57262E400F90773EB74428AF4521C744ACFE7D202F19EBF9B7AE3E03
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........JF..+(.+(.+(.@..+(.@).+(.+).+(.@+.+(.@,.+(..^,.+(..^..+(..^*.+(.Rich.+(.........................PE..d..../La.........."......X.....................@..........................................`A....................................................<............p..T....v..XA...........R..8............................S...............P...............................text....=.......>.................. ..h.rdata.......P.......B..............@..H.data........`.......N..............@....pdata..T....p.......P..............@..HPAGE.................T.............. ..`INIT.................b.............. ..b.rsrc................n..............@..B.reloc...............t..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\tvmonitor.cat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8881
                                                                                                                                                                                                                                      Entropy (8bit):7.27496797439638
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Ast9AnYe+PjPtrwnc8ijtlAur9ZCspE+TM4rwMcA0qTv0a:NAnYPLWUUHeM4cAVv0a
                                                                                                                                                                                                                                      MD5:1F2380A5474583DBA929F761A760546F
                                                                                                                                                                                                                                      SHA1:561248613C6F443D8A993900E2DBEBF3B718A660
                                                                                                                                                                                                                                      SHA-256:143DF27418B1EAF375BED6291765E2E77166830D6216A6BFB71A075735F05DA5
                                                                                                                                                                                                                                      SHA-512:4309403DF0A29C53190833AA13A6E67A4501650B77106BC62925F691DFFEDCAB184B6DF3B8BA750E0A8FD4C9B6E0919B729F5BD250413178CD7A4CE287241AED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0."...*.H........".0."....1.0...+......0..|..+.....7.....m0..i0...+.....7......i.&...E..l....N..170512092819Z0...+.....7.....0..F0....R2.9.6.0.7.A.C.D.0.3.F.6.4.A.B.F.5.2.3.9.8.B.F.3.D.E.0.4.E.8.1.9.D.1.A.0.8.C.3.4...1..K0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........)`z...J.R9........40V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.5.E.A.8.D.A.C.7.0.9.3.1.2.3.E.2.6.5.8.4.A.4.9.0.1.2.5.1.7.8.1.8.C.0.F.5.8.6.D...1..C0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.p..>&XJI.%....Xm0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0....+.....7......0.....O.S

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\Base.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):65976
                                                                                                                                                                                                                                      Entropy (8bit):4.490731717806226
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:Ym6UIhHoJHX73S9HptSp4imFRjMB1XoRYiizcAMxkE:+UIx43S9JwpueoR7tx
                                                                                                                                                                                                                                      MD5:579375935D5CCB16A69EF0C01BCF0FD0
                                                                                                                                                                                                                                      SHA1:3622E6D0F2BA8A83165F75710B245D97DD39E7D3
                                                                                                                                                                                                                                      SHA-256:F1271F1C7BFB346944D3EE2DA0CD26652A63C7694C28C32AB65F3E5169AE364D
                                                                                                                                                                                                                                      SHA-512:9FB6D7D816A760D503C4F3DBA3BFC9B7E7FF6F22A3B9681144CC55EBC2DAC0793B9B6AB20AE9DA791647AF54162C03BA08C10DE93A855DABBCEB686352F74D50
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5Qe.q0..q0..q0..eO..p0..q0..r0..eO..p0..Richq0..........PE..d...{.$e.........." ...$.......................f....................................s.....`.......................................................... ..P...........H...p)...........................................................................................rdata..............................@..@.rsrc...P.... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\Boot.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):25024
                                                                                                                                                                                                                                      Entropy (8bit):5.723801985176344
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Fo5lfiiT3keVGuofIYiiftAAM+o/8E9VF0NyEGKH:a7GuogYiiuAMxkENKH
                                                                                                                                                                                                                                      MD5:44C69468458548444460D437267BB501
                                                                                                                                                                                                                                      SHA1:15868F9019FB64B212BEC3D2F00660005AC60D70
                                                                                                                                                                                                                                      SHA-256:02EB8A56AF3ACC2F577AC37962B889C555F68683349D4A23D1585CA57642A584
                                                                                                                                                                                                                                      SHA-512:FC70932FEE3E6D64D4409BA958AD0C74F2C3975AE3439E6E73014518AA45B641F2F09A0C5191DD3FF980AD768C04B010757D400891CA1F609906AB61085232AA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5Q..q0..q0..q0..eO~.p0..q0..p0..eO..p0..Richq0..........PE..d...s.$e.........." ...$.....4...............................................`............`.......................................................... ..p1..........H8..x)...........................................................................................rdata..............................@..@.rsrc...p1... ...2..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\aswClnTg.htm.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):703
                                                                                                                                                                                                                                      Entropy (8bit):5.259120582728411
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:OM5egV+uymynA5eYytM5eVEYo9IaNMDOVK8X7+CEbg6mISTwcF2AXw2IaNMzu:5eQtdyGeme6Yo9INQKg7+g6mccFe2I4
                                                                                                                                                                                                                                      MD5:4EBF04FAF20DFF03F5D62D5AF5F32151
                                                                                                                                                                                                                                      SHA1:7088E12344219071C118DDC11415C7A8643E52DA
                                                                                                                                                                                                                                      SHA-256:C27D162C8C40C816E09A3A0093E7FCF30DF436E3266065633450595BA156ED53
                                                                                                                                                                                                                                      SHA-512:B784CDCC2EC75DA2FAF00CCAFC211CB3FC874F085000BDB6BBD2E05FB1D11DD966CB04E5A1C8F4C91B0720E3CAA7A8A82C753C87546005A969D27ECE581AF163
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<br /><br />..<hr style='border:none; color:#909090; background-color:#B0B0B0; height: 1px; width: 99%;' />..<table style='border-collapse:collapse;border:none;'>...<tr>....<td style='border:none;padding:0px 15px 0px 8px'>.....<a href="https://www.avg.com/internet-security">......<img border=0 src="https://static.avast.com/emails/avg-mail-stamp.png" alt="AVG logo" />.....</a>....</td>....<td>.....<p style='color:#3d4d5a; font-family:"Calibri","Verdana","Arial","Helvetica"; font-size:12pt;'>......This email has been checked for viruses by AVG antivirus software.......<br><a href="https://www.avg.com/internet-security">www.avg.com</a>.....</p>....</td>...</tr>..</table>..<br />..</html>..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\aswClnTg.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):79
                                                                                                                                                                                                                                      Entropy (8bit):4.7007116475260196
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:r1FopJFAuWpuFGNWMXQkkizWDSL7Vv:bopJF/FMABGWOLB
                                                                                                                                                                                                                                      MD5:F27E56279B0DE10CF9330DD15C36F997
                                                                                                                                                                                                                                      SHA1:3AAE430D7F3248AFE29A4E70919570005BC4743A
                                                                                                                                                                                                                                      SHA-256:F49A2735886EC0A1199973160B88AC88DEE576588F4C0A211ED5EBF44C566067
                                                                                                                                                                                                                                      SHA-512:BBD01EAE02DACD6452A1EDB191D1AAF00F2009789676CEDBB5E50D39627AD7D86176763294C63C48A8E84BB77074363C5855AA42C4E601584748318751F6B7CC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:....-- ..This email has been checked for viruses by AVG...https://www.avg.com..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\aswInfTg.htm.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):643
                                                                                                                                                                                                                                      Entropy (8bit):5.569170913404483
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:8XpOFsT2IaNMLqDuzh1OFTZuRmyG2cTZGlaxJE+jKWjolhClIlsqeCPZ1Pr3OZuV:OpOFE2IVqC3OFNB2cTZGlojRkbsqdZ5j
                                                                                                                                                                                                                                      MD5:7DB7DBD7815BEBD69C5005B16F191731
                                                                                                                                                                                                                                      SHA1:94D9CA774F6E0C153666E7179BEDDDC1D0771D3B
                                                                                                                                                                                                                                      SHA-256:14D52B2DB6114EC914D5A43B0D8DC285911DA75044B19909C914AF874EE54A90
                                                                                                                                                                                                                                      SHA-512:FF6052349BDC78D96AA1491D8EA8C764E53C9EF02EA1F2A446D90C153FF9F921FD301AFE83A6F5C65FA03EEE23A76C7A0CAB72F73E41B5BFDCED0CA2EA6ADCFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<BR><BR>..<TABLE width=400><HR>..<P style="FONT: 9pt/11pt verdana"><a href="https://www.avg.com/internet-security">AVG Antivirus</a>: %TYPE% message INFECTED:<br>%ATTACH%</P>..<P style="FONT: 8pt/11pt verdana">Virus Database (VPS): %VPS%<BR>Tested on: %TIMEDATE%<BR><FONT color=gray>AVG - copyright (c) 1988-2023 AVG Technologies.</FONT></P>..<TBODY></TBODY></TABLE>..<BR></html>..%INBOUND=Inbound%..%OUTBOUND=Outbound%..%CLEANED=was successfully cleaned.%..%DELETED=was deleted from the message.%..%LEFT=was (BEWARE!!!) left intact in the message.%..%MOVED=was moved out of the message.%..%MOVEDTOCHEST=was moved to the Quarantine.%..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\aswInfTg.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):438
                                                                                                                                                                                                                                      Entropy (8bit):5.3668932434892636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:borDAzORmcL7ZGhlWpWJE+jKWjolhClIlsqeCPZ1Pr3OZuV:borMUvZGhlWajRkbsqdZ5T2K
                                                                                                                                                                                                                                      MD5:20511513A692ACE563587FD8119F022E
                                                                                                                                                                                                                                      SHA1:A3A058154B7F3370AB07026BDF9C61D0487663F0
                                                                                                                                                                                                                                      SHA-256:F0215CEABC6E0FA003E8079879956603C35466B7E5D998CC84789ADE5CFB9119
                                                                                                                                                                                                                                      SHA-512:189EFAC592953EC4FD30263613E67ABB7412EF11AC3A5802BC8F27B01A24E593493700226F012D43999E9F53E43623A209D230741327021946D8E79D62DB2B7A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:....-- ..AVG Antivirus: %TYPE% message INFECTED:..%ATTACH%....Virus Database (VPS): %VPS%..Tested on: %TIMEDATE%..AVG - copyright (c) 1988-2023 AVG Technologies...https://www.avg.com..%INBOUND=Inbound%..%OUTBOUND=Outbound%..%CLEANED=was successfully cleaned.%..%DELETED=was deleted from the message.%..%LEFT=was (BEWARE!!!) left intact in the message.%..%MOVED=was moved out of the message.%..%MOVEDTOCHEST=was moved to the Quarantine.%..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\1033\uiLangRes.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):254904
                                                                                                                                                                                                                                      Entropy (8bit):3.8790354266199127
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:vu7rfd4Zth/SOkzV9nwXin9UOPe6XPeINlTQv4t3mfXFVDiYxU4xmr/Wzt:aPa0SfN
                                                                                                                                                                                                                                      MD5:B388D6125EECC6618E026CEFA4260A8F
                                                                                                                                                                                                                                      SHA1:70799E098B370BA965BCA98B9335DE475A001E31
                                                                                                                                                                                                                                      SHA-256:10235BFFB1FF0B07FEC89C05487A476025174E5DE0AE93668AABE42647653170
                                                                                                                                                                                                                                      SHA-512:69CDB5266CDC7B039AAE508E51AB68566E2557829EB308BC0BFE978CCF1C6BDFA1D590941D809F59A277BF93175B80816AA22C80C61274125BF23D85D06B52E7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.N... ... ... ....... ..!... ...$... ...#... ...%... ...!.O. ...!... ...)... ... ... ....... ...... ..."... .Rich.. .........................PE..d...z.$e.........." ...$............ ..........f.....................................0....`A.........................................;..T...D<..x....p.......`..(...H...p)......<...P5.......................6..(....4..@............0...............................text............................... ..`.rdata.......0......................@..@.data... ....P.......(..............@....pdata..(....`.......*..............@..@.rsrc........p......................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AVGSvc.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):843192
                                                                                                                                                                                                                                      Entropy (8bit):6.7178890156373114
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:y4r6hWdMAD/F+DWVa4a8h0lhSMXlWAodKLJkdV4KO:y4rNXd+DWw4ibJIV4
                                                                                                                                                                                                                                      MD5:4104E9FBFF086B0034518F86564D4905
                                                                                                                                                                                                                                      SHA1:DBEB4335075E74296CE5C4869A2F9909D577B432
                                                                                                                                                                                                                                      SHA-256:27A9C65492F4E0FB10DDC36FD9B612E3A37B0C713895AB0BD06A7B65781A8ED3
                                                                                                                                                                                                                                      SHA-512:BCEB197ABD90C3B680B92540E8BA9571CD7C099E4C3EF56C05AAAF369D0383B11398711D51B7C67432C828F8B9BA90223AD4DD0DDCE3F6DB8F837F9A891D8EB3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........U;..4U..4U..4U.[J...4U.[JQ..4U.[JV..4U.[JT..4U.,FV..4U.,FQ..4U..L..4U.=AP..4U.[JP..4U..KT..4U.,FT..4U..4T..6U..K\..4U..KU..4U..K...4U..4..4U..KW..4U.Rich.4U.................PE..d.....$e.........."....$.....~.................@.....................................@....`.........................................`u......lv...........Z...0...Y..H...p)...........u.......................v..(.......@...................dr.......................text...+........................... ..`.rdata..J...........................@..@.data....k.......X..................@....pdata...Y...0...Z..................@..@.didat..@............N..............@....rsrc....Z.......\...P..............@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20467128
                                                                                                                                                                                                                                      Entropy (8bit):6.502222061972111
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:HQruwBrSP2pkpTraEyJ3n/3kcC2NPBXqslxICr/PbDWhsMPO:N+rSP2pkyJ3/3kcBNZXqslxBn0O
                                                                                                                                                                                                                                      MD5:767ABCACCB38FF63952537525F357576
                                                                                                                                                                                                                                      SHA1:957D8C0C2FBD880A29B951FEC6C30F3A169F86AD
                                                                                                                                                                                                                                      SHA-256:F9A867F59F44E960DEF67C625FAEFB4BA51225B60A9A09451C0A5C52163F229D
                                                                                                                                                                                                                                      SHA-512:DDA10C4DAB4C65DC6F7516C79719C79C128B210A2C032731712E022B264B5C338CE7C7A08ECAE26867016050A036610AE5F9D06C004FA66BC670EB7E7ADC96AB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......q.L.5."]5."]5."]<..]-."].'\<."]...]'."]..&\?."]..!\1."]..#\?."]c.&\.."]..'\.."]..'\6."]c.#\1."]5."]3."]..!\4."]..&\$."]..'\.."].!\7."].&\;."].$\4."]c.'\K."].#\u."]!.#\ ."]5.#].."]!.+\.."]!."\4."]!..]4."]5..]0."]!. \4."]Rich5."]................PE..d...W.$e.........."....$......v......b.........@..............................:.......8...`............................................$.............%.P...........H$8.p)....7.8..............................(....'..@................B...T.......................text............................... ..`.rdata....C.......C.................@..@.data............~..................@....pdata...............D..............@..@.rsrc...P.....%......N#.............@..@.reloc..8.....7......N5.............@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AavmRpch.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):631744
                                                                                                                                                                                                                                      Entropy (8bit):6.3746900348910485
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:T3VKA0lAxpx4NytBSFvw53+AHyCbGDObG9TN/:T3VKA8AxAN8BSFvw53+AHyCbGDObG9p
                                                                                                                                                                                                                                      MD5:5582519A78039F8704BCB39CE62B71A2
                                                                                                                                                                                                                                      SHA1:3B46F21F4FBA1723543E99283DEDF997466223FF
                                                                                                                                                                                                                                      SHA-256:F28832B81A9F7C53A921C087F28028BAD3D54C412F1F5153FCF32672E6D1BF2B
                                                                                                                                                                                                                                      SHA-512:BA880614A21803083E3A09C6DE11914FC577458737B590C7BFDB47D51A5F74F50FEA3034AF559556060417D14289795A65EB9096DBF7702DEDE5F7822815A54F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......nW..*6q.*6q.*6q.H..+6q.Hu."6q.Hr..6q.Hp.,6q.#N..:6q.Ht.46q..Ct.+6q.>Ip..6q.|Ct.(6q..Dp.%6q.*6p..7q.>Ix..6q.>Iq.+6q.>I..+6q.*6..+6q.>Is.+6q.Rich*6q.........................PE..d.....$e.........." ...$.....~.......6........@e..........................................`A............................................|...<!..T.......h....@..,[..Hz..x)......$...............................(....G..@............ ...............................text............................... ..`.rdata..`!... ..."..................@..@.data........P.......,..............@....pdata..,[...@...\..................@..@.didat..X............`..............@....rsrc...h............b..............@..@.reloc..$............j..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4970936
                                                                                                                                                                                                                                      Entropy (8bit):6.5216130057791935
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:+MLYHmldC/nxp3wRuCYlNevz8cbBRI0nCvhA1xbJoCathduGbOSn0y6sMG8pld0O:ucuCYb4RIrvjdz0VGYvwJM
                                                                                                                                                                                                                                      MD5:22DDB7F75AC21C728BA925B578D21908
                                                                                                                                                                                                                                      SHA1:9AB76756FC3DF45DC1167AD89E694EF64A0C5E2D
                                                                                                                                                                                                                                      SHA-256:4D33D8C3CD01BD1AF202E5B0286EBA191271FC8F633A09FBDE2249138044D061
                                                                                                                                                                                                                                      SHA-512:D7626EAD44C4ADD24F5DAE0740B37AA454ADE6B97F9CA73C46C3C2C05EE6D52A4E625543435FD744E2E5D7E0682538462C8060C1F6B3756CC89D0AB10F0634E9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.........B...,}..,}..,}2.)|=.,}E..}..,}E.(|..,}8.)|..,}E.)|..,}E./|..,}2./|..,}#.)|..,}.}..,}{.(|..,}..(|..,}..,}..,}..)|..,}#.(|..,}2.(|..,}2.-|..,}..-}..,}..%|..,}..,|..,}...}..,}...}..,}...|..,}Rich..,}................PE..d...{.$e.........."....$..2..n......@..........@..............................L.....d2L...`......................................... .A.......A.,.... L.8.....I..]..H.K.p)...0L..g..0.:.......................:.(....:.@.............3.p............................text...j.2.......2................. ..`.rdata..\.....3.......2.............@..@.data........A.......A.............@....pdata...]....I..^....H.............@..@_RDATA..\.....L......>K.............@..@.rsrc...8.... L......@K.............@..@.reloc...g...0L..h...HK.............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AvConsent.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):674240
                                                                                                                                                                                                                                      Entropy (8bit):6.788171405730896
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:HvF9emhKG8ZtDee8LFPMdV4Fg/LFPMdV4FgO:HvFABZtDee8JkdV4K/JkdV4KO
                                                                                                                                                                                                                                      MD5:5A0BB4D4663C33E38D4ED7356D064C35
                                                                                                                                                                                                                                      SHA1:F6C04C9BDEEB3164AFE6B9FCE51A694C0E8115B4
                                                                                                                                                                                                                                      SHA-256:1693A32D68A5FAA4EED838DB16B0D92EB66A591E8B3FA2270CF16448661D4A7C
                                                                                                                                                                                                                                      SHA-512:F8624D7700D866E0E6E990D27B94266D5B42089B9BA8F382BDD07B725AC61A04BD618A783135CBF916FFB03A60AA8920DB008E309EEAB72B6E1AFB62B4702643
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........Q..;0..;0..;0..N&.90..N..10..N..90..N..=0...B..90...B..90..2HH.)0..mE..80../O..90..N...0...E..:0..;0..80...B..*0..;0...2../O..j0../O..:0../O$.:0..;0L.90../O..:0..Rich;0..................PE..d.....$e.........."....$............ ..........@..........................................`.........................................@.......$...h........g.......B..H ..x)...p............................... ..(.......@............................................text............................... ..`.rdata...M.......N..................@..@.data............n..................@....pdata...B.......D...l..............@..@.didat..`...........................@....rsrc....g.......h..................@..@.reloc.......p......................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1290688
                                                                                                                                                                                                                                      Entropy (8bit):6.613386388683355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:rVR1Aol1pnKOLFnSRMsR2DddSA3MYfKyc0aM1qLh0lhSMXlS9/bbEJkdV4Kpc:b71K8FSRiDddFcYo0S6DJIV47
                                                                                                                                                                                                                                      MD5:73F82E3C7A1090B78C043DA2F200A35D
                                                                                                                                                                                                                                      SHA1:7B022D69A611364B79F8874608CD32D1A57B704D
                                                                                                                                                                                                                                      SHA-256:21D5491BC45A711015793649760FB5750ED8C86BF1051FE83EBB5B0BE2A94C98
                                                                                                                                                                                                                                      SHA-512:E000A1D7325494D0370F68164B97D63F26D4C30634F5A6141F73FE262EC1D83FD84295A0D929ECA88A351CF2E6E0B3E21C7A5BAE8F3AC9CA5DAF5A7C29F84632
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........................K.......Y.'....Y....Y.....$.....Y.....?.......I...................................%......M..........Rich...........................PE..d...).$e.........."....$.....J.................@..........................................`.........................................`.......D...........HY..........H...x).....................................(.......@.......................@....................text............................... ..`.rdata..l=.......>..................@..@.data...(....0...b... ..............@....pdata..............................@..@.didat..P....p......................@..._RDATA..\...........................@..@.rsrc...HY.......Z..................@..@.reloc...............r..............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AvEmUpdate.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5190080
                                                                                                                                                                                                                                      Entropy (8bit):6.553198465911655
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:zMLJH6ldfnkdJTvsidmQXPcCB03xdK2r+O/nQYIBjV7znSbAbw93HmuYrBnvB4uC:u92xdGY5Dp6LZaaZXro
                                                                                                                                                                                                                                      MD5:04EE29B8B770222B84B2B8075DA30A2E
                                                                                                                                                                                                                                      SHA1:A88233FFE519856935A2B18084392146F7FFA65A
                                                                                                                                                                                                                                      SHA-256:2CF2C96C665039348676D4A5FE642B3A62E96C82B32BA4B4BA98BB7490676657
                                                                                                                                                                                                                                      SHA-512:5A423A816EEC7B40E80B68F3BFF998EB747C5C7DA3506DF111E1450E70CC12EDEA3A2FF0742F70EC64D5C73F8756A2DA38158FDB5912085548A899FFE068F67F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........Z^...^...^...............Y.......M.......,.......T.......Q...........W.s.\...^...R......._......._......._.......y......._.......y...^...E......._.......Y...J.......J..._...J..._...^.w.\...J..._...Rich^...................PE..d.....$e.........."....$."5.........P).........@..............................P.......O...`..........................................!D.....h"D......@N.PZ....K.tD..H.O.x)....O..a..0#=......................$=.(....!=.@............@5..............................text....!5......"5................. ..`.rdata.......@5......&5.............@..@.data....q...`D......:D.............@....pdata..tD....K..F....K.............@..@_RDATA..\....0N......HM.............@..@.rsrc...PZ...@N..\...JM.............@..@.reloc...a....O..b....N.............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\AvLaunch.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411584
                                                                                                                                                                                                                                      Entropy (8bit):6.966484428831523
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:0jLGSVsLph0lhSMXl+i5v+LFPMdV4Fg5:0ZVWh0lhSMXlX5WJkdV4K5
                                                                                                                                                                                                                                      MD5:E3332CED7718ED6993220E79BDA98A44
                                                                                                                                                                                                                                      SHA1:8EC6EFDDC4A45BA1A536F18A58D0F73A958ABE79
                                                                                                                                                                                                                                      SHA-256:25788EB2EE0CCCCFD80809C34637F0532089E608079C55E3F98AACF6E6871CC8
                                                                                                                                                                                                                                      SHA-512:8500A14F39A98F92BFEBC11EAD0E8AD6DA0E85B51F02F527C97021F12173560314E21441DB2CAFF5B1FD346A32AA2497BC3B9A9D73F52CA98B07DF6516453207
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......w...3.T3.T3.T..JT1.T...U9.T...U7.T...U..T...U5.T:.$T .T.U2.T.U?.T3.T..T3.T0.T'..Ug.T'..U2.T'.HT2.T3. T1.T'..U2.TRich3.T................PE..d.....$e.........."....$.......................@.............................p............`.........................................@.......$...,.......HZ..........H...x)...`.......+.......................,..(....*..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...H,..........................@....pdata........... ..................@..@.rsrc...HZ.......\..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\BreachGuardSdk.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2099024
                                                                                                                                                                                                                                      Entropy (8bit):5.550046465587105
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:EzJzK8ZB7kVE2msLu8tFW4oUjXZWn4N32lt6GsJJrIP:Ezh9gCsLu8HBXZWn4N3wtHsLm
                                                                                                                                                                                                                                      MD5:29042E26983B64E3529A705DE8B62A63
                                                                                                                                                                                                                                      SHA1:E848EB98DEE3D78E467FA686238DB5797077F7D2
                                                                                                                                                                                                                                      SHA-256:1EA8EFE87962A33EF85A60AE98DA76AA19068D9B3B759BCA2259CFFC97EFE59D
                                                                                                                                                                                                                                      SHA-512:9056198A888686F4B474C37FA1361C0D9953612B788EABF0F38165E8B023F3F3396F686163C42CA030B1F8E0FD535C4C9872075382E14B1835085A003547DCD1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W.|...|...|....G..|.......|.......|.......|.......|.......|...|..4|..n....|..n....|..n.+..|...|C..|..n....|..Rich.|..........................PE..d....dNc.........." .....x...n......G........................................@ ....... ...`.........................................0....&............ ......0..4L......P).... ......?..8................... I..(....?..8............................................text...Ew.......x.................. ..`.rdata..B............|..............@..@.data........@.......$..............@....pdata...n...0...p..................@..@.idata..Z7.......8...r..............@..@.tls................................@....00cfg..Q...........................@..@.rsrc......... .....................@..@.reloc...$.... ..&..................@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\BrowserCleanup.ini.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):4.624111172624227
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:xVRcyqFhXUAKFn:xVRaFhiF
                                                                                                                                                                                                                                      MD5:4957ED73D5E5E303E351C8F8B7B53E1C
                                                                                                                                                                                                                                      SHA1:E61238F49E44237C56D4D5B41AEB150160880B74
                                                                                                                                                                                                                                      SHA-256:59727F7A256B7A70971F2E62B43B0A923937F85689FC3AA4AE50E4FBFBF83499
                                                                                                                                                                                                                                      SHA-512:DB4854667285BB1CD8D07AB189607EC5BC489AFB2D0A5B5A3388F91CEFD012FECA689787452901E0EB1DE6E8792E69C0097C38B89BBA0D977D0B29E5E5EF2FEB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:[App]..ServerURL=http://bcu.ff.avast.com..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\CommChannel.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1353152
                                                                                                                                                                                                                                      Entropy (8bit):6.42637199385006
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:5OGiqmH0kd8lUL0dES7PT55baMuzqU2TEz7R4fC:5OGiqQ0kd8EGXpsjx2TK
                                                                                                                                                                                                                                      MD5:BB1A91C763385B4C0339F9E6DB19C59B
                                                                                                                                                                                                                                      SHA1:808D6D509B8BA7D4C3F4CD16213F6A6F14459370
                                                                                                                                                                                                                                      SHA-256:97604514E70A454544B467B292E96FC35E8ECC9B9D7BEE43063848D7910A430E
                                                                                                                                                                                                                                      SHA-512:C31135FE6AB7D24B69130AA4030C7A89DA1385C77E9E8460AD83BD6CB33B59C07C9961FE326553F8C7C6A12265897C076E9A7AF39D1540EEF0FE91C35F4718CA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......!r.e...e...e...g..g....mW.n....m..m....m..g....m..m...a..g...a..g...lk9......}..c...3f.......m..E...f..d...3f..g...a......ql..n...e.......ql......ql..d...qlU.d...e.=.d...ql..d...Riche...................PE..d.....$e.........." ...$.(...^.......................................................M....`A........................................`V..h....W..........X.......|...H|..x)......p...x...........................(....q..@............@......dP.......................text....&.......(.................. ..`.rdata..dd...@...f...,..............@..@.data...............................@....pdata..|...........................@..@.didat..x............X..............@....rsrc...X............Z..............@..@.reloc..p............b..............@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\CommonRes.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1833912
                                                                                                                                                                                                                                      Entropy (8bit):7.54130263993297
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:pw1xw0Y4X50ToBD0Mklc2UnWXqYiHC8V:ajp0ToBDXr2rqYiHC8V
                                                                                                                                                                                                                                      MD5:EB9125AC3C0ADC2E9BE9B5C405A1A2F0
                                                                                                                                                                                                                                      SHA1:A45827D6847E8931E6C58C753D49364FAE6C4C21
                                                                                                                                                                                                                                      SHA-256:83877D368BFF2DD8B8F110E92649AD28CA1D7118C5280C0CED46BD60B475623A
                                                                                                                                                                                                                                      SHA-512:26C6023CA490A8D6A936C1E189B2A7B306CF72E10D78B7183970FB903B265CC95A603E4F32386734965A0CFB05FCF616DD37305E4C1F4FF52ABFF837080AC6D0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z...Z...Z...S.q.X.......X......Y...Z...x.......P.......R.......Y...N...X...N...[...N...[...Z.u.^...N...[...RichZ...........................PE..d.....$e.........." ...$............p..........f..........................................`A........................................`(..8....(..P....P.......@......H...p)......,...."...............................!..@............ ...............................text...(........................... ..`.rdata..N.... ......................@..@.data...@....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\HTMLayout.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4157376
                                                                                                                                                                                                                                      Entropy (8bit):6.484288987221152
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:rAjIj0qqqqqizlf9r1L3rMaGSzma8MiTlKVe3zzsJlliRkOedsYYJT653qrqNWDh:9Ev1LO88zDilMkOfYarqNEIOh
                                                                                                                                                                                                                                      MD5:8EBE16AE0DD136418999CE7196AE5033
                                                                                                                                                                                                                                      SHA1:244275BF43ADCAAC0525A5E403ECA1DDBFCA9E94
                                                                                                                                                                                                                                      SHA-256:87A63D31B6BE9530B0D1272A56F657FF411A02A2A8EE3B13CA70541DB6396083
                                                                                                                                                                                                                                      SHA-512:CC719B0ED3D33A0B6478E024B080BD22CAFE2826085E45C24B44C49DA7ED31CF04E15C9FF97F50551DAA4EDB8DF69AA15764CEAB033D804F67930011C8A56CB8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......BB2..#\U.#\U.#\U.QYT.#\U.].U.#\U.]YTV#\U.]XT.#\U.]_T.#\U.Q_T.#\U.QXT.#\U.MXT.#\U.Q]T.#\U.#]Uo"\U.\UT.#\U.\\T.#\U.\.U.#\U.#.U.#\U.\^T.#\URich.#\U................PE..d...`.$e.........." ...$..0..........$(.......................................?.....x.?...`A........................................P.:.......;.,....p>.....P<.....HF?.x)...0?......6.......................6.(.....6.@.............0..............................text.....0.......0................. ..`.rdata..z~....0.......0.............@..@.data........@;......,;.............@....pdata.......P<.......<.............@..@_RDATA..\....`>.......>.............@..@.rsrc.......p>.......>.............@..@.reloc......0?.......>.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgArDisk.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):31568
                                                                                                                                                                                                                                      Entropy (8bit):6.967020187106408
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:USp0wfwonXyrGJXSNb3FR6Cc31AqR9z2snIYiif3DyAM+o/8E9VF0Ny4GX:vyCJCNHor9zXIYiiGAMxkEdX
                                                                                                                                                                                                                                      MD5:51952D9054DCD82D3144297D516977CB
                                                                                                                                                                                                                                      SHA1:C2A2ED18E8CBA17B6C6CFCC5996A1F3487DF0D46
                                                                                                                                                                                                                                      SHA-256:FF9FAB4C025647959D4E107BEFBF080C374FE21378E7205AC83F1A131A8D9820
                                                                                                                                                                                                                                      SHA-512:A5EFF769E1722BB60395BB8752C55E202D852E0538E3A5C565CB6234F1FC6F66702EFB9CD995C837AEBEF6BEBF6901FFE71083E3773E933D6763662801697867
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n.y...*...*...*z}.+...*...*...*z}.+...*z}.+...*mz.+...*mz.+...*mz.*...*mz.+...*Rich...*........................PE..d.....#e.........."..................`.........@..........................................`A.........................................P..W....`..(....p.......@.. ....*..PQ...... ...0!..p............................!..8............ ...............................text............................... ..h.rdata....... ......................@..H.data........0......................@....pdata.. ....@......................@..H.edata..W....P......................@..@INIT....D....`....... .............. ..b.rsrc........p.......$..............@..B.reloc.. ............(..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgArPot.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):240616
                                                                                                                                                                                                                                      Entropy (8bit):6.568453964893847
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:RyYbj19MQjfq8/XWMb1gBqaluvLcDxj1QW:Ry6zj/Xhb1AfLQW
                                                                                                                                                                                                                                      MD5:CAAE722D9630C5A71FB33B618A5E33FF
                                                                                                                                                                                                                                      SHA1:FB91850ED3BD05ADC800D2BCA90B18D1B2AEA8E7
                                                                                                                                                                                                                                      SHA-256:F74D40C37DFC1A66DFD27426700FDFFF2047036732EF6BA6028E2378E1A994C8
                                                                                                                                                                                                                                      SHA-512:437D49BB882F3AFF16B798B9088EA4F5A60F74A80FBE00EA1BBAC5D9C1A6C53BA7F7CE178CA297751D3B824D2F89FDD2FB4AB78B58087E9CA605817E48DD7630
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R..H.......................................................................z............Rich............................PE..d.....#e.........."............................@.........................................`A.........................................p..V.......(............0.......T...W..........P...p...............................8............................................text............................... ..h.rdata...G.......H..................@..H.data...............................@....pdata.......0......................@..HPAGE.........P...................... ..`.edata..V....p.......4..............@..@INIT....L............6.............. ..b.rsrc................L..............@..B.reloc...............P..............@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgBoot.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):313272
                                                                                                                                                                                                                                      Entropy (8bit):6.86052559422491
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:mqCPYrWuMLbHACldSS5tHy7SG7Hn3XUwSGeTiRRJUiA53VYOdGVj8IcPfVwM:yuMLbHACldSgwSGJitdGVj8IcPfVf
                                                                                                                                                                                                                                      MD5:A02B37CEA56FD1DFD8D57FF3413449F5
                                                                                                                                                                                                                                      SHA1:86813422153F252D2F1A789346845D5DD352301F
                                                                                                                                                                                                                                      SHA-256:BDC52074194A35DA9E1BC21717E4F5C48514D48EC2FF51208FC69FE93C9A44CD
                                                                                                                                                                                                                                      SHA-512:69B8C2245F52515C9856D69F23B960C0C612144D7FDCA39B08E4C77C8326BD7697B93A9FD45E50C837AACAF68147D50025D7C0F9629401BCADC0CBA6C1BCB98C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g1..._..._..._.nZ..._.n\..._.n[..._..k[..._..k\..._..kZ..._..._..._..t^..._...^.U._..t[..._..yV.._..y...._..y]..._.Rich.._.........................PE..d.....$e.........."....$............@...............................................Z.....`..................................................v..(...............@...H...p)..........8@..T...........................0?..................x............................text............................... ..`.rdata..............................@..@.data...H!...........r..............@....pdata..@............t..............@..@.rsrc...............................@..B.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):25064
                                                                                                                                                                                                                                      Entropy (8bit):6.36659004745478
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:EwugbPlbsRI5W2cUMAO+w9dX8qPTKAR9z6++5jW:E9uw2cUMWIP289zh+JW
                                                                                                                                                                                                                                      MD5:3AB7DD53C5A5546A29E208C76100C189
                                                                                                                                                                                                                                      SHA1:66BF0D92CAC9A59087D16B826FEF31D7B9FE62FD
                                                                                                                                                                                                                                      SHA-256:0ADCDB9F44E4BCA1D5AE538F1D0EFC71CE4C8127945878F64131F4B27881679B
                                                                                                                                                                                                                                      SHA-512:1F45EC8B6298A3313082C4A483E5C6BF4367A2C931472A525198FB9D3A9BBA01B9FB326BE1B4E7800936BFAE4DE8CC99FA7514748FC5FD2E1CE8E2D2DF99C0E2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@..@..@..Q2..@..Q2..@..Q2..@..@..@..:5..@..:5..@..@{.@..:5..@..Rich.@..........................PE..d....R5c.........."......"...........`.........@....................................`......A................................................\`..(....p.......P.......<...%......(...@1..p............................1..8............0...............................text...+........................... ..h.rdata.......0......."..............@..H.data........@.......*..............@....pdata.......P.......,..............@..HINIT.........`...................... ..b.rsrc........p.......2..............@..B.reloc..(............:..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgKbd.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):39680
                                                                                                                                                                                                                                      Entropy (8bit):6.818292314860308
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:RhMWnA5ys5fYd6JIXJH6u9zi4Yii8eAMxkEVl:RhRnA5t5S6qtvzi47Fsx5l
                                                                                                                                                                                                                                      MD5:4264918BF94E76AF7DA5DA0991C7C706
                                                                                                                                                                                                                                      SHA1:A3CF4F8D2C7E2E881A5FF6BF8037BA10CB586176
                                                                                                                                                                                                                                      SHA-256:71172B8815616DC30BF899CD2C604D1C7D649F9D7D743D1FD4CDFA065573CB4C
                                                                                                                                                                                                                                      SHA-512:1E4AA84D55FA4E4E502CAFFEA4434ECEFAC6872298426FCD8CAD33AEBD38EF1F445E6616B1D7C4F25CB0D683A4830E60D015221F94B89EABDFF3BB557A536DC7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s....f...f...f.)`g...f...g..f.)`e...f.)`b...f.>go...f.>g....f.>gd...f.Rich..f.................PE..d.....#e.........."..................p.........@.....................................]....`A.................................................p..(............`.......J...Q......t...HG..p............................G..8............@...............................text....$.......&.................. ..h.rdata.......@.......*..............@..H.data...\....P.......8..............@....pdata.......`.......:..............@..HINIT.........p.......<.............. ..b.rsrc................D..............@..B.reloc..t............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgMonFlt.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):275208
                                                                                                                                                                                                                                      Entropy (8bit):6.234677811270204
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:j+FvnsIFM4WeOS7waPU+FqeudnrBY8nZMaD/wNJ:j+WIFMNWwaPUcBV8nZVIJ
                                                                                                                                                                                                                                      MD5:B3808C5B0B5B4E1E1FF374AED8274001
                                                                                                                                                                                                                                      SHA1:49F652AF0D39CEB4D648AEFD73E2C5A2A3D0DE17
                                                                                                                                                                                                                                      SHA-256:71C802E311144FA2F44F2A232D313FBE2D84992F60CE68E35753A1D530AFF9A5
                                                                                                                                                                                                                                      SHA-512:F2FCD5824F7B55E4261CF380047BB99108363D724800A8A92CFE53FCF15D6944DAE1AE8E31E4719DB1D1746B53BB2B1305D688D9E789703AC232B2F011DB7744
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Y...Y...Y/..X...Y/..X...Y/..X...Y/..X...Y...Y...Y8..X...Y8.+Y...Y8..X...YRich...Y........................PE..d.....#e.........."..........\....... .........@.............................p......3.....`A................................................. ..d....P...................Y...`..........p...........................P...8............0...............................text...2........ .................. ..h.rdata..L....0.......$..............@..H.data....F...0......................@....pdata...............&..............@..HPAGE.....q.......r...<.............. ..`INIT....6#... ...$.................. ..b.rsrc........P......................@..B.reloc.......`......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgNetHub.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):561816
                                                                                                                                                                                                                                      Entropy (8bit):6.124103521745421
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:qXgoMMWi2L9NDLNhrQZ6UBtKT8nsSKnLFYS8wRtW3zW96b:qwAz2LbD5hKxtKT8nsScLF3PRtW3zj
                                                                                                                                                                                                                                      MD5:EBD02032178A9A44DEA5C5C8F8992407
                                                                                                                                                                                                                                      SHA1:06A4D24E4ED51F8BD1C298717D6F6B56F8F6C268
                                                                                                                                                                                                                                      SHA-256:1FD44DC82E2BF8EB4DE9D74EFD532419BD5709E8000D0F07F818250C943B88C8
                                                                                                                                                                                                                                      SHA-512:3B1F9B905A6616D8496AA321A960D51B82CEBC0C75C1C691C922ECAE1A2B8BF318AB24A12EDF56ED71DAEC58F7C3F03543A934ADB59D9F92F6ABDFE910CA3AE1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........s...s...s..,....s..,....s..,....s...s...s..;...s..;.J..s..;....s..Rich.s..................PE..d.....#e.........."..........<.................@............................. .......c....`.....................................................x................-...0...b.............p...........................P...8...............(............................text....t.......v.................. ..h.rdata..xZ.......\...z..............@..H.data...............................@....pdata...-..........................@..HPAGE....L........................... ..`INIT....:........................... ..b.rsrc................(..............@..B.reloc...............,..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgRdr2.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):105280
                                                                                                                                                                                                                                      Entropy (8bit):6.591139891611463
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:zl+TJSg88ZUZLt/cuBf1sC36w/+JDOaFXa2x2fVYD32tTw+zHSa7Nxo:zEnecux1SO+sCK2AmD32tjztw
                                                                                                                                                                                                                                      MD5:F9F037CCC4302496E4AB814A3410D33B
                                                                                                                                                                                                                                      SHA1:DE5D67E1902974534B40921D19B8086EE7E9AB26
                                                                                                                                                                                                                                      SHA-256:A669DAB599FACD3CB2079FF954F1A4EC973750E781F2BCC4FB2E2CC083F3CA41
                                                                                                                                                                                                                                      SHA-512:92D8FF8B07AFB51D5FE7CFF2CB20169C74023E01CD6464E843F88689BFA9C93C6CACB8FB55B211241023BFBBEF18075C133061910E40F49D62427DC2EBF76781
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.m.t...t...t......w......|......r......f......}...t..........n......u......u...Richt...................PE..d.....#e.........."..........J.......p.........@..........................................`A.................................................p..d............@..p....H..@S.......... ...p...............................8............................................text............................... ..h.rdata...'.......(..................@..H.data...l.... ......................@....pdata..p....@......................@..HPAGE.........P...................... ..`INIT....x....p...................... ..b.rsrc................B..............@..B.reloc...............F..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgRvrt.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):80568
                                                                                                                                                                                                                                      Entropy (8bit):6.684715196516567
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:MH+o0PKfT7JVRBRBhXbOVUPiFNkv6Ba7bUDh327l8JJBzXE7SxQ:FoTgVFNkN8DhQ6zBIF
                                                                                                                                                                                                                                      MD5:3F371F8511DDC36A1FF0982F9302D483
                                                                                                                                                                                                                                      SHA1:CDCCE16394835F26A0AF6B8707EC663293441A8A
                                                                                                                                                                                                                                      SHA-256:20E27D34B0566F9F3A75D0BAE48ED04105651A23C8F4F412A8E93F6D4AC76E6E
                                                                                                                                                                                                                                      SHA-512:E100BC933C29513CBB08E930BDFDB5D5FA9CDFC9649A3F8662E443DB62DDA138DD5ACCAA42065C5A351DE594DC6C4130D222E0B696BD6DBD6A9E4057BCB190D7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x.T.x.T.x.Ti..U.x.T.x.T.x.Ti..U.x.Ti..U.x.Ti..U.x.T~..U.x.T~.*T.x.T~..U.x.TRich.x.T........................PE..d.....#e.........."..........0.................@.............................0......P.....`A....................................................(........................R... .........p...........................P...8............................................text............................... ..h.rdata..............................@..H.data...P...........................@....pdata..............................@..HPAGE................................ ..`INIT....t........................... ..b.rsrc...............................@..B.reloc....... ......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgSP.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710056
                                                                                                                                                                                                                                      Entropy (8bit):5.893713430763462
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:nE/qLLEk0ISCL12kJq726AZVAOUEo3hClSAzU:E/qLLEk0BcJaDy2OUt3h8SAg
                                                                                                                                                                                                                                      MD5:0B22637ED888AFAB629365FB91C1400C
                                                                                                                                                                                                                                      SHA1:71AB6BBE6DAD6A3460BF4F930EFC4CF916862A99
                                                                                                                                                                                                                                      SHA-256:ADAD588E7880BA7AE4F28AA20CEC98B2036DE4FD0AFAFE9F44F0693800E5B745
                                                                                                                                                                                                                                      SHA-512:6E92529D9A07B8DFB414E07F9B7A5C5533162FC00CA5C8AB23D3D4D30919F8CB4A21959CD4BACE3B80FB8E9095C13B73E78C8106E55321E3B690FC4F7205C9EF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;....c...c...c.....xc.....yc.....wc.....vc...c...b.....|c.....&c.....~c.....~c..Rich.c..................PE..d.....#e.........."............................@.....................................4..........................................................d............ .......n...g..............p...........................@...8............@..x............................text....,.......................... ..h.rdata.......@.......2..............@..H.data........`...r...J..............@....pdata....... ...0..................@..HPAGE.....;...P...<.................. ..`INIT....R-...........(.............. ..b.rsrc................V..............@..B.reloc...............Z..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgSnx.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):951360
                                                                                                                                                                                                                                      Entropy (8bit):6.190954210183528
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:7LtU7Ll1jStHVFKYvYVliny5R61xzVxJo55zfpvHf+kQPcm:7LtU7Ll1ugY2gnphoHzfpvHf+kvm
                                                                                                                                                                                                                                      MD5:BCF9BC08798C309A24E2C491717824CF
                                                                                                                                                                                                                                      SHA1:23F617A09E02548FADF83CA02DD4D33B16890C08
                                                                                                                                                                                                                                      SHA-256:5E2C44BBED0C7BF528B035768FD3906D5D2EAF971FFCCB8E1E104A2930118619
                                                                                                                                                                                                                                      SHA-512:6741670E0F2815DDEBF746B6012722D1D8DD421F4612EFAB3849EA52FEC221AB54A0E6ADE9D97DA0A72CE1419CEDEB23C7125032FE94087C4EC04BCC5055ACB3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........s...s...s.......s.......s.......s.......s.......s...s..hr.......s.......s....A..s.......s..Rich.s..................PE..d.....#e.........."......<.....................@....................................~y..........................................................x....P..........h=......@p...`..........p...............................8............0...............................text............................... ..h.rdata...I...0...J..."..............@..H.data...,S.......(...l..............@....pdata..h=.......>..................@..HPAGE....~.... ...................... ..`INIT...."1.......2.................. ..b.rsrc........P......................@..B.reloc.......`... ..................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgStm.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):213336
                                                                                                                                                                                                                                      Entropy (8bit):6.493229037189328
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:4QE7/vmNrAgjRrvJTB4Fu6Hq22aWfX9asqe2R81sf0+gyYe4BI0:U+pjRbuu6HM/9WcGq1n
                                                                                                                                                                                                                                      MD5:9D47F9383831C1C7919AFDAF98D554EA
                                                                                                                                                                                                                                      SHA1:FB406739ED18BD29C529DAE32C070B2C0021D032
                                                                                                                                                                                                                                      SHA-256:E811C9100F55BF61324F71EB90F2DD7327E80DC727443E2EB234C3F6160D7310
                                                                                                                                                                                                                                      SHA-512:6A171773996AF22EC0094A8E935E6138FE32F9FFA2023C04A1548DC2CDE83E815E6D668539C283A31E2C90B66EEAE4D76449C4B3894384264B29A68F27524248
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k.l.j...k.f.k...k.f.k...k.l.j...k...kZ..k.l.j...k.l.j...k.k.j...k.kmk...k.k.j...kRich...k........................PE..d.....#e.........."......X.....................@.............................P.............A................................................d...d....0..................XW...@..........p...........................0...8............P..p............................text....=.......>.................. ..h.rdata...b...P...d...B..............@..H.data...............................@....pdata..............................@..HPAGE................................ ..`INIT................................ ..b.rsrc........0......................@..B.reloc.......@......................@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):319712
                                                                                                                                                                                                                                      Entropy (8bit):5.548468330511625
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:uHlP8bwIdIhyZkShKbAdku1PnDY0kjDjKPTCKcs/u:Xvdk005Sc
                                                                                                                                                                                                                                      MD5:D7DF30B028B3D48B4E6F83F4DEF53679
                                                                                                                                                                                                                                      SHA1:839E6AD38926B9AC6DC2069F1BA13F18071985AB
                                                                                                                                                                                                                                      SHA-256:575798F903C5E8696F3BA967E86859FB8E8CB22D265BCC5B7FE053876AC287FF
                                                                                                                                                                                                                                      SHA-512:6FB691FEC8FBCB992E892F559F8ACEAE416C9E29941BDEDDFD0518ADD169B47F9B1A003BDE91E4BCDC3E256600D9A71014A9E3EF63B9D1C1AFE989E1FA992627
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QP%..1K..1K..1K..CJ..1K..1J.1K..CH..1K..CO..1K..CM..1K..DH..1K..DB..1K..D...1K..DI..1K.Rich.1K.................PE..d.....#e.........."............................@................................................................................................<............`..`........Z...... .......p...............................8...............p............................text............................... ..h.rdata...W.......X..................@..H.data...HG.......H..................@....pdata..`....`.......8..............@..HPAGE.........p.......H.............. ..`INIT....*............d.............. ..b.rsrc................x..............@..B.reloc.. ............|..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsdriver.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):393536
                                                                                                                                                                                                                                      Entropy (8bit):5.998324877995473
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:tSzUEoO4WaQH+nRnZI4kdveC0VEMUE10vp5jz3Bg+:tlY4fnu4kYV1UPvz
                                                                                                                                                                                                                                      MD5:5681E8860E1F502D6BB3A500EC624993
                                                                                                                                                                                                                                      SHA1:AC1C887605B5C83043E3D29B63B998A0A0B50D86
                                                                                                                                                                                                                                      SHA-256:73941B08BCBAEB7B82F202D82AACBE8C350921626F0C8D0FCE7965549EC8C339
                                                                                                                                                                                                                                      SHA-512:A5AF55A22C48816A3C03AFC14F00E57753EFF51AF6B84E879D45A71350BE67F56BE81B50C559E443BC9EF2E7DA6DF4540E24C22EDADCECDEA6AEC9C72D96C77A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X_.H91.H91.H91..K4.I91..K7.O91..K2.N91..K5.O91..K0.O91.H90.c81..L2.I91..L4.I91..L8.%91..L.I91..L3.I91.RichH91.................PE..d.....#e.........." .....D...........k....................................... .............A....................................................P.......X....... .......@]..............T........................... ...8............ ..x............................text............................... ..h.rdata....... ......................@..H.data...)W...@......................@....pdata.. ............8..............@..HPAGE............. ...V.............. ..`INIT.... ............v..............@..B.rsrc...X...........................@..B.reloc..............................@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgbidsh.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):297912
                                                                                                                                                                                                                                      Entropy (8bit):6.183421192086843
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:KAwWPz3KVh9MtamxteVwwPa425P8WFZiE1C+2b2:KAwW+mtntexPa425P8WXCDi
                                                                                                                                                                                                                                      MD5:5487C3976E9F0381DB4565AF8444E31B
                                                                                                                                                                                                                                      SHA1:8C98C2E5E6AD276F714C57DE2D1959D370F028CD
                                                                                                                                                                                                                                      SHA-256:9E340F9942EA97650A0EA2CBCB0A96865BDC45961A1ABB5395A4E8E69AEFA916
                                                                                                                                                                                                                                      SHA-512:50915F5F3D539DCB2B0ACB1E90B205ED136AAB1967886925CEB70D9A1F3F79A1286C8124BAFBB017C40923E4E78AC23A9CF0D7559F1ADA384B1F067A556431A1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......fV=."7S."7S."7S..EV.#7S..EP.'7S..EW.'7S..ER.+7S."7R..7S..BZ.C7S..B..#7S..BQ.#7S.Rich"7S.........................PE..d.....#e.........." .........J.......i.....................................................A.................................................@..d....`..P.......H....2...Y...p......0...T...............................8...............`............................text...L........................... ..h.rdata........... ..................@..H.data...............................@....pdata..H...........................@..HPAGE.........0...................... ..`INIT....~....@......................@..B.rsrc...P....`.......$..............@..B.reloc.......p.......*..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Inf\x64\avgbuniv.sys.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):96504
                                                                                                                                                                                                                                      Entropy (8bit):5.948340659659551
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:0a+0oL249gVd1D05DcxDDDDDDDDUlJcNIXZ2ijzPC97CxKw:0bNHJcNkZ7jLC9c
                                                                                                                                                                                                                                      MD5:AC092BA513D1A4EDEEECA16106B248EC
                                                                                                                                                                                                                                      SHA1:974ACB952C8316CD5F98085C9578D1E1FB1EC11E
                                                                                                                                                                                                                                      SHA-256:CCD7A1E2CE01BF66B6B5560F984C160C32AC9F038D9C4D25714976566A430F0A
                                                                                                                                                                                                                                      SHA-512:6609BCB02D8B599FB28D128FAFD0521A9C4BE3834CCC7147733F4EE0D3D8E981915ACCD37A6EBD72A5993CB6E4F20ED364BB850473CE3A0870291BE53EF33CDB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.......+...........R...+.......+.......<.......<.......<.......Rich............................PE..d.....#e.........." .....z...........(..............................................V......A.................................................P..<....`.......0.......&...R...p......T...T...............................8............................................text....m.......n.................. ..h.rdata...............r..............@..H.data........ ......................@....pdata.......0......................@..HPAGE.........@...................... ..`INIT.........P......................@..B.rsrc........`......................@..B.reloc.......p.......$..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\Boost.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1361
                                                                                                                                                                                                                                      Entropy (8bit):5.135395644586466
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:8fT20oz6AMIot5LLxUFB93xyPvsjt99QHbsUv4fOk5T0No3SFf:QT3oz6Ec5xUb9EyQHbs5JD3SFf
                                                                                                                                                                                                                                      MD5:B51058FEAD1AA71840B79527F5BFFD3D
                                                                                                                                                                                                                                      SHA1:BC3C4D41D4CC7753BEA8E7A77FDB7CD384ADBB59
                                                                                                                                                                                                                                      SHA-256:BEB8E42E9D6B4284E03304D05A81A0755200A965FC8D0A5E0AEA1E84CF805D6E
                                                                                                                                                                                                                                      SHA-512:F1A8D21CCBB6436D289ECFAE65B9019278E40552A2383AAF6C1DFED98AFFE6E7BBF364D67597A131642B62446A0C40495E66A7EFCA7E6DFF72727C6FD3776407
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Boost Software License - Version 1.0 - August 17th, 2003....Permission is hereby granted, free of charge, to any person or organization..obtaining a copy of the software and accompanying documentation covered by..this license (the "Software") to use, reproduce, display, distribute,..execute, and transmit the Software, and to prepare derivative works of the..Software, and to permit third-parties to whom the Software is furnished to..do so, all subject to the following:....The copyright notices in the Software and this entire statement, including..the above license grant, this restriction and the following disclaimer,..must be included in all copies of the Software, in whole or in part, and..all derivative works of the Software, unless such copies or derivative..works are solely in the form of machine-executable object code generated by..a source language processor.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WA

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\Crypto++.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3949
                                                                                                                                                                                                                                      Entropy (8bit):5.157096605941707
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:E8xqQdQZJqWbbfwpnusz6d5y9EyQHE2xJ8rYJgNse:E2qQdGq6wpnufU2yQHE2H8rsFe
                                                                                                                                                                                                                                      MD5:15F12037D9859D059C3A557798163450
                                                                                                                                                                                                                                      SHA1:B3609A3D6832159913CC9B8FB128DF1383087B24
                                                                                                                                                                                                                                      SHA-256:E668AF8C73A38A66A1E8951D14EC24E7582FEE5254DD6C3DAE488A416D105D5F
                                                                                                                                                                                                                                      SHA-512:A976ECBE99AB8F29C8290F26DF5906326E820EB3F212928CD2B74783716BB6B7B6E75104140B2816408AF15A1DB30F4F5AB05133BAA2C2D3A6E48C6D915FA915
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Compilation Copyright (c) 1995-2019 by Wei Dai. All rights reserved...This copyright applies only to this software distribution package..as a compilation, and does not imply a copyright on any particular..file in the package.....All individual files in this compilation are placed in the public domain by..Wei Dai and other contributors.....I would like to thank the following authors for placing their works into..the public domain:....Joan Daemen - 3way.cpp..Leonard Janke - cast.cpp, seal.cpp..Steve Reid - cast.cpp..Phil Karn - des.cpp..Andrew M. Kuchling - md2.cpp, md4.cpp..Colin Plumb - md5.cpp..Seal Woods - rc6.cpp..Chris Morgan - rijndael.cpp..Paulo Baretto - rijndael.cpp, skipjack.cpp, square.cpp..Richard De Moliner - safer.cpp..Matthew Skala - twofish.cpp..Kevin Springle - camellia.cpp, shacal2.cpp, ttmac.cpp, whrlpool.cpp, ripemd.cpp..Ronny Van Keer - sha3.cpp..Aumasson, Neves, Wilcox-O'Hearn and Winnerlein - blake2.cpp, blake2b_simd.cpp, blake2s_simd.cpp..Aaram Yun - aria.cpp, a

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\Detours.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1122
                                                                                                                                                                                                                                      Entropy (8bit):5.127308255466628
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:QiDGVl+IrDJHcH0ynYgtoJq1hBE9wHbsUv4fOk4/+8/3oqaFN:TDa+I3J0lYEbBGwHbs5JK/3oDFN
                                                                                                                                                                                                                                      MD5:C26B34F5996C7ED7F7BCE6AAF6C8A98B
                                                                                                                                                                                                                                      SHA1:553E3A3EFEC9A07D9B08FCAADBCD88F2099AADA8
                                                                                                                                                                                                                                      SHA-256:F854AE8AABC0404652B48A2B3BF7F21EC174C69D73F5596934C20884EB0639EF
                                                                                                                                                                                                                                      SHA-512:E3C82BFE3BACB07E3A8327A01B2C9772E44BFA1A8012C0F0B363D6E3B2EE2371BC66F9C207611CD6F73D6F1FF1CEB9B2BF2C7D0864ADE256D41D533B598A804F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:# Copyright (c) Microsoft Corporation....All rights reserved.....# MIT License....Permission is hereby granted, free of charge, to any person obtaining a copy of..this software and associated documentation files (the "Software"), to deal in..the Software without restriction, including without limitation the rights to..use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies..of the Software, and to permit persons to whom the Software is furnished to do..so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all..copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED *AS IS*, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER..LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TO

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\EULA.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Non-ISO extended-ASCII text, with very long lines (2345), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):82443
                                                                                                                                                                                                                                      Entropy (8bit):4.721225358659806
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:eFTcZO7RtCH4GsEClVYB81osESnauexHLasodv6zxoLx:eFTk4Gs9YB8zESnaueh5oV6zk
                                                                                                                                                                                                                                      MD5:98ED747585FDAE910038499A32CAA6B1
                                                                                                                                                                                                                                      SHA1:5BFCC2D13E2E88A9E73C5146CF81655A80038B27
                                                                                                                                                                                                                                      SHA-256:F65A29AE37F5222F6EA8DED3DFEE6B2C9EF368C93665C7CBA8AB124940F4C7D7
                                                                                                                                                                                                                                      SHA-512:D5E54661E48DAEFB34E2731C8E331BACFE3B0B14B81108BBEBA8D353CC7E3F0DC46D6E5FF68BA3066234EB1FFC9BF0B45F02BA4EFB3E223C08771EE7A8915DFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Version 1.13 (Revised October 1, 2020)....END USER LICENSE AGREEMENT..Please read the terms and conditions of this End User License Agreement (.Agreement.) carefully before you use the Solution (as defined below). This is a legally binding contract. By assenting electronically, or installing the Solution or using the Solution, you accept all the terms and conditions of this Agreement on behalf of yourself and any entity or individual you represent or for whose Device you acquire the Solution (collectively .you.). If you do not agree with the terms and conditions of this Agreement, do not continue the installation process, do not use the Solution and delete or destroy all copies of the Solution in your possession or control...This Agreement relates to your use of certain software (.Software.), services or hardware and related firmware, including any Updates (each, a .Solution.) in connection with which you are accepting this Agreement, and any related Documentation. In this Agreement, .

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\GSL.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1177
                                                                                                                                                                                                                                      Entropy (8bit):5.0985548747672595
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:ODkugarjVJHoH0yE3gtwF7q1h69QH9sUv4pOk4/+wJ3oqmFZ:ODzRdJglQEZoQH9s5XyJ3otFZ
                                                                                                                                                                                                                                      MD5:598FD6266B820D382B6F1134F56351F2
                                                                                                                                                                                                                                      SHA1:91D5E0457D0B8A0B9C0A2F557E0E2DC4D7F3805F
                                                                                                                                                                                                                                      SHA-256:656E11EA18F7FB862F6625469B822583F3C08E986B3A24962D74737EBF6927E6
                                                                                                                                                                                                                                      SHA-512:A1DE7199FFC3ADF0A4679B47CE77CCDD6EBE7ECE123D286C58236A08B64C13C707E590FB5A12AD0A72E6A5907356F4D5754151EB7FB45A99D71CAA50912C16E5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2015 Microsoft Corporation. All rights reserved. .. ..This code is licensed under the MIT License (MIT). ....Permission is hereby granted, free of charge, to any person obtaining a copy ..of this software and associated documentation files (the "Software"), to deal ..in the Software without restriction, including without limitation the rights ..to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies ..of the Software, and to permit persons to whom the Software is furnished to do ..so, subject to the following conditions: ....The above copyright notice and this permission notice shall be included in all ..copies or substantial portions of the Software. ....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE ..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OT

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\ICU.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21439
                                                                                                                                                                                                                                      Entropy (8bit):5.1357753042685355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:5udKkjHrElobnqrEvJ+rsMb3rl0rsqrsVLpJVrsqrsLLpJuvQjNjbSrYmriVx090:5IKkjHwlo7qwQ/3r+tCpJVtIpJDkDM0u
                                                                                                                                                                                                                                      MD5:A2A0BAEA9713F129F7D433DCFC635167
                                                                                                                                                                                                                                      SHA1:349E31D4F425C71D5C63E2DCF4A19F5E0EDCB57B
                                                                                                                                                                                                                                      SHA-256:F155F8F66833BDC8E0479656256BFAC1D66A9EC9DF4AA56292308F522B4E3FA7
                                                                                                                                                                                                                                      SHA-512:87DD90B17AED6C5AACA53BAAA3D149C07028F730CA34681842AA9C855817413345AF27A0BD27DFC64677ED6D9B2E9013B585BDA06130315CBDCCF0A27103A809
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:COPYRIGHT AND PERMISSION NOTICE (ICU 58 and later)....Copyright . 1991-2020 Unicode, Inc. All rights reserved...Distributed under the Terms of Use in https://www.unicode.org/copyright.html.....Permission is hereby granted, free of charge, to any person obtaining..a copy of the Unicode data files and any associated documentation..(the "Data Files") or Unicode software and any associated documentation..(the "Software") to deal in the Data Files or Software..without restriction, including without limitation the rights to use,..copy, modify, merge, publish, distribute, and/or sell copies of..the Data Files or Software, and to permit persons to whom the Data Files..or Software are furnished to do so, provided that either..(a) this copyright and permission notice appear with all copies..of the Data Files or Software, or..(b) this copyright and permission notice appear in associated..Documentation.....THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF..ANY KIND, EXPRESS OR

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\JsonCpp.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2778
                                                                                                                                                                                                                                      Entropy (8bit):5.093429809315255
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:0NYgUd4UKwKPJTnlPiEX8QHvs6IEX3BjFt1:f2fPRsQHdBL1
                                                                                                                                                                                                                                      MD5:51D2728AC2976FDF6EEB3A02CD58982E
                                                                                                                                                                                                                                      SHA1:3D4AF58A6B52EE70064ABF68A2412AAC2CDDD42E
                                                                                                                                                                                                                                      SHA-256:C3AED6A54154090685DF3BBCD72E7A84943A4F3D5E5491BC6446A0B2D538C493
                                                                                                                                                                                                                                      SHA-512:734DAE65AFC8B551ECBF6665DD0A48DE8EFF2CB815A079A2BD7E37E19388253E39441A779403CB553D091449AE1EB858BA560726B86B2486220BC694F85CB6B3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:The JsonCpp library's source code, including accompanying documentation, ..tests and demonstration applications, are licensed under the following..conditions.......Baptiste Lepilleur and The JsonCpp Authors explicitly disclaim copyright in all ..jurisdictions which recognize such a disclaimer. In such jurisdictions, ..this software is released into the Public Domain.....In jurisdictions which do not recognize Public Domain property (e.g. Germany as of..2010), this software is Copyright (c) 2007-2010 by Baptiste Lepilleur and..The JsonCpp Authors, and is released under the terms of the MIT License (see below).....In jurisdictions which recognize Public Domain property, the user of this ..software may choose to accept it either as 1) Public Domain, 2) under the ..conditions of the MIT License (see below), or 3) under the terms of dual ..Public Domain/MIT License conditions described here, as they choose.....The MIT License is about as close to Public Domain as a license can get, and is..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\LUA.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1086
                                                                                                                                                                                                                                      Entropy (8bit):5.187094111501185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:1rDJHcH0ynYgtoJq1hBE9QHbsUv4fOk4/+8/3oqaFN:13J0lYEbBGQHbs5JK/3oDFN
                                                                                                                                                                                                                                      MD5:513EA4BCE55C427E58B1B6D40D087D24
                                                                                                                                                                                                                                      SHA1:D2F6CC5490D34DA9FD15E6EDEE4995D6EEB42892
                                                                                                                                                                                                                                      SHA-256:7732FA42EBC8652EE3300A086A068F6AA5008CFA0D14948B144E4B06C82EFDA7
                                                                                                                                                                                                                                      SHA-512:0C9F8D90F4CA229B5F175384D0CF348CDB8BCCC062BA5B2F97D5ABA0B9D823B0EBC2A0634041EC70E62715250A238B41B0C31CCD76AC24B8E864508D93251931
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright . 1994.2019 Lua.org, PUC-Rio.....Permission is hereby granted, free of charge, to any person obtaining a copy of..this software and associated documentation files (the "Software"), to deal in..the Software without restriction, including without limitation the rights to..use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies..of the Software, and to permit persons to whom the Software is furnished to do..so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all..copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER..LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,..OUT

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\LZMA.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):600
                                                                                                                                                                                                                                      Entropy (8bit):4.897043737762326
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:JEIZIzFOnlTICJF9sEJcm3IWbs1RMhaKfJixVBJmgGzWR:JpiFOL7yy3Iis1R1BvJm9WR
                                                                                                                                                                                                                                      MD5:D774C7A88D7B41D7C73490067B54E3A4
                                                                                                                                                                                                                                      SHA1:661206B3D45D9F6836915CB266F8536EF8ED39D9
                                                                                                                                                                                                                                      SHA-256:6182268F7C8C37FEF81E83F722D1AC9BD1EA4307F16005A6900BC1AA473828E0
                                                                                                                                                                                                                                      SHA-512:7F9BC6A96E2CD7A1B8522EDBCB72BE141A5136DDA654E0E8AB5CCF39A216B23478C64BB4FC68A71EE303237E6E9E063ADB84873BB786E235E9A039D914E7B762
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:LICENSE..-------....LZMA SDK is written and placed in the public domain by Igor Pavlov.....Some code in LZMA SDK is based on public domain code from another developers:.. 1) PPMd var.H (2001): Dmitry Shkarin.. 2) SHA-256: Wei Dai (Crypto++ library)....Anyone is free to copy, modify, publish, use, compile, sell, or distribute the ..original LZMA SDK code, either in source code form or as a compiled binary, for ..any purpose, commercial or non-commercial, and by any means.....LZMA SDK code is compatible with open source licenses, for example, you can ..include it to GNU GPL or GNU LGPL code...

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\OpenSSL.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10352
                                                                                                                                                                                                                                      Entropy (8bit):4.440603698068024
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qf9fG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhR:k1u9b01DY/rGBt+dc+acR
                                                                                                                                                                                                                                      MD5:97AA3AAFA51953D4AD591398B916595E
                                                                                                                                                                                                                                      SHA1:A849084B5239438F44C43B52576171F660576E2F
                                                                                                                                                                                                                                      SHA-256:ED72CE2B51EE58F117E5A021E2E04AF158857F40269FBC03491F0B2A99DBCC96
                                                                                                                                                                                                                                      SHA-512:0B54F6B692EE9C92E0A867361B1601459CF6BCBD653B902E1DAFACF3EC445AF11023E8A5F7485E4513D351EC662BA39DFD52A9E84858128E512E68ACE970C18B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.. Apache License.. Version 2.0, January 2004.. https://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.... 1. Definitions..... "License" shall mean the terms and conditions for use, reproduction,.. and distribution as defined by Sections 1 through 9 of this document..... "Licensor" shall mean the copyright owner or entity authorized by.. the copyright owner that is granting the License..... "Legal Entity" shall mean the union of the acting entity and all.. other entities that control, are controlled by, or are under common.. control with that entity. For the purposes of this definition,.. "control" means (i) the power, direct or indirect, to cause the.. direction or management of such entity, whether by contract or.. otherwise, or (ii) ownership of fifty percent (50%) or more of the.. outstanding shares, o

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\PCRE.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3550
                                                                                                                                                                                                                                      Entropy (8bit):5.184894121826678
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:7tmXu4cco6bZtv3Kfv3nOO/JXRJFNMH432smA32smEtP10VwH3/BpPCsHn:QXrcco6Ntifj/JXRJF2Y3V3yrwv7n
                                                                                                                                                                                                                                      MD5:347DFEF587108750FA72297199FCC986
                                                                                                                                                                                                                                      SHA1:0E34D7CD8AFEB7E3A17BB25F371262A1DDC564DF
                                                                                                                                                                                                                                      SHA-256:08BEBDA80B178F4B558FAED4E52930F66E855614E4DFAE15A436733B4712E041
                                                                                                                                                                                                                                      SHA-512:DEFA096320296C640A94A6ABEAD06698A7682BF522DC1F216BD6A3FB70519D789B83AC061A518672987F6CF2D5FE5F7E60D1F9DCCFEC5B74C9B387ED591339EA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:PCRE2 LICENCE..-------------....PCRE2 is a library of functions to support regular expressions whose syntax..and semantics are as close as possible to those of the Perl 5 language.....Releases 10.00 and above of PCRE2 are distributed under the terms of the "BSD"..licence, as specified below, with one exemption for certain binary..redistributions. The documentation for PCRE2, supplied in the "doc" directory,..is distributed under the same terms as the software itself. The data in the..testdata directory is not copyrighted and is in the public domain.....The basic library functions are written in C and are freestanding. Also..included in the distribution is a just-in-time compiler that can be used to..optimize pattern matching. This is an optional feature that can be omitted when..the library is built.......THE BASIC LIBRARY FUNCTIONS..---------------------------....Written by: Philip Hazel..Email local part: ph10..Email domain: cam.ac.uk....University of Cambridge Computing Se

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\Xerces.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2751
                                                                                                                                                                                                                                      Entropy (8bit):5.171482269491816
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:+OV/rYJ//rYJWrb/fstsua7+nP2lpL3Tx432sUWzsAp3m3EYz3tYT2l5X:rV/rYJ//rYJWXca7+OHjy35zsAp3w92w
                                                                                                                                                                                                                                      MD5:B2FEAA6A26C0149AF9C4FBE2D6B692B1
                                                                                                                                                                                                                                      SHA1:23DF548394B0B16E6D5C733B427307288E1B359B
                                                                                                                                                                                                                                      SHA-256:D7E3EAF9A5EC61DD5F4065D252A2B0130C0E300AC3AC9CB307469E2A86EBBCA7
                                                                                                                                                                                                                                      SHA-512:156E4CB2A1AE146CEE9CD25258B299FDFAB716866EABBAB3E01F23A0E063E4469537C0A1E497D36F829E710211FCA7DB58608AE6BCE87CACB75C66C8A57483B3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/*.. * The Apache Software License, Version 1.1.. *.. *.. * Copyright (c) 1999-2001 The Apache Software Foundation. All rights.. * reserved... *.. * Redistribution and use in source and binary forms, with or without.. * modification, are permitted provided that the following conditions.. * are met:.. *.. * 1. Redistributions of source code must retain the above copyright.. * notice, this list of conditions and the following disclaimer. .. *.. * 2. Redistributions in binary form must reproduce the above copyright.. * notice, this list of conditions and the following disclaimer in.. * the documentation and/or other materials provided with the.. * distribution... *.. * 3. The end-user documentation included with the redistribution,.. * if any, must include the following acknowledgment: .. * "This product includes software developed by the.. * Apache Software Foundation (http://www.apache.org/).".. * Alternately, this acknowledgment may appear in the softwa

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\brotli.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1103
                                                                                                                                                                                                                                      Entropy (8bit):5.17831518423703
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:gLgrrzJHkH0yw3gt3DQJq1hjQ9QHbsUv4fOk4q8/3oqaFz:EgrHJMlUE/jyQHbs5J8/3oDFz
                                                                                                                                                                                                                                      MD5:7DF5CD81700618EF9926FEB32290D2AF
                                                                                                                                                                                                                                      SHA1:4763BA7DFA7730D98B190DD8A4A2C6818D301FCB
                                                                                                                                                                                                                                      SHA-256:60AE0F13E76CC2EAAA108677EEFA4CE16B647F6BBE8CF0A1AC9429D82ECA7248
                                                                                                                                                                                                                                      SHA-512:92C0BBDC5155D6E218682840DDE38697327973B8F45E0C6D100705601449A6F1F8EBA74CEF8BCADF09EA945602B378BC64E81885F40965FA038D7974A71E5641
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.....Permission is hereby granted, free of charge, to any person obtaining a copy..of this software and associated documentation files (the "Software"), to deal..in the Software without restriction, including without limitation the rights..to use, copy, modify, merge, publish, distribute, sublicense, and/or sell..copies of the Software, and to permit persons to whom the Software is..furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in..all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER..LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, AR

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\bsdiff.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1349
                                                                                                                                                                                                                                      Entropy (8bit):5.214781999300611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:zIJlsAUni9obOVprYFTsJPprYFTsgY9iS432srEOkh4ROUT32s3yKtTfd13v0Txf:MfL0OVprYJ8prYJ2iS432sEo32s3LtJS
                                                                                                                                                                                                                                      MD5:A5F132CDEE178B77DCAC80346CC12B62
                                                                                                                                                                                                                                      SHA1:D44350C4D2332A9A30F154F896E88A3E89016825
                                                                                                                                                                                                                                      SHA-256:331B34C5D939627EB370FE4250BEAEC0D0FB5EDBF687B0C3631930385026CF7C
                                                                                                                                                                                                                                      SHA-512:D3E45FF903524667E40FD06870C957EFF349E44EEF22A2D9E9E01DB9FF806DCFB3082AD5BF974B864944A6C4B2D7D9910D67E440A5BDB50BE23600115537588F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview: Copyright 2003-2005 Colin Percival.. Copyright 2012-2018 Matthew Endsley.. Copyright 2018-2020 Emanuel Kom.nek.... Redistribution and use in source and binary forms, with or without.. modification, are permitted providing that the following conditions .. are met:.. 1. Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in the.. documentation and/or other materials provided with the distribution..... THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR.. IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.. WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.. ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY.. DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL.. DAMAGES (INCLUDING, BUT NOT LIMITED T

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\bzip2.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1936
                                                                                                                                                                                                                                      Entropy (8bit):5.230203854704142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:koO3qOV/rYJP6+HzumHPmic432sVosr32s3p/tP1OtwH6L:klnV/rYJiUumO03rr3zoKI
                                                                                                                                                                                                                                      MD5:9087D9182E280D5A124E844FCF52AF82
                                                                                                                                                                                                                                      SHA1:058D1D953744A7ACE99B86C97238A3083DDE120B
                                                                                                                                                                                                                                      SHA-256:5ECA2C8028DEE3A4728012BC60A763F69205325D0EB75B344CB7E10A788FAA96
                                                                                                                                                                                                                                      SHA-512:18758D28733AA9DB4257DB7A18176A8459265021F6CC60E48EE6BBCA422411D798BC597A683AFEFCE0045C2B025E65577F6ED085FA8C9ACB10B3E23464DA6DFB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..--------------------------------------------------------------------------....This program, "bzip2", the associated library "libbzip2", and all..documentation, are copyright (C) 1996-2019 Julian R Seward. All..rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions..are met:....1. Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer.....2. The origin of this software must not be misrepresented; you must .. not claim that you wrote the original software. If you use this .. software in a product, an acknowledgment in the product .. documentation would be appreciated but is not required.....3. Altered source versions must be plainly marked as such, and must.. not be misrepresented as being the original software.....4. The name of the author may not be used to endorse or promote .. products derived from t

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\c-ares.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):673
                                                                                                                                                                                                                                      Entropy (8bit):4.41061690497559
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:okOG62Rr3US4esl8sbUsgq6L49Ugmq6NM4obx9D1uqXR1qRfq7HFM2VPXI5YtJyz:RMgnbi67q6kdmq6ZodDjXHpV3yz
                                                                                                                                                                                                                                      MD5:128B02BA4177D31EF91600882BB0BABA
                                                                                                                                                                                                                                      SHA1:6B98F098FA3F1CAB58B9610B0AF9C9545D5010E2
                                                                                                                                                                                                                                      SHA-256:B87AC954A37F855F6F7199A3154E2E84623558DF980E8AFCCB94C5C93BD4CBA3
                                                                                                                                                                                                                                      SHA-512:77B2FB5862BD1D999CD9549319FFE492ED20AA63659003BFB48C2426242984F97B6666BA9AFBB0CB7D71A46F4F5F7E883E31C248F9B9EEC339E3D4D7FFA66A0C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright 1998 by the Massachusetts Institute of Technology... ..Permission to use, copy, modify, and distribute this software and its..documentation for any purpose and without fee is hereby granted, provided that..the above copyright notice appear in all copies and that both that copyright..notice and this permission notice appear in supporting documentation, and that..the name of M.I.T. not be used in advertising or publicity pertaining to..distribution of the software without specific, written prior permission...M.I.T. makes no representations about the suitability of this software for any..purpose. It is provided "as is" without express or implied warranty...

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\cURL.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1110
                                                                                                                                                                                                                                      Entropy (8bit):5.166860791847204
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:atK2lr8Cb7rmq6c9QHbsUv4fOk47OXdKo3txqyoTr9DLFiw:Z2lr5mteQHbs5JaOtb3txlCr93Fiw
                                                                                                                                                                                                                                      MD5:8915CDA79ECB12328CCB33113DC85ECC
                                                                                                                                                                                                                                      SHA1:127E0111A102FB3F6AF9AD82D0620F4C4AC2C164
                                                                                                                                                                                                                                      SHA-256:7C3794F6AA18B133DC86045D00F3D5894682084692A959CE521982EED4554F37
                                                                                                                                                                                                                                      SHA-512:30ACF8EB04E4063478C8CE0879C838DD9F9083EFB6E239393F4727CEA279A171AC4C597F3F1BF855210EED3091ACFB50D9D31851CF6A147774F3BF246D6F4D59
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:COPYRIGHT AND PERMISSION NOTICE....Copyright (c) 1996 - 2020, Daniel Stenberg, <daniel@haxx.se>, and many..contributors, see the THANKS file.....All rights reserved.....Permission to use, copy, modify, and distribute this software for any purpose..with or without fee is hereby granted, provided that the above copyright..notice and this permission notice appear in all copies.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN..NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,..DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR..OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE..OR OTHER DEALINGS IN THE SOFTWARE.....Except as contained in this notice, the name of a copyright holder shall not..be used in advertising or otherwise to promote th

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\cef.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1691
                                                                                                                                                                                                                                      Entropy (8bit):5.208095677978678
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:XwHciQuOrrYJyrYJubjChmPU943ZAw30EKmk3tmTHy:gHTurrYJyrYJubjChFq3L30hUTS
                                                                                                                                                                                                                                      MD5:4434D135A9D9631E1741CE7254375A0F
                                                                                                                                                                                                                                      SHA1:E2D2DD3FA7A0F0F7814118AF8C03094FC325D333
                                                                                                                                                                                                                                      SHA-256:2E69C36A7EAA4FA153426EAB635C607EA0356CBC7A68A70F42A49E8AB8EB8106
                                                                                                                                                                                                                                      SHA-512:9C59379E08895138E88B588F0EE3C4AB0938E8FD6906AB041484C6ED90DA38C7EF9DF7843002ABE5249B359DAC56C9C064F9119E58EEB1FD34BB2B7A35194450
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:// Copyright (c) 2008-2020 Marshall A. Greenblatt. Portions Copyright (c)..// 2006-2009 Google Inc. All rights reserved...//..// Redistribution and use in source and binary forms, with or without..// modification, are permitted provided that the following conditions are..// met:..//..// * Redistributions of source code must retain the above copyright..// notice, this list of conditions and the following disclaimer...// * Redistributions in binary form must reproduce the above..// copyright notice, this list of conditions and the following disclaimer..// in the documentation and/or other materials provided with the..// distribution...// * Neither the name of Google Inc. nor the name Chromium Embedded..// Framework nor the names of its contributors may be used to endorse..// or promote products derived from this software without specific prior..// written permission...//..// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..// "AS IS" AND ANY EXPRESS OR IMPLIE

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\dnscrypt-proxy.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1283
                                                                                                                                                                                                                                      Entropy (8bit):5.260449399642617
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:bOW+uAYBbfdfmq6o9ibcNc6vqPRmAXZF3e4Oeik3CPpzj5uBG0:5+ubBAtqibUtvqAApF3e4OeP6uo0
                                                                                                                                                                                                                                      MD5:7EEE1933E27BFD222F8ECD48D463C30B
                                                                                                                                                                                                                                      SHA1:506DD04AC3DB8729ABFFD4132294D017B8B1FBA6
                                                                                                                                                                                                                                      SHA-256:E9BFBF4CD2BB60EA2982DC50DEE92466A81A42DE9B40E65C4EE17298646C7BCE
                                                                                                                                                                                                                                      SHA-512:279D059DFA2C81C371000B865FE49389FA911BEBF4C4F7E83379598E3E109852B14A185F1BD970DC94AD53A804D7554A4547DBE7BD7902781DAA8DA1898F7885
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:dnscrypt-proxy is covered by the following license :..../*.. * Copyright (c) 2011-2012 Frank Denis <j at pureftpd dot org>.. *.. * Permission to use, copy, modify, and distribute this software for any.. * purpose with or without fee is hereby granted, provided that the above.. * copyright notice and this permission notice appear in all copies... *.. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.. * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.. * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.. * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.. * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.. * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.. * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE... */....====....This license applies to all parts of dnscrypt-proxy that are not externally..maintained libraries.....The externally mai

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\intel_asm.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Algol 68 source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1517
                                                                                                                                                                                                                                      Entropy (8bit):5.136931786038229
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:3VvUnzn+bOVhrYFTtu+JPhrYFTcZ2Xf3Bi69VoU432sZEOSPWWRO232s+yxtafyO:3VOVhrYJfhrYJ1foo+U432sAL32s+Et+
                                                                                                                                                                                                                                      MD5:4CDDB654FE704264C203B4D9C7C832C0
                                                                                                                                                                                                                                      SHA1:9D236E8F305B4BC8C486DE24549A706A3957C210
                                                                                                                                                                                                                                      SHA-256:634788199F33637E3CC36C61E5272F72CCBDAB87BE0C07EAAAF487C5F4F1CE82
                                                                                                                                                                                                                                      SHA-512:1933696744C8A95BC6C82EF0D19E99F1D4291F6E0AAF8570E45BD74065EC076EA9B3E4B030EBC8DF52903F4F98AEF6A9727D3370834EFB9187E4CE24AB9A0180
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2015, Intel Corporation ....All rights reserved. ....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are..met: ....* Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer. ....* Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in the.. documentation and/or other materials provided with the.. distribution. ....* Neither the name of the Intel Corporation nor the names of its.. contributors may be used to endorse or promote products derived from.. this software without specific prior written permission. ......THIS SOFTWARE IS PROVIDED BY INTEL CORPORATION ""AS IS"" AND ANY..EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE..IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR..PURPOSE ARE DISCLAIMED. IN

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\jansson.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1100
                                                                                                                                                                                                                                      Entropy (8bit):5.168516987759519
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:ybmrzJHkH0yw3gt3DQJq1hjQ9QHbsUv4fOk4/+8/3oqaFz:xHJMlUE/jyQHbs5JK/3oDFz
                                                                                                                                                                                                                                      MD5:928FFCBE179CA1FAA2D4A2747CCAB1B7
                                                                                                                                                                                                                                      SHA1:0978FA6A4BB455F6237ECA37956D179B7512FC1F
                                                                                                                                                                                                                                      SHA-256:C8D3B9240B998223DAF58EA16BF2856CAA5CDBCB75E93D4FD20C548033D885E2
                                                                                                                                                                                                                                      SHA-512:627AF0D12924E508694E977823FD6D705700EEC590E9EDD432605078B007143CEE5C70391143AE259CFF9287DB89FC3E613198C4C586236D71E2DE70CBC6D0CC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2009-2020 Petri Lehtinen <petri@digip.org>....Permission is hereby granted, free of charge, to any person obtaining a copy..of this software and associated documentation files (the "Software"), to deal..in the Software without restriction, including without limitation the rights..to use, copy, modify, merge, publish, distribute, sublicense, and/or sell..copies of the Software, and to permit persons to whom the Software is..furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in..all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER..LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISI

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\lexbor.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1086
                                                                                                                                                                                                                                      Entropy (8bit):5.187094111501185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:1rDJHcH0ynYgtoJq1hBE9QHbsUv4fOk4/+8/3oqaFN:13J0lYEbBGQHbs5JK/3oDFN
                                                                                                                                                                                                                                      MD5:513EA4BCE55C427E58B1B6D40D087D24
                                                                                                                                                                                                                                      SHA1:D2F6CC5490D34DA9FD15E6EDEE4995D6EEB42892
                                                                                                                                                                                                                                      SHA-256:7732FA42EBC8652EE3300A086A068F6AA5008CFA0D14948B144E4B06C82EFDA7
                                                                                                                                                                                                                                      SHA-512:0C9F8D90F4CA229B5F175384D0CF348CDB8BCCC062BA5B2F97D5ABA0B9D823B0EBC2A0634041EC70E62715250A238B41B0C31CCD76AC24B8E864508D93251931
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright . 1994.2019 Lua.org, PUC-Rio.....Permission is hereby granted, free of charge, to any person obtaining a copy of..this software and associated documentation files (the "Software"), to deal in..the Software without restriction, including without limitation the rights to..use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies..of the Software, and to permit persons to whom the Software is furnished to do..so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all..copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE..AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER..LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,..OUT

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\libPNG.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5479
                                                                                                                                                                                                                                      Entropy (8bit):4.847855772001339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Q9IzL5TPtwjzgkC3OOobgrRoy1mcy8dElpFoLMt6DQWJbz1HYK:GIzL5rOjzgH3OhUr7rMQMt6MWRR
                                                                                                                                                                                                                                      MD5:9C08C5872A3314661E37289D53A846E4
                                                                                                                                                                                                                                      SHA1:DDAD81444C937F22E749AB9518058682953B1CDB
                                                                                                                                                                                                                                      SHA-256:0AD3BFEE8BE10E5519949E7AF492E36BC349376B75FBEB412229A5967E3E9434
                                                                                                                                                                                                                                      SHA-512:DDA85F29349E7222A6487F91E42E798C6D93A091FB01ED08D7CAFF5B906A2732788FEA763D3E8FD10084361AF8531BA2059E2410E845390C937AFF659CD0FA36
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:COPYRIGHT NOTICE, DISCLAIMER, and LICENSE..=========================================....PNG Reference Library License version 2..---------------------------------------.... * Copyright (c) 1995-2019 The PNG Reference Library Authors... * Copyright (c) 2018-2019 Cosmin Truta... * Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson... * Copyright (c) 1996-1997 Andreas Dilger... * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.....The software is supplied "as is", without warranty of any kind,..express or implied, including, without limitation, the warranties..of merchantability, fitness for a particular purpose, title, and..non-infringement. In no event shall the Copyright owners, or..anyone distributing the software, be liable for any damages or..other liability, whether in contract, tort or otherwise, arising..from, out of, or in connection with the software, or the use or..other dealings in the software, even if advised of the possibility..of such damage.....Perm

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\libevent.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3378
                                                                                                                                                                                                                                      Entropy (8bit):5.342079876936178
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:k+/URV/rYJM/rYJYCSw3gOQigk3yCBlDprgif1TeK:GZrsUrsYCSw3g+gk3yChUW1Tp
                                                                                                                                                                                                                                      MD5:D6913685A013829414179D17903310AF
                                                                                                                                                                                                                                      SHA1:D665DF4878AE79173751D5A8A4346C1E2567F232
                                                                                                                                                                                                                                      SHA-256:8DD48E57572D33854A835BA6BB045D9A01321BAE43377934FC08CE642992206B
                                                                                                                                                                                                                                      SHA-512:228FA37C918F781F3151B7CEBFAA2575C70E515193ADCAE66A25C5DE0035199BA935E677C1DF1B2ACF6951B43AD4E253A5277CCD72AFF9BC60CF6F1BBF444EAA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Libevent is available for use under the following license, commonly known..as the 3-clause (or "modified") BSD license:....==============================..Copyright (c) 2000-2007 Niels Provos <provos@citi.umich.edu>..Copyright (c) 2007-2012 Niels Provos and Nick Mathewson....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions..are met:..1. Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright.. notice, this list of conditions and the following disclaimer in the.. documentation and/or other materials provided with the distribution...3. The name of the author may not be used to endorse or promote products.. derived from this software without specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR..IMPLIED WA

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\libsodium.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):841
                                                                                                                                                                                                                                      Entropy (8bit):5.078971696278001
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:CIoP+uAYBICfdfmq6o9ibcNc6vqPRmAXZF3el:CH+ubKCAtqibUtvqAApF3el
                                                                                                                                                                                                                                      MD5:DCD04D4748467021571F4A01F797DDAE
                                                                                                                                                                                                                                      SHA1:C59D498FA113B09406389F8828DDE6407F5A651D
                                                                                                                                                                                                                                      SHA-256:7B8C5DBC64E5CE65C94D31B5690A0E30FF83222BBBBB859DF2A56B9DFEF14326
                                                                                                                                                                                                                                      SHA-512:7AE6A19FDDA606F467C15E97BA08620838961BF64D9C5B6843CD877A23F0697BDE8874842B12E3C317E18B4F8609531BB05414D5ED4EC68337CE8E1C73AAE64E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/*.. * ISC License.. *.. * Copyright (c) 2013-2016.. * Frank Denis <j at pureftpd dot org>.. *.. * Permission to use, copy, modify, and/or distribute this software for any.. * purpose with or without fee is hereby granted, provided that the above.. * copyright notice and this permission notice appear in all copies... *.. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.. * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.. * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.. * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.. * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.. * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.. * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE... */..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\lzfse.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1539
                                                                                                                                                                                                                                      Entropy (8bit):5.159830532727548
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:NRL3UnemvooObOAFT7JiFTzwQorBTPS9p432s4OkpKWZ32si/yxtTR10TnDZloy:vqIOAJoJzqPgp432sUH32sQEt910Poy
                                                                                                                                                                                                                                      MD5:FE680362852389FE7A16C47AAE27BC92
                                                                                                                                                                                                                                      SHA1:377EA1B96CABE859AF78BB561CA4171544AB0152
                                                                                                                                                                                                                                      SHA-256:E89251CDAAF385D93F74B819412217E47A7A06CD65115A1F87EEDDA0DFFB2947
                                                                                                                                                                                                                                      SHA-512:8BB0E1AE7FC66E12581B43C0823E82011EC88D714EB244A840A46272D9C04163893217B6AE6C42D07EF72C88EA154950282EF09F0AEF2DD44A3E42DE709135EF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2015-2016, Apple Inc. All rights reserved.....Redistribution and use in source and binary forms, with or without modification,..are permitted provided that the following conditions are met: ....1. Redistributions of source code must retain the above copyright notice,.. this list of conditions and the following disclaimer.....2. Redistributions in binary form must reproduce the above copyright notice,.. this list of conditions and the following disclaimer in the documentation.. and/or other materials provided with the distribution.....3. Neither the name of the copyright holder(s) nor the names of any contributors.. may be used to endorse or promote products derived from this software without.. specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY..EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES..OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\mbedTLS.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11558
                                                                                                                                                                                                                                      Entropy (8bit):4.476140734205082
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ff9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:9Ou9b01DY/rGBt+dc+aclkT8SH+
                                                                                                                                                                                                                                      MD5:D229DA563DA18FE5D58CD95A6467D584
                                                                                                                                                                                                                                      SHA1:B314C7EBB7D599944981908B7F3ED33A30E78F3A
                                                                                                                                                                                                                                      SHA-256:1EB85FC97224598DAD1852B5D6483BBCF0AA8608790DCC657A5A2A761AE9C8C6
                                                                                                                                                                                                                                      SHA-512:E2F81CB44129E1BC58941E7B3DB1FFBA40357889BACE4FD65FD254D0BE1BB757625BDF36BF46D555EB3CA4B130DCD1C05225CAEC28D8472DCCF52A63DBD6E185
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview: Apache License.. Version 2.0, January 2004.. http://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.... 1. Definitions..... "License" shall mean the terms and conditions for use, reproduction,.. and distribution as defined by Sections 1 through 9 of this document..... "Licensor" shall mean the copyright owner or entity authorized by.. the copyright owner that is granting the License..... "Legal Entity" shall mean the union of the acting entity and all.. other entities that control, are controlled by, or are under common.. control with that entity. For the purposes of this definition,.. "control" means (i) the power, direct or indirect, to cause the.. direction or management of such entity, whether by contract or.. otherwise, or (ii) ownership of fifty percent (50%) or more of the.. outstanding shares, or (

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\mhook.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11560
                                                                                                                                                                                                                                      Entropy (8bit):4.476377058372447
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:kOu9b01DY/rGBt+dc+aclkT8SH+
                                                                                                                                                                                                                                      MD5:D273D63619C9AEAF15CDAF76422C4F87
                                                                                                                                                                                                                                      SHA1:47B573E3824CD5E02A1A3AE99E2735B49E0256E4
                                                                                                                                                                                                                                      SHA-256:3DDF9BE5C28FE27DAD143A5DC76EEA25222AD1DD68934A047064E56ED2FA40C5
                                                                                                                                                                                                                                      SHA-512:4CC5A12BFE984C0A50BF7943E2D70A948D520EF423677C77629707AACE3A95AA378D205DE929105D644680679E70EF2449479B360AD44896B75BAFED66613272
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.. Apache License.. Version 2.0, January 2004.. http://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.... 1. Definitions..... "License" shall mean the terms and conditions for use, reproduction,.. and distribution as defined by Sections 1 through 9 of this document..... "Licensor" shall mean the copyright owner or entity authorized by.. the copyright owner that is granting the License..... "Legal Entity" shall mean the union of the acting entity and all.. other entities that control, are controlled by, or are under common.. control with that entity. For the purposes of this definition,.. "control" means (i) the power, direct or indirect, to cause the.. direction or management of such entity, whether by contract or.. otherwise, or (ii) ownership of fifty percent (50%) or more of the.. outstanding shares, or

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\nanopb.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):918
                                                                                                                                                                                                                                      Entropy (8bit):4.4686465575903975
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:fMZlSWsTby3FOxpV7FP96yPXAbUEDEG92iQYWA3FnFiNehGTBMlx/OIUsMCh82lO:Zby3oHvYxAUdQvdaGGasHO
                                                                                                                                                                                                                                      MD5:C58EFEA00B9A80527A4EB1EDF3B48D42
                                                                                                                                                                                                                                      SHA1:7A9460DEF676DEC00AFFDA16ABA1E93F0FB26F74
                                                                                                                                                                                                                                      SHA-256:A9C42B959825BCE9B7C72A7B0797A41580CB21F407B73E08168FB1ED1DB438C4
                                                                                                                                                                                                                                      SHA-512:6CBCC440792E05C8B73755ACB329E2961A1991B730FC468D7483B1C005BDC664271237DE634C3A1969967F8FEEA03B36EE8D2DD58E94DC61F553C4D728FF9D2E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2011 Petteri Aimonen <jpa at nanopb.mail.kapsi.fi>....This software is provided 'as-is', without any express or ..implied warranty. In no event will the authors be held liable ..for any damages arising from the use of this software.....Permission is granted to anyone to use this software for any ..purpose, including commercial applications, and to alter it and ..redistribute it freely, subject to the following restrictions:....1. The origin of this software must not be misrepresented; you .. must not claim that you wrote the original software. If you use .. this software in a product, an acknowledgment in the product .. documentation would be appreciated but is not required.....2. Altered source versions must be plainly marked as such, and .. must not be misrepresented as being the original software.....3. This notice may not be removed or altered from any source .. distribution...

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\nghttp2.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1181
                                                                                                                                                                                                                                      Entropy (8bit):5.222493399843199
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:9zkIrNJHYHPyPP3j6Jq1k9QHvsUrt8Ok4S+dmo3rqwFG:9lhJw6PvjR8QHvs6IE33rxFG
                                                                                                                                                                                                                                      MD5:AE3F3D4FD356269CB456DF973156650F
                                                                                                                                                                                                                                      SHA1:4F58EC889575F422DFE25FE14F22EEB5D009A4C9
                                                                                                                                                                                                                                      SHA-256:D0A9C5D1E40D1179F0669BD93E079A518B3067FAD240410804170F05D1BA04B6
                                                                                                                                                                                                                                      SHA-512:AC1C0E7D7020F7AE091BB53E4B5D1AFA8E9A669BBED4F7A418B8CB9975EACE1C8C6EAA840F1248EA4F607F87BA8765D61EA0F05FC0E586EE21275633C8F1C3C8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..The MIT License....Copyright (c) 2012, 2014, 2015, 2016 Tatsuhiro Tsujikawa..Copyright (c) 2012, 2014, 2015, 2016 nghttp2 contributors....Permission is hereby granted, free of charge, to any person obtaining..a copy of this software and associated documentation files (the.."Software"), to deal in the Software without restriction, including..without limitation the rights to use, copy, modify, merge, publish,..distribute, sublicense, and/or sell copies of the Software, and to..permit persons to whom the Software is furnished to do so, subject to..the following conditions:....The above copyright notice and this permission notice shall be..included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE..LIABLE FOR ANY CLAIM, DAMAG

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\protobuf.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1764
                                                                                                                                                                                                                                      Entropy (8bit):5.1400808744788815
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qO3rYJUrYJk1C4wD7439x3wEWmJC3t2zTHcLkC:n3rYJUrYJk1CnM3b3wQigzTot
                                                                                                                                                                                                                                      MD5:CE79A5E699943B3A132C0DEBA1777AC6
                                                                                                                                                                                                                                      SHA1:57919D5BF210193D05BA496A870832582F475559
                                                                                                                                                                                                                                      SHA-256:F4DF8B2457697851385D9EBB93267832C1DFA24E0E61881952F6B0C452663DC9
                                                                                                                                                                                                                                      SHA-512:82CDA6F61E3DFF94228D3EEFE4E1F65DC483ACA9C8597E482C1D6584D2F70AB7327AF6461080447649DC4986B9932025DBCAE5C078A2DBCCA82C3A985D118F4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright 2008 Google Inc. All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are..met:.... * Redistributions of source code must retain the above copyright..notice, this list of conditions and the following disclaimer... * Redistributions in binary form must reproduce the above..copyright notice, this list of conditions and the following disclaimer..in the documentation and/or other materials provided with the..distribution... * Neither the name of Google Inc. nor the names of its..contributors may be used to endorse or promote products derived from..this software without specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.."AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR..A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL TH

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\pugixml.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2142
                                                                                                                                                                                                                                      Entropy (8bit):5.227364363048355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3wzPQupRigg/HuMugHPJTnlP92Ew8QHvs2IExOojvM:APeTP9V3QHSoo
                                                                                                                                                                                                                                      MD5:AE1FCFD0AA84B946BB9FC04BA39DAFCF
                                                                                                                                                                                                                                      SHA1:E1391AB3BCDBDD0FB6E9169FFA1D72C1650F839E
                                                                                                                                                                                                                                      SHA-256:E9C108AFA89F5F9EF50484BB1C64A8D07D0C0BFCE171DF01840702CEEAEC1E34
                                                                                                                                                                                                                                      SHA-512:BB9635487DEF64130A10EC3CD4106E5018CE17D9B979124D9F6674AB1FC7FA549C32C0602AEAD88CFA78F6900ADA5A1776995FE4B864B466D6DFBF1CB53D942E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:pugixml 1.10 - an XML processing library....Copyright (C) 2006-2019, by Arseny Kapoulkine (arseny.kapoulkine@gmail.com)..Report bugs and download new versions at https://pugixml.org/....This is the distribution of pugixml, which is a C++ XML processing library,..which consists of a DOM-like interface with rich traversal/modification..capabilities, an extremely fast XML parser which constructs the DOM tree from..an XML file/buffer, and an XPath 1.0 implementation for complex data-driven..tree queries. Full Unicode support is also available, with Unicode interface..variants and conversions between different Unicode encodings (which happen..automatically during parsing/saving).....The distribution contains the following folders:.....docs/ - documentation....docs/samples - pugixml usage examples....docs/quickstart.html - quick start guide....docs/manual.html - complete manual.....scripts/ - project files for IDE/build systems.....src/ - header and source files.....readme.txt - this file...

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\rapidjson.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (739), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5044
                                                                                                                                                                                                                                      Entropy (8bit):5.161532014342918
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:wt8WCogOrYJnrYJzph/3f3z9IT32YdPs0QHnoqPsvQHnoJ:wuogOrsnrsFh/3f3BKPQHnYQHnS
                                                                                                                                                                                                                                      MD5:CFF54E417A17B4B77465198254970CD2
                                                                                                                                                                                                                                      SHA1:A2922AC9CAF1914313D4117DD30F4F1DE71C5E14
                                                                                                                                                                                                                                      SHA-256:60AB263D1868282CB8262199EDF648C21E45B729A78C6768BC9C27214A673DA0
                                                                                                                                                                                                                                      SHA-512:A8CBF26C8BABCF722623A709D5810BAFF798448A969000C36BFB7570D6AD388220066973783D7E162C1968FC42D0418A1C7AE15F51EEA2EF2A2E843FDD9CDDFB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Tencent is pleased to support the open source community by making RapidJSON available. .. ..Copyright (C) 2015 THL A29 Limited, a Tencent company, and Milo Yip. All rights reserved.....If you have downloaded a copy of the RapidJSON binary from Tencent, please note that the RapidJSON binary is licensed under the MIT License...If you have downloaded a copy of the RapidJSON source code from Tencent, please note that RapidJSON source code is licensed under the MIT License, except for the third-party components listed below which are subject to different license terms. Your integration of RapidJSON into your own projects may require compliance with the MIT License, as well as the other licenses applicable to the third-party components included within RapidJSON...A copy of the MIT License is included in this file.....Other dependencies and licenses:....Open Source Software Licensed Under the BSD License:..--------------------------------------------------------------------....The msinttype

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\sqlite.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1531
                                                                                                                                                                                                                                      Entropy (8bit):4.4419575401333775
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:13QpHr1jvO2UPPLUolMKrIeCENv/MAXSpexdDWNQtX1eUOfmCo/pm:13MLUgcr/tUAGodDWN2wPo/pm
                                                                                                                                                                                                                                      MD5:BDC36270610932FF0C405F7DBEC4F1AA
                                                                                                                                                                                                                                      SHA1:36EF609B122CCDE100FA096A4703F3433AF6E2D1
                                                                                                                                                                                                                                      SHA-256:8C109E1D8394FD4557D916D75EF61FB406319106CBEAB77736D7C666BEFD1AB6
                                                                                                                                                                                                                                      SHA-512:83F1346CBC0D4E49B0E4CC338FA12813661EAFB00ACBA39D350E28C54C86D6D19317545DDDAE562763E6794E5268731CF4D1D8F24DB42A0CF8D9AB9165970BEB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:SQLite Is Public Domain....All of the code and documentation in SQLite has been dedicated to the public..domain by the authors. All code authors, and representatives of the companies..they work for, have signed affidavits dedicating their contributions to the..public domain and originals of those signed affidavits are stored in a firesafe..at the main offices of Hwaci. Anyone is free to copy, modify, publish, use,..compile, sell, or distribute the original SQLite code, either in source code..form or as a compiled binary, for any purpose, commercial or non-commercial,..and by any means.....The previous paragraph applies to the deliverable code and documentation in..SQLite - those parts of the SQLite library that you actually bundle and ship..with a larger application. Some scripts used as part of the build process (for..example the "configure" scripts generated by autoconf) might fall under other..open-source licenses. Nothing from these build scripts ever reaches the final..deliverable

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\unrar.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2018
                                                                                                                                                                                                                                      Entropy (8bit):4.650059556899331
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:f/bAgaA8eXpb02xgCgFTF2XBtzK818fSmS0zDENYXjwUAXoExeaAFdxrJLXXvPhK:fcghvgJORNw40qUA4U0hkqC/
                                                                                                                                                                                                                                      MD5:7CF65040F98BAF1BA15F488D76F31E6A
                                                                                                                                                                                                                                      SHA1:C9E9E12D8D124BDC38B63A1C832BF36890DDF046
                                                                                                                                                                                                                                      SHA-256:64578D53633622B31D19024184265F01D045B637DA98FBD15CA81E39ACFBA63F
                                                                                                                                                                                                                                      SHA-512:4FFB42AD75204DA6A288AA2D748754EAB2A94386C33C9981AB1EDB6F848E02FBE4590BAAFD81F5349A4C09BB913AEDD7F57D49C43D96B8AD6E63C0E44D0A8CA1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview: ****** ***** ****** UnRAR - free utility for RAR archives.. ** ** ** ** ** ** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. ****** ******* ****** License for use and distribution of.. ** ** ** ** ** ** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. ** ** ** ** ** ** FREE portable version.. ~~~~~~~~~~~~~~~~~~~~~.... The source code of UnRAR utility is freeware. This means:.... 1. All copyrights to RAR and the utility UnRAR are exclusively.. owned by the author - Alexander Roshal..... 2. UnRAR source code may be used in any software to handle.. RAR archives without limitations free of charge, but cannot be.. used to develop RAR (WinRAR) compatible archiver and to.. re-create RAR compression algorithm, which is proprietary... Distribution of modified UnRAR source code in separate form.. or as a part of other software is permitted, provided that.. full text of this paragraph, sta

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\vxWidgets.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2466
                                                                                                                                                                                                                                      Entropy (8bit):4.867091674937462
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qzuljEek9y8HE7gJRg4D8yGQp5mTWWSewav3HfK/vy:WuljEbrjg4DN9p5myhY3Hi3y
                                                                                                                                                                                                                                      MD5:7C3860FFBB2E3DF660F4762E02A28A4E
                                                                                                                                                                                                                                      SHA1:9A689135294896040420EAD4E5A05038D0CE8CBC
                                                                                                                                                                                                                                      SHA-256:803B8B5AA4151030221B3C3F71A645DA6241938421E49901444A79E5CCA75FA8
                                                                                                                                                                                                                                      SHA-512:393E4077221420B1A1D73CB1D89AD264B65E36DDE03271959699260E8305FF8715AB1A7535C356F2BF961F316CCB1EF1FF6E13DA1708E7B53A9B6E12AD7066D0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview: wxWindows Library Licence, Version 3.1.. ======================================....Copyright (c) 1998-2005 Julian Smart, Robert Roebling et al....Everyone is permitted to copy and distribute verbatim copies..of this licence document, but changing it is not allowed..... WXWINDOWS LIBRARY LICENCE.. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION....This library is free software; you can redistribute it and/or modify it..under the terms of the GNU Library General Public Licence as published by..the Free Software Foundation; either version 2 of the Licence, or (at your..option) any later version.....This library is distributed in the hope that it will be useful, but WITHOUT..ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or..FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public..Licence for more details.....You should have received a copy of the GNU Library General Public Licence..along wit

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\xmlParser.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2070
                                                                                                                                                                                                                                      Entropy (8bit):5.039420272178635
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:31D0frKHMHbJpOVRrYJERrYJgqgvePjkm432sWWz32s3E8z3tIHXa:31D0KQ18VRrYJERrYJev+G37z3zpK3a
                                                                                                                                                                                                                                      MD5:A3E6629906286395714E96DC4AC8EDF4
                                                                                                                                                                                                                                      SHA1:E1FAF4917A367E29BE497AFC8CA14BB7B4493EFE
                                                                                                                                                                                                                                      SHA-256:BDD96967D9B60683A91E086651EC03EED0D4BA142B37993111A0B1A608F8A05D
                                                                                                                                                                                                                                      SHA-512:C9BE16142C2D45B9E81B2E33840B58837EABF94B3659CBCE65E18D1501AC85CFA35FA087A467CBD55D633F1DFE370E61ABEDA2ED1E6DB4E8B65826B7C41A4CCB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/**.. ****************************************************************************.. * <P> XML.c - implementation file for basic XML parser written in ANSI C++.. * for portability. It works by using recursion and a node tree for breaking.. * down the elements of an XML document. </P>.. *.. * @version V2.23.. * @author Frank Vanden Berghen.. *.. * BSD license:.. * Copyright (c) 2002, Frank Vanden Berghen.. * All rights reserved... * Redistribution and use in source and binary forms, with or without.. * modification, are permitted provided that the following conditions are met:.. *.. * * Redistributions of source code must retain the above copyright.. * notice, this list of conditions and the following disclaimer... * * Redistributions in binary form must reproduce the above copyright.. * notice, this list of conditions and the following disclaimer in the.. * documentation and/or other materials provided with the distribution... * * Neither the nam

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\xxHash.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2276
                                                                                                                                                                                                                                      Entropy (8bit):5.2877240270854875
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:adHmZ6MOOrfJwrfJzkB432sVoR32s3EiP3tQHbH+yCpXNygHKzZ:anVOrfJwrfJzku3S3zVSiyCpXT6Z
                                                                                                                                                                                                                                      MD5:06CDEE91812DDFAF4CF3916F7A5309C4
                                                                                                                                                                                                                                      SHA1:00397115D379F863279D13E823D33ED9C8B51BE4
                                                                                                                                                                                                                                      SHA-256:7A9555C822ED30FCBF6832004EDAC893BA10BBCDB8E12D9A3662DDF1B52BD6E7
                                                                                                                                                                                                                                      SHA-512:CF22A889618B15FD40DD82809C2C8F5003FD40236798D8738FD3C56CF0F27B52E4157F834E5339BF12388DEDB96EAB1DC3E9D01968E1A4AA155E60CEA9C96694
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:xxHash Library..Copyright (c) 2012-2020 Yann Collet..All rights reserved.....BSD 2-Clause License (https://www.opensource.org/licenses/bsd-license.php)....Redistribution and use in source and binary forms, with or without modification,..are permitted provided that the following conditions are met:....* Redistributions of source code must retain the above copyright notice, this.. list of conditions and the following disclaimer.....* Redistributions in binary form must reproduce the above copyright notice, this.. list of conditions and the following disclaimer in the documentation and/or.. other materials provided with the distribution.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND..ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED..WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE..DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR..ANY DIRECT, INDIRECT, INCIDENTAL, SPE

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\yara.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1519
                                                                                                                                                                                                                                      Entropy (8bit):5.187635019028982
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:U3UnemvobbOOrPFTVJyFTzc6pGBTPC9B432sVvEOkDs89ROg32s3yxiTftr8A3t/:SOOrPJ2JzHiPQB432sVoR32s3EiP3tQS
                                                                                                                                                                                                                                      MD5:4BF27A810F9A1F9E7C76B029B3B457CC
                                                                                                                                                                                                                                      SHA1:8EDFF1174E110DE6AEC218A8D9AC56DBEA27A1E9
                                                                                                                                                                                                                                      SHA-256:1E5A5EAE04B378D12F93A3ACF56DFDCAC7005BDD67FE22D71C855F4E994E9928
                                                                                                                                                                                                                                      SHA-512:D818FE6F1905F46445FDBED9EA63751441FDD69651AC532AAE946181FC28DA8D2AAC98146FB507D3DF9720B24DCD2F05A20735F32E113503253FD85DEFA2870E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (c) 2007-2016. The YARA Authors. All Rights Reserved.....Redistribution and use in source and binary forms, with or without modification,..are permitted provided that the following conditions are met:....1. Redistributions of source code must retain the above copyright notice, this..list of conditions and the following disclaimer.....2. Redistributions in binary form must reproduce the above copyright notice,..this list of conditions and the following disclaimer in the documentation and/or..other materials provided with the distribution.....3. Neither the name of the copyright holder nor the names of its contributors..may be used to endorse or promote products derived from this software without..specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND..ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED..WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE..DISCLAIMED. IN

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\Licenses\zlib.txt.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):982
                                                                                                                                                                                                                                      Entropy (8bit):4.552277493291723
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Ngx475SWsEZ9iWfTKh7FP96yPX0bUEDEGUAH2iQYkFMVFnFRp5GHZBMeTx/OEMxr:GxkMosv8xAbAHdQN2Tp5GHvdDSY8PJh
                                                                                                                                                                                                                                      MD5:8041053262BC492837749777C930A791
                                                                                                                                                                                                                                      SHA1:E8CBE20136C6D1627D40932DC4398D2053BE5228
                                                                                                                                                                                                                                      SHA-256:D988D5362EA432D8C8AD9F05AF876BA9409EB1EBAD8C34B899FC9CC8C7EA5311
                                                                                                                                                                                                                                      SHA-512:0F321A821B1AB36A5E60A5D5E94DC26564A2CB03347B54279B5530F7B50AB3105D537637F338553DFC4EF800D28BE103AB0CA50F77DA3B4627FB6D7C558BD3EA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:Copyright (C) 1995-2016 Jean-loup Gailly and Mark Adler....This software is provided 'as-is', without any express or implied..warranty. In no event will the authors be held liable for any damages..arising from the use of this software.....Permission is granted to anyone to use this software for any purpose,..including commercial applications, and to alter it and redistribute it..freely, subject to the following restrictions:....1. The origin of this software must not be misrepresented; you must not.. claim that you wrote the original software. If you use this software.. in a product, an acknowledgment in the product documentation would be.. appreciated but is not required...2. Altered source versions must be plainly marked as such, and must not be.. misrepresented as being the original software...3. This notice may not be removed or altered from any source distribution.....Jean-loup Gailly Mark Adler..jloup@gzip.org madler@alumni.caltech.edu..

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4017592
                                                                                                                                                                                                                                      Entropy (8bit):6.474143036226857
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:HMLFHKlde28WUmD+0wVw3isXMBk0GSKMI/QA7mqxrokt9lvi3nzOgJ84v5+btc75:emDkBkX9o087
                                                                                                                                                                                                                                      MD5:158CE7134066352FCD48545BAB2D6A87
                                                                                                                                                                                                                                      SHA1:6F2C02D5AAC10AC97DD0DB7257B503D698F846DE
                                                                                                                                                                                                                                      SHA-256:23F94ACB7F8808CD229EA875D82DB5C559A74851FB83E756E14E61AF72D21ADA
                                                                                                                                                                                                                                      SHA-512:23C403660565D8718C8310E4A4434A4A7DB96499CBDF76E1B2402393FD724BEA47D82049BD1FD9B9D27785854542BE78EE9D9492F291FD0803F9D313DB292D05
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$..........4I..gI..gI..g...f...g.$gM..g..f[..g..f9..g..fC..g...fF..g...fi..gI..gE..g@.JgK..g...fH..g...fM..g...fH..g...f^..gI..g...g]..f[..g]..fH..g].&gH..gI.NgK..g]..fH..gRichI..g........PE..d...;.$e.........."....$.*&....................@..............................=......P=...`..........................................#4......$4.......=. .....;.X...H$=.p)....=..\..............................(...`...@............@&..............................text....(&......*&................. ..`.rdata.......@&.......&.............@..@.data....X...P4......84.............@....pdata..X.....;.......;.............@..@_RDATA..\....p=.......<.............@..@.rsrc... .....=.......<.............@..@.reloc...\....=..^....<.............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswPEAntivirus.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10856384
                                                                                                                                                                                                                                      Entropy (8bit):6.478730129709163
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:Tt/4+wgQTQ4YW5xuxOG9eyIfJ3q2LTBTtBkLRloOoH:TtBIFF5AxOG9ey+J3qVa7H
                                                                                                                                                                                                                                      MD5:D194FB1EC36F1A2D3D73074E3818C3D4
                                                                                                                                                                                                                                      SHA1:4711140FF84712120A1D1D676A88E9B068998E3D
                                                                                                                                                                                                                                      SHA-256:A26BC8A3A7CE022CAFB6500B68BCEA5F21BD154ECD921AADD21DA0DC020398CB
                                                                                                                                                                                                                                      SHA-512:311F77DA8A63B363483A26D8DC32FCC10AF17D415A5B98E410451853D2D1098E167CAA391EE41ED1B78D8A9F31657B62DACAB2391941C5CF2082CE68CD1E9CAA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$..........6...e...e...e..ce..e#..d...e^..e...e^..d..e^..d...e^..d..e`..d..e8..d...e)..d...e^..d..e...d..e)..d...e)..d...e...d..e...d...e...d...e)..d..e...e..e...d..e...d...e...e...e..ge...e...d...eRich...e................PE..d.....$e.........."....$.\j...;......ZN........@.........................................`.................................................\................@...X..H~..x)......x....0|......................1|.(.....o.@............pj..O..h........................text....Zj......\j................. ..`.rdata..<u"..pj..v"..`j.............@..@.data....H.......,.................@....pdata...X...@...Z..................@..@.didat..H............\..............@....rsrc................`..............@..@.reloc..x............f..............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswPEBrowser.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3405240
                                                                                                                                                                                                                                      Entropy (8bit):6.470793573109207
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:G361CRrmB0vORXuPEoU0HFRgJ84vHvDmZyTcCaJMh6/NE:pBzXuJHl
                                                                                                                                                                                                                                      MD5:3E2386D116230EEC4E3B50C770E9F31F
                                                                                                                                                                                                                                      SHA1:C41AF5A359E8C2056535FBC74B2A589336D1C8F8
                                                                                                                                                                                                                                      SHA-256:52DDB9085F129DDF9BA68B0CE54ADC48ED26ACE046E7E2E8D0AFA1A84AB92DB5
                                                                                                                                                                                                                                      SHA-512:45ACE8BB390D231B400BBABF8C42E347617D306B40F475405D399F04CCEFCEC4EE30C9EB72E343E58B387AE0C8697E893B2609735C5E7EDD42E808E8EC32F41E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......>.Drz.*!z.*!z.*!...!y.*!... p.*!..) ~.*!..+ r.*!../ I.*!..) x.*!... x.*!s.!n.*!,.+ ~.*!n.+ x.*!../ {.*!z.*!|.*!,./ .*!... {.*!..+ m.*!z.+!..*!n.# ..*!n.* {.*!n..!{.*!z..!x.*!n.( {.*!Richz.*!........PE..d.....$e.........."....$.....J................@.............................04.....X.4...`.........................................p.).....X.).......2...... 1.H...H.3.p)....3..j..(.$.......................$.(....|!.@................"....).`....................text............................... ..`.rdata..@...........................@..@.data....s....*..D....*.............@....pdata..H.... 1.......0.............@..@.didat..X.....2......n2.............@....rsrc.........2......r2.............@..@.reloc...j....3..l...`3.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswPECommander.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3192760
                                                                                                                                                                                                                                      Entropy (8bit):6.472872966079275
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:5CAvQEjGFFU2AW5cgnWx0oB4D8thFuA+07yTcN0ESme1BU:Tx2cWdoBIU
                                                                                                                                                                                                                                      MD5:9E35E7DA080B13984FA95EB1023BF608
                                                                                                                                                                                                                                      SHA1:A8C7B6D1D4F4C969205AA999CF4194995676EBB7
                                                                                                                                                                                                                                      SHA-256:D32E8E5997F494DB4EC2247B6FCE7AE9F02A6D46AA6C8DD3D61E3854FC11A605
                                                                                                                                                                                                                                      SHA-512:975E14AEE60E151DBA57BE83D34AB132D5B0487ED305D3499A2CA76DEEC44A58F5C3C0AB03C48623C029538ACA1F1DCA66529174FC68A37486FDEF70F28426FE
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........=..\.\.\.."...\..".\..".\..".\..".\.q..\.q..\..).\.#.\.$p..\.`).\.\.\..).\.`).\.q..\.\.[.#.B\.#.\.#...\.\t..\.#.\.Rich.\.........................PE..d...".$e.........."....$.....6.................@..............................1.....SF1...`..........................................>&......>&......p/.........T_..H.0.p)....0..h..Hn!......................o!.(.......@...............H0...9&.@....................text............................... ..`.rdata..............................@..@.data....v....'..F...b'.............@....pdata..T_.......`....-.............@..@.didat.......`/......./.............@....rsrc........p/......./.............@..@.reloc...h....0..j...$0.............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswPEShell.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3363256
                                                                                                                                                                                                                                      Entropy (8bit):6.587306692815455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:jCXdTQ0oQz8e3KjnHgsCIHC47gJ84v5J+BTcNy0dS+sTua4XJIV4LJIV49GXF:SXmeITHvTCoOoPXF
                                                                                                                                                                                                                                      MD5:5113FE55CA8F04DA822CAB1229C7DE28
                                                                                                                                                                                                                                      SHA1:E891E702115F29AE9BFDADAB3C9A2F373F11A989
                                                                                                                                                                                                                                      SHA-256:5088FB0258865B86C9B7DAF802CDC8F4EDE0D96A827BC3F7D872A9DEE4E54C71
                                                                                                                                                                                                                                      SHA-512:AEC839B849292BF72A25AD86847FAF93DE44D7DE42EF6E65B8C7058B24C3CF4AECB2FD7A065C6BA46A2D26502CFC76FF8C949457C5581E44F056B7F667910D2E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........[.k.:.8.:.8.:.8DD}8.:.8DD.9.:.8DD.9.:.8DD.9.:.8DD.9.:.83H.9.:.83H.9.:.8.B.8.:.8"O.9.:.8.E.9.:.8.O.9.:.8.O.9.:.8"O.9.:.83H.9.:.8.:.8-?.8.E.90:.8.E.9.:.8.E.8.:.8.:.8.:.8.E.9.:.8Rich.:.8........................PE..d.....$e.........."....$.....x.................@..............................3......'4...`..........................................N&......O&.0....0/.......-.._..H(3.p)...03..b..(.!.......................!.(.......@................'...I&.`....................text.............................. ..`.rdata..............................@..@.data....`...P'..>...2'.............@....pdata..._....-..`...p-.............@..@.didat..0.... /.....................@....rsrc........0/.....................@..@.reloc...b...03..d....2.............@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswRegLib.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):128952
                                                                                                                                                                                                                                      Entropy (8bit):6.155552056864603
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:3y2kRhImKsbZ1M/mu+DNdt9Nd39Ndt9NdtLjqoJSu6rspBoSijUz5:3yxLKkX8eqoJSuPpBoSc
                                                                                                                                                                                                                                      MD5:C7976445AAE38AE295158DCFDE8F04F2
                                                                                                                                                                                                                                      SHA1:62C9421261C3FC03EE9DAC5C78C1638E471CA1D5
                                                                                                                                                                                                                                      SHA-256:4B41024C27A42F4191326526DC82F0B00C54A4F29E6E53571B3335A3572FD63C
                                                                                                                                                                                                                                      SHA-512:4A141D23943DF2230917C0EBF90E36473D8B69656172DA127163E9E2C9F68FE64C8258BB8DFA9781F676B7BF79EA26829B2F1A3C6F4BA800094E2C145A10A507
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........<._.R._.R._.R.....^.R...Q.[.R...V.V.R...W.B.R...S.W.R...W.^.R.V...O.R.K.S.].R...S.P.R._.S.:.R.K.[.z.R.K.R.^.R.K...^.R._..].R.K.P.^.R.Rich_.R.................PE..d.....$e.........." ...$.....................................................0............`A........................................`...T...........................H...p)... .......f.......................g..(....e..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@...........................@....pdata..............................@..@.aswRegi............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\aswShMin.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):209856
                                                                                                                                                                                                                                      Entropy (8bit):6.350528927944843
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:mak5kT4ksExHzx/okraCUdohJpTMqYid:makST4kssHdVT8old1d
                                                                                                                                                                                                                                      MD5:B702BAB807290757B219BEB5E9209807
                                                                                                                                                                                                                                      SHA1:69C933FC0A616D44B21F300092924F3090EDD015
                                                                                                                                                                                                                                      SHA-256:D8845D5E04EB3ED64CA4090CD30F582313BB23A43004ADBBFD7F7153A3FBCC7E
                                                                                                                                                                                                                                      SHA-512:DAE269166CCFB91ABCC1492560C86FBFF1D9606605091842B2B1C444CDCCA7E8D14F0B48C46E9656A459E538E79266F891836F262E5ABF7B0138C0AE92917024
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7zC.Y)C.Y)C.Y)..Z(I.Y)..\(..Y)..](W.Y).](S.Y).Z(I.Y).\(..Y)..X(E.Y)J..)@.Y)C.X)..Y)..\(B.Y)W.P(H.Y)W..)B.Y)C..)A.Y)W.[(B.Y)RichC.Y)................PE..d...|.$e.........."....$.....d.......T.........@.............................`.......x....`.....................................................d....@..........d...H...x)...P..................................(...@...@............... ............................text.............................. ..`.rdata..............................@..@.data....'..........................@....pdata..d...........................@..@_RDATA..\....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\background-loading.png.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):662542
                                                                                                                                                                                                                                      Entropy (8bit):7.979329958318988
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:uxf4fCa15wBOQvPEDMAK+ywEJUVWoCQvOGZj4+vPnenTpHjoj716T:Qf4fCgqBHPml3zTVOQWG5V3neTtjNT
                                                                                                                                                                                                                                      MD5:EAD968E4266725709FC170EBD749F760
                                                                                                                                                                                                                                      SHA1:BF99C488BEACEFF8ECF7734BF1A9FB481D3EC434
                                                                                                                                                                                                                                      SHA-256:5F0799AA26C5EE902F26875C02BF0CA3CC884E0A2722DFAD89624659E03C4B9C
                                                                                                                                                                                                                                      SHA-512:CFA46409BF381E4C52E35C9F2369B9B4F377EC68C62609829992B9BD46E440C66643A8B457A98834336D1CE3C7828FBEB9C2CCB4B9DDFB75AD2B74D77702DF6F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a.....IDATx...i.n.q..e}..w...z..Fc!.&!p.w..!..4.R...G.....G....^.......;...aQ.H.LRC.. @C.........@..@o.._w..._.T..u..dfe}.}..d.}.9u.2....2.......g#..c.....-.<8.\V+..O'....X...,q..cY...W...W.w..$.g.....a..z....6...yS.v;...T\...........O*. =/.;+..x*[.i.#....%#..W./M..kd;X.4.r.....%NHe.1d..y.WzL.....Jo.......F.YN.zV..<..2....f.G...~........g#...v..Nyg...N...f.5..M.:.....8..a..7.fC..|..@.X.x.Z.X.Z4[8...."..=O.c..o!Z.`............x....(...s#.g.u.Tg....>.....y...a...F..k..../..Z.{.K.. ...`.#...[..&.2L.Q..bF... ...i...|e.......H.8.&.4H.s.a.=|......o..}.... .y.d.....OK.h.M..yo.....#.</q.>#1..4.B.x..G..z$...U..Do{........h}..X!..TU>.2.....Q..WaC..Md........qg.{<....Q..8.....Z.^.(..d.G.....R.I...r.r.X....,.Z....%=..K..H.....@.{...x.<[s...Z...u.&....k7.u....j....7.....Y.<.T..}.O.{.3.e....v.x....yKw.:.t/.H/.3........./.[..8..V[Z.@...W.... ...z...Kx..n................_*O

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\background.png.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):660251
                                                                                                                                                                                                                                      Entropy (8bit):7.978870431576906
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:mxf40/atS/tbc34HmvY4HzLykAr3jRyov+gZH4NRWdQpHR+9:4f4ftS/tbcoQ5TwnRlvNZH4NQd8Y9
                                                                                                                                                                                                                                      MD5:D681F59276007A55650501CA31715F8E
                                                                                                                                                                                                                                      SHA1:5156EDE5FFBD33946DCC2B23B2C1D53E8E7BF702
                                                                                                                                                                                                                                      SHA-256:F800F6F5E01405B463ED0CF798029354C405FA54C0D8DA59CDCF38A2CE9D73AB
                                                                                                                                                                                                                                      SHA-512:C1BE5415B87FE1C97DD1315035034815C1CB4EB08F71C2E0E9141EAE7628D25045829330207FE4CD745E3E42BDB77CFF7DB09CF0E2E982665B59A7493F026D6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a.....IDATx...i.n.q..e}..w...z..Fc!.&!p.w..!..4.R...G.....G....^.......;...aQ.H.LRC.. @C.........@..@o.._w..._.T..u..dfe}.}..d.}.9u.2....2.......g#..c.....-.<8.\V+..O'....X...,q..cY...W...W.w..$.g.....a..z....6...yS.v;...T\...........O*. =/.;+..x*[.i.#....%#..W./M..kd;X.4.r.....%NHe.1d..y.WzL.....Jo.......F.YN.zV..<..2....f.G...~........g#...v..Nyg...N...f.5..M.:.....8..a..7.fC..|..@.X.x.Z.X.Z4[8...."..=O.c..o!Z.`............x....(...s#.g.u.Tg....>.....y...a...F..k..../..Z.{.K.. ...`.#...[..&.2L.Q..bF... ...i...|e.......H.8.&.4H.s.a.=|......o..}.... .y.d.....OK.h.M..yo.....#.</q.>#1..4.B.x..G..z$...U..Do{........h}..X!..TU>.2.....Q..WaC..Md........qg.{<....Q..8.....Z.^.(..d.G.....R.I...r.r.X....,.Z....%=..K..H.....@.{...x.<[s...Z...u.&....k7.u....j....7.....Y.<.T..}.O.{.3.e....v.x....yKw.:.t/.H/.3........./.[..8..V[Z.@...W.... ...z...Kx..n................_*O

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\waikamd64.mst.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Installation Database, Subject: Windows Automated Installation Kit, Author: Microsoft Corporation, Keywords: Installer, Comments: Windows Automated Installation Kit, Create Time/Date: Mon Jul 13 17:30:20 2009, Name of Creating Application: Windows Installer XML v2.0.3620.0 (candle/light), Security: 2, Template: AMD64;1033, Last Saved By: AMD64;1033, Revision Number: {31E8F586-4EF7-4500-844D-BA8756474FF1}2.0.0.0;{31E8F586-4EF7-4500-844D-BA8756474FF1}2.0.0.0;{0EAF84C7-F60C-4C9A-8299-19F213BE10CB}, Number of Pages: 200, Number of Characters: 0
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3584
                                                                                                                                                                                                                                      Entropy (8bit):2.499314150224037
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:rk5aZ2EfIXYCBz/tnB39JJ0ZD7+9Jb0hWJPSy4enin6CG:rCaZ2EDGB39JJ0ZD7+9Jb04JaGCG
                                                                                                                                                                                                                                      MD5:EC82D1081D31554E75D7E72B30D31D78
                                                                                                                                                                                                                                      SHA1:FF5615640CDA8CEC9FB0AD3FB8A4E441BCC8E398
                                                                                                                                                                                                                                      SHA-256:0823905CE46355FE514ED547D5C639AF39B2B3D28A5BCABD1846997C7A4208B7
                                                                                                                                                                                                                                      SHA-512:2F36323DB92F1C1D4E3B8F18F8258830A6200BC7061EAAEADCD0A655E30276592376FA4C4F706F497D5FCD00A1E5C5649E20407D3860910A184CCBE4B36547B9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\wxbase315u_vc.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3109712
                                                                                                                                                                                                                                      Entropy (8bit):6.61926858778699
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:kkSDJENEpiv4omjT6M+o+eKDP5OvvPvhfsXmqgZcM1mHyCz3tklxJOqlB8KTyfpK:GQviL+3zDivPJUWJZ2yCDJK
                                                                                                                                                                                                                                      MD5:6BE3312340BEB58DF3C490F717EC4B36
                                                                                                                                                                                                                                      SHA1:1E45F5D386260D8A232E7C990802DB2C3C2FA233
                                                                                                                                                                                                                                      SHA-256:19BB793140D369FDC1E94E79AAD0AFE90A442EEAA4945B978232B86254B38642
                                                                                                                                                                                                                                      SHA-512:A1AA942BBFD3773F7EC1CE027F6F9A7296711BF27F96EB4A5398BD9FB510FE95FF9BD00F41D767B3982A2FD1BD1442368241E6E336C1249A030C31E6535D30E5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........d..d..d...\..d.....d.....d.....d.....d.....d.....d.....d..d.1e.....d.....d.....d...0..d..dX..d.....d.Rich.d.........................PE..d....._c.........." .....V..................................................../......./...`.........................................`$&.......,......p/..........d...J/.P)..../.\#..0.!.T.....................!.(.....!.8............p...............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data...P....0-.......-.............@....pdata...d.......f....-.............@..@.rsrc........p/......./.............@..@.reloc..\#..../..$...&/.............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\RescueDisk\wxmsw315u_core_vc.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9693520
                                                                                                                                                                                                                                      Entropy (8bit):6.426830026542257
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:dFRdW4EP46lE2JrXttMOcNBQM12tINR0qX46TQYpCePAcr1gm9QzN3ZEPtorGaRV:C9pXS/pCedkzN3ZZKItfIBSksjrX
                                                                                                                                                                                                                                      MD5:2242FCC9038B6751388EA5C3D3FE7C4D
                                                                                                                                                                                                                                      SHA1:7BEE974F4573D2E718E6B3274B59B054ED89D847
                                                                                                                                                                                                                                      SHA-256:BF6DDC8DA511CB35E7390D35072DB0C4A1D1D4504ADC1D669482D0F826831646
                                                                                                                                                                                                                                      SHA-512:FE9C31BDB5A029268BCADFC260408BF39565ED7C20957EF5EE87C8B094F80757038E2A4AC6654FBBEA0E1BC68ED576FD94D2697D1811D5D6DC96F1CDDA80F8D2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........Sh].=;].=;].=;T.;I.=;;..;\.=;..9:U.=;..>:Y.=;..8:G.=;..<:[.=;..9:>.=;..<:_.=;I.::\.=;I.9:V.=;I.;:\.=;I.<:B.=;].<;..=;..8:..=;..=:\.=;...;\.=;]..;\.=;..?:\.=;Rich].=;........PE..d....._c.........." .....vJ...L......LC..................................................`.........................................0zw.......X....... ...............P)......$.....i.T.....................i.(.....i.8.............J..3...........................text....uJ......vJ................. ..`.rdata....@...J...@..zJ.............@..@.data....?..........................@....pdata...............D..............@..@minATL.......p.....................@..@.rsrc... ..........................@..@.reloc..$..........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\SetupInf.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4100536
                                                                                                                                                                                                                                      Entropy (8bit):6.4744347834151785
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:0MLpHBldV8J3IqNRkPztYNEtRl0P1Fd0VGdOMNLCUVyjksp2KD78thFuw+0+c7y9:puRctYOENNeUV/
                                                                                                                                                                                                                                      MD5:C0AE908FB6DA26DFF9D7786573DA5968
                                                                                                                                                                                                                                      SHA1:4440092DF7EABBC753DE32EC62378D181B5723B2
                                                                                                                                                                                                                                      SHA-256:47E82825F5D26C8899B113E28D32C8C1F80FC2CF0355863C44545107B116292E
                                                                                                                                                                                                                                      SHA-512:DE23976FA9F4DDC53BDD2A8292E122409A17CF099CB37A481BD7EDB21742DBFCC28FE5A038CAF5D632F74772A0EA9209D20C0F51EB9F9F4BEBB2679FA76A5365
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.........z..{)..{)..{)Q.~(G.{)&..)..{)&..(..{)&.~(..{)&.x(..{)Q.x(..{)Q..(..{)...)..{)@.~(..{)..{)..{).~(..{)@..(..{)Q.z(..{)..z)o.{)..r(..{)..{(..{)...)..{)...)..{)..y(..{)Rich..{)........................PE..d.....$e.........."....$.&'.........`..........@.............................@?.....z.>...`..........................................Z5......[5.......>.8.....<.....Hh>.p)....>..]..../......................./.(...p./.@............@'..............................text...j%'......&'................. ..`.rdata.."D...@'..F...*'.............@..@.data....\....5......p5.............@....pdata........<......:<.............@..@_RDATA..\.....>.......>.............@..@.rsrc...8.....>.......>.............@..@.reloc...]....>..^....>.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\SupportTool.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9083832
                                                                                                                                                                                                                                      Entropy (8bit):6.772799095920272
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:sTxGk4KRu+UjIB8END9Ez8Hh2IPgebqq4m2zuNtf3c9+oOo:sTxGkxRu+UjIB8g968HhdPQ9m/bMr7
                                                                                                                                                                                                                                      MD5:A90A73577DDCEA9C82B44B1D8D70B0C6
                                                                                                                                                                                                                                      SHA1:C1DC9F25496846DF7B33F0704FB9AC92CE83C7C3
                                                                                                                                                                                                                                      SHA-256:D90FBBE48FCE1480C1F2F2E9C9F377A549B30120FB53E0EB25B42D91BAB32191
                                                                                                                                                                                                                                      SHA-512:A688358E63002576639FEC0D5DC2C2476653ED30746A1A7CBA03072F0570F15FC429331F317AC115BF56BE3DF3CF9439F120B28728ABB9A6E987CA4AC6DE2CD6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........'..F...F...F..b4..@F...8h..F...8...F...8...F...8...F..b4...F...>...F..s3...F...F...F...3...F...3...G..+(...F..+(...F..b4...F..b4...F...F..dE...9...G...9...F...9j..F...F...F...9...F..Rich.F..........................PE..d...q.$e.........."....$..R...9................@.............................0..........`.........................................pmo.....Xno.......z.......w.....Hr..p).......o....e.......................e.(.....e.@.............R..............................text.....R.......R................. ..`.rdata........R.......R.............@..@.data..../....o.......o.............@....pdata........w......br.............@..@_RDATA..\.....z.......u.............@..@.rsrc.........z.......u.............@..@.reloc...o.......p..................@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\TuneupSmartScan.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12379576
                                                                                                                                                                                                                                      Entropy (8bit):6.357813210301676
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:eP0mbe0QMdMWy/kwuo2xd0pCUBHKIgVeqShxOsVc:ePd6MdnyXCMHjgVew+c
                                                                                                                                                                                                                                      MD5:A706E9A78E57F0E313F957DD52D13E8F
                                                                                                                                                                                                                                      SHA1:1FA2965493F3FE91937C1060BC60C42D98D4F2A8
                                                                                                                                                                                                                                      SHA-256:F0FBF0FB1A99249FD1C76D686DA586666C9E56F37B3C39DF19A1C5BBDF104969
                                                                                                                                                                                                                                      SHA-512:89EC73E1040B56CC784633CD9D45C7459C1F607BAD8FC07AED421A53E9A6BB04C6AEFA280C8305E7266F2A5CF2DC9FC6EB861E25BA930DAC9E964798F6C073F5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$.......2!..v@..v@..v@...80.n@...4..|@...>^.z@...>..~@...>..t@...>..~@...2..t@...5..w@......p@.. 5...@...2..w@...2..w@.. 5..r@...>..D@.. 5..r@..b?..z@...2..|@...2..O@..v@...E..b?..>B..b?..w@..b?\.w@..v@4.u@..b?..w@..Richv@..................PE..d...[.$e.........." ...$.dr...K......$Z............................................`....`A........................................0o..8...hr..........h.!..`......H...p)...0..T.............................(.....v.@.............r.p&...b..@....................text....br......dr................. ..`.rdata..X.....r......hr.............@..@.data...0....@...`..................@....pdata.......`.......z..............@..@.didat..............................@....rsrc...h.!.......!.................@..@.reloc..T....0.......$..............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\VisthAux.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):362432
                                                                                                                                                                                                                                      Entropy (8bit):6.6662881049739395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:H8PVHiNsHLAcR/CzSpbLU+LFDPMTJYhr64FgBl:HMiNsHbggLlLFPMdV4FgBl
                                                                                                                                                                                                                                      MD5:5E1DD772BA2B03076E5CC3E29F5781EB
                                                                                                                                                                                                                                      SHA1:B13AA465F26F71F77DD70EECC19F9ACF3B27E88A
                                                                                                                                                                                                                                      SHA-256:C3C5CCBD2BD1D17CB94DEE2D3D3E1EB529EF1088CCAFCE1B17A6C463862C9B3C
                                                                                                                                                                                                                                      SHA-512:D9E32F43A3208DA856543C0A45B8331BFC166EB8B0D43918511973B92115BBAE60CED085CBCD3068D4415641F2E17BD063764443B9E4786E7760947AC75FDB55
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........a..............n~[.....n~......n~......n~.......u.......x5.....n~.......r..................Y.....................Y.......1.............Rich............................PE..d.....$e.........."....$.z...P.......&.........@....................................b.....`.........................................@Z......$[...................(..H^..x)......8...............................(......@....................X..@....................text....y.......z.................. ..`.rdata...............~..............@..@.data....5.......,...h..............@....pdata...(.......*..................@..@.didat..............................@....rsrc...............................@..@.reloc..8............X..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\anen.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1627064
                                                                                                                                                                                                                                      Entropy (8bit):6.437981769745519
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:ji13qym2OacrJ3+Ba29AcG+nG6kJL1EJOMDVVTK8DJZCcyd:mkSOzrJ3+M29tV9w6JOEvTK8N6
                                                                                                                                                                                                                                      MD5:B9EC35D361A49E2555234DD4064572B7
                                                                                                                                                                                                                                      SHA1:C5B1AE6B686AE7129E34B63EA8E82ECDECE1367F
                                                                                                                                                                                                                                      SHA-256:9497778E10099D0D636A37529233B45AD073CF63F586C9C77614D8FF7EDC7A52
                                                                                                                                                                                                                                      SHA-512:0CD1F7448F357E2B5EF521A817A75CE08E46B866EC657862512AD6F1D34ED212832002E00D76E2114ADE0D71301A9F37CF786DE97D269C38216695C03A7CC5C6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$............|...|...|..E.S..|..E....|..E....|..E....|..2....|..2....|..#....|......|..{....|......|....=..|..2....|..E....|.......|...|...~......|.......|....Q..|...|9..|.......|..Rich.|..........PE..d...`.$e.........." ...$............`...............................................y.....`A........................................@~..<...|...X.......P.......\...H...p)..........hQ.......................R..(......@...............(....y.......................text...|........................... ..`.rdata..............................@..@.data...............................@....pdata..\...........................@..@.didat..`...........................@....rsrc...P...........................@..@.reloc........... ..................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashBase.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):823744
                                                                                                                                                                                                                                      Entropy (8bit):6.533018968121505
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:SdeqEqchc7Qtbi/hhlTSKh0lhSMXlrZjary:SdeqUmhl8lj
                                                                                                                                                                                                                                      MD5:BECA0E85251BB4EFD8939B911082A427
                                                                                                                                                                                                                                      SHA1:CCBFA3A2C375CBAFB980F378DE75800F2F89D31F
                                                                                                                                                                                                                                      SHA-256:897A6625F53416639615DC9F7F641E81512F450DBDDF120A67C6E291E0922D2C
                                                                                                                                                                                                                                      SHA-512:2B37DBAE11CF991B3185E13A52601968D7BA3CF0C738A031CECB93FD3EFCF90258A4BC6E5F76F6E7996F5663129F021973B3AA1C7039758AC533C16BDF6E6785
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........u.@C...C...C....j!.A....j..K....j..A....j..E....f..A....f..A...JlO.W....a..B....j..g....a..@...Wk..H....f..M...C...?...Wk......Wk..B...Wk#.B...C.K.@...Wk..B...RichC...................PE..d...;.$e.........." ...$.............................................................O....`A.........................................p..D...Tr..........P....0...a..Hh..x)...........^......................._..(...0...@...................$k.......................text.............................. ..`.rdata..............................@..@.data....s.......X..................@....pdata...a...0...b..................@..@.didat...............V..............@....rsrc...P............X..............@..@.reloc...............`..............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashQuick.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):398784
                                                                                                                                                                                                                                      Entropy (8bit):6.6971253828812545
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:U11yMCv3NSKe5mEA1SCID0wcFCmAreLFDPMTJYhr64FgFW:U11tCsK8mhlw0CwLFPMdV4FgFW
                                                                                                                                                                                                                                      MD5:64F324951D50E094395EF8EEE516DF90
                                                                                                                                                                                                                                      SHA1:FAB37FE111F603BD2A3598C3D8B3B806754E4DB0
                                                                                                                                                                                                                                      SHA-256:FEB80B70AC43D5C6A4A32A0DE56F106C4C8A80098C095A7C403A07568EE81ADA
                                                                                                                                                                                                                                      SHA-512:DCA688370159A61061A05CD887FD9A30229B488417BF41491923AEC7FE4A74998DFA8D75CDB2E2CE7BDE9FA3088852496FF9AE4ED961B11471D251B4CCF0DD66
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......?&..{G.{G.{G..9).zG..9.qG..9..G..9.}G.r?G.iG..2.zG..5.wG..9.YG.o8.vG.{G..F.o8.EG.o8.zG.o8+.zG.{GC.yG.o8.zG.Rich{G.........................PE..d...5.$e.........."....$.............].........@.............................P............`.................................................t................`...-..H...x)...@......8K.......................L..(.......@...............x............................text...k........................... ..`.rdata..............................@..@.data...0R.......<..................@....pdata...-...`....... ..............@..@.didat..@............N..............@....rsrc................P..............@..@.reloc.......@......................@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashServ.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21143992
                                                                                                                                                                                                                                      Entropy (8bit):6.470360148949278
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:b9pyb/y/PLKRuFX9QI3J1qVrATrSLRq2HlcGX:Bpyb/Gxl9QI3J1qVIrSLRqOlpX
                                                                                                                                                                                                                                      MD5:36C16E7F159E474D040E395A6419129D
                                                                                                                                                                                                                                      SHA1:AE62046FFBAA5E5F3DC89A930C02A19632868E9D
                                                                                                                                                                                                                                      SHA-256:DE46178038638C98E05271A4BD6D421038F2D9A3B8B4C77157FF966991223AA5
                                                                                                                                                                                                                                      SHA-512:25C40FCA167B1418843DA33894D0F4A3A550654847C652747C6A0EC51C10566C3179E1CEE6F2009539A3771123C845DD399ABE9AC4FC5D7CB1F1C3E9E6D75400
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................h...........!..L.!This program cannot be run in DOS mode....$........4<..UR.UR.UR.-..UR.f!W.UR..+..UR..+V.UR..+Q.UR..+S.UR.} W.UR.l'T.UR..+W.UR.%;W.UR.%;V.UR.. S.UR.l'Q.UR.l'V.UR.*S.UR.. V.ZUR.} V.UR.. W.UR.US..\R.l'S.UR.*[..QR.*R.UR.*..UR.U..UR.*P.UR.Rich.UR.........PE..d.....$e.........." ...$.t...pw.....@..........e............................. E......HC...`A.........................................=..H...X>..L.....B.......:.....HxB.p)....B......Z.......................[..(...0...@...............p@...........................text...=r.......t.................. ..`.rdata..4.J.......J..x..............@..@.data...X{!..........h..............@....pdata........:......t7.............@..@.didat........A......\?.............@....rsrc.........B......d?.............@..@.reloc........B.......?.............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashShell.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3794880
                                                                                                                                                                                                                                      Entropy (8bit):6.467685155525637
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:b/IECbRIG02AJMXJLS+1GaH3BVoRwcEAEFWOZyU0MAgJ84vzDv7ZyTcCASR+SF+g:1Cb6mJNVT2OZMVb
                                                                                                                                                                                                                                      MD5:09922977F2E1BE6BB0A1FFB7AC0292B7
                                                                                                                                                                                                                                      SHA1:B3FF43C6D448E9E75BB35F656F08680F6BE04237
                                                                                                                                                                                                                                      SHA-256:4EFFF93843799F05F62D7F7A6B0C700B7A50192C92DA14DA71F8022554AD2156
                                                                                                                                                                                                                                      SHA-512:1E0AB063A55AF03CB0EFE68EEA4496108E7CEACB14D5B725F5C024B4FE0B5B8F15E02AED06B31AF4F782C753D203D0F114932CF6791FA96EF73F6109FDCCC835
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......\7..V...V...V...$...V..(W..V..(...V..(...V..(..tV...$...V...$..:V....9..V...#...V...V...V..N#...V...#...V...$...V...V...W...)...W...)...V...)U..V...V=..V...)...V..Rich.V..........................PE..d.....$e.........." ...$.4#....................d..............................:......):...`A........................................0.0.......0.......9..A...08.....H.9.x)...@:.D[...Z+......................[+.(....Y+.@............P#..............................text....3#......4#................. ..`.rdata..>j...P#..l...8#.............@..@.data... e....0.......0.............@....pdata.......08......x7.............@..@_RDATA..\.....9.......9.............@..@.rsrc....A....9..B... 9.............@..@.reloc..D[...@:..\...b9.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashTask.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1232320
                                                                                                                                                                                                                                      Entropy (8bit):6.3701051735668734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:BN6i0OGylEHhJHJ+A2u3atsVBBxh+xlPqKkRma9a:BN6JOGylEPpr2mh+XPHk
                                                                                                                                                                                                                                      MD5:2B41818C2DAEBBF4B9F6D67697EC533A
                                                                                                                                                                                                                                      SHA1:FF0A0D26D1F0EC34B3B72CB97B28C48B46B6E7D9
                                                                                                                                                                                                                                      SHA-256:B983CA7C5247B45351D326C701742E653CB4CEB9D963C9650B102695B60B6E46
                                                                                                                                                                                                                                      SHA-512:D23BFBEDF67815078310855FB07AD9A18AB964E8E0BBB9DF4180DD8A7EA74FCDAAEAB01BF46DC24B16D0E00BC863111DE836EF64A5020ADD0BCDC8B9AAD6BBA0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........m.............Cr_.....Cr......Cr......Cr......%y.......t1.....y......Cr......y.......s......4~..........1....s..c....s.......s].......5......s......Rich............PE..d...>.$e.........." ...$.V...f......p................................................V....`A................................................,...........H.... ......H...x)......................................(.......@............p......t... ....................text...{T.......V.................. ..`.rdata.......p.......Z..............@..@.data........ ......................@....pdata....... ......................@..@.didat..............................@....rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ashUpd.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):522680
                                                                                                                                                                                                                                      Entropy (8bit):6.628264985785411
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:eebeQuK2AuMhmqNMlIVkPnkvLFPMdV4Fgz:eebWGTNMlWkPnkvJkdV4Kz
                                                                                                                                                                                                                                      MD5:F2B5623FEDA12238C28A0E19D042DAB0
                                                                                                                                                                                                                                      SHA1:ABB8BDBFAFD15A201E5253D146E43918C91625FA
                                                                                                                                                                                                                                      SHA-256:3C2A6617262A71ACC6E8C8602A12B893F2711470A067C1456A68318F14A9FC1D
                                                                                                                                                                                                                                      SHA-512:F43F5A25F12DE24BFA46E9FE2F66ADBCCC53781796E59E9EA240B04C73426BEFFBEA1EC524B416891A0BDA591AAF7D0EEF1F0FE7D8A96B54C0D8F841C42F90A1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......g:.r#[.!#[.!#[.!.%-!"[.!.%. )[.!.%. '[.!.%. %[.!*#C!7[.!... "[.!u.. [.!.%. .[.!.). 1[.!7$. ([.!#[.!<Y.!7$. l[.!7$. "[.!7$/!"[.!#[G!![.!7$. "[.!Rich#[.!........................PE..d...I.$e.........."....$......................@............................. ......Bf....`..............................................................[...`..\=..H...p)..........h'.......................(..(.......@...............0............................text...K........................... ..`.rdata...b.......d..................@..@.data....J.......6..................@....pdata..\=...`...>..................@..@.didat..X............l..............@....rsrc....[.......\...n..............@..@.reloc..............................@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\asulaunch.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):70536
                                                                                                                                                                                                                                      Entropy (8bit):6.475499489951965
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:AY1z389crNXJx2d2g1u3uNeI+082ZryzB+4ESzBcEpYinAMxY7No8YiieAMxkEt0:Av9cjwsoeWg+4LzB17Hxuh7Bxh0
                                                                                                                                                                                                                                      MD5:3AC75A137D4A1B681CC4969E5FD2A18B
                                                                                                                                                                                                                                      SHA1:458551243A4B272EF346F1030D536E158F8FF38E
                                                                                                                                                                                                                                      SHA-256:C9A4CF9140603F3B4DB2A947A049167952C09436DF5D9F0CEDCCD6DEADC7B975
                                                                                                                                                                                                                                      SHA-512:31D92C9799288564BD86D683474BF95973B27FD5C3EFF4783F7B10E82676C3CA1DAA46A0CDADD86ADA89F6E17E5FE1B660E487B6D3AA102D24729405EAC6FEA5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........o....z...z...z.Lp....z.Lp~...z.Lpy...z.Lp{...z.;|y...z.;|~...z..v...z.;|{...z.Lp....z..q{...z...{...z..qs...z..qz...z..q....z......z..qx...z.Rich..z.................PE..d.....$e.........."....$.b...f.......B.........@..........................................`.................................................d...................P........Q......4...@...........................(.......@............................................text...+a.......b.................. ..`.rdata...;.......<...f..............@..@.data...@...........................@....pdata..P...........................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswAMSI.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):709048
                                                                                                                                                                                                                                      Entropy (8bit):6.526372794743047
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:8kauLAgMiwyZYVWzSFSV7pP+h6RUrr/G+N+rZnThph0lhSMXl+2oX1V:8kawAgMiwyZv7p2U+2Tjh0lhSMXljcj
                                                                                                                                                                                                                                      MD5:085AAA400F761208025D78AA03E9491C
                                                                                                                                                                                                                                      SHA1:E75E906B53226B050CB277E0D34FDF5CC1E3255F
                                                                                                                                                                                                                                      SHA-256:54A025379AA9DA51A9585E25C3081D3EE4698C67D1102D41DDE064DCC7A28109
                                                                                                                                                                                                                                      SHA-512:88315B4BCD3B1355F2986D73EF756EA680DB16CE5755ACD5723DD6A0A8C64AD765A12C8C8E14B7A7360E181DF44D162EEEED5DB7A554B56D38733750A46B3798
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........5..[..[..[.#.X...[.#.^.^.[.T...[.T._..[.T.X...[.T.^..[.#._..[.2.^..[......[..[...[.#.Z..[..Z..[...R.r.[...[..[.....[.....[...Y..[.Rich.[.........PE..d.....$e.........." ...$............p".......................................0............`A............................................................X........N..H...p)..........0\.......................]..(.......@...............h.......@....................text...|........................... ..`.rdata..PI.......J..................@..@.data....[...0...$..................@....pdata...N.......N...6..............@..@.didat..............................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswAux.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1036224
                                                                                                                                                                                                                                      Entropy (8bit):6.140003314176969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:S2qPGEGDXO6GuGpgRL0v0UFNocuexM5PAQRaMMErCzfSSyVJOsKbkI:YeEGDXO6zGpga0UFNnuexwAQ8m2FPL
                                                                                                                                                                                                                                      MD5:8BCFADCBB22A4374AE654420A42842FC
                                                                                                                                                                                                                                      SHA1:146257F31BFD58B879972492CA5190AC315D3DAA
                                                                                                                                                                                                                                      SHA-256:2D113370F5255DB340965D3D31369C692F3E0EA4F29EEC25D7BE73D4BEDCAB1A
                                                                                                                                                                                                                                      SHA-512:64280DE4C57D2E5B9206F9990635E065FC6DDB2EBD399E08937CDB2FF0D69EC13FC9F8D58C26CFA9C672E4DE1C329336A146A531C44B996DD7086599E77295CB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......dO.. ..@ ..@ ..@)V6@,..@.PX@#..@.P.A(..@.P.A$..@.P.A9..@.P.A&..@.\.A'..@ ..@...@.@.A...@4Q.A&..@4Q.A!..@4QZ@!..@ .2@"..@4Q.A!..@Rich ..@........................PE..d.....$e.........." ...$.............F...............................................l....`A...........................................................@.......x...H...x)......................................(...p...@............................................text...k........................... ..`.rdata..............................@..@.data....E.......4..................@....pdata..x...........................@..@.rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswAv.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11689920
                                                                                                                                                                                                                                      Entropy (8bit):6.470677857619575
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:GobftHr2CeWDi1x7ZFEoJ5GHlfrCqY58c5e2YOxzwl0EgULDO:pDh9eWDmxVfwleqYac8j6EgUe
                                                                                                                                                                                                                                      MD5:5E1DA68F067ACA8FFA29506267651DB2
                                                                                                                                                                                                                                      SHA1:B2E7B99000B1F0C51FF61B47E2BF87180793E4A1
                                                                                                                                                                                                                                      SHA-256:DA7E7D4BD007661D75063C25C1D5E369ACA3AFF8B57EC92F56FE98A52A5DA166
                                                                                                                                                                                                                                      SHA-512:2C35C86D62B1F305B62EB7EDD3C475B2C52F2310DEBD4F358E53618D7B95FBFEA30DD72C2F6C06EA0A6719E760DA0B8ACD806305E599022C4AFCBCFFEB949E36
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b.......r.....................h...........!.....!........................h..........y.....y...........h.....h......................p.............Rich...........................PE..d.....$e.........." ...$..x...:......zR......................................p......&^....`A.........................................B..8....V..`....P...+...P..p...H6..x)....................................(...@.}.@.............x..*...#.......................text.....x.......x................. ..`.rdata...m#...x..n#...x.............@..@.data...X....0......................@....pdata..p....P.......6..............@..@.didat..@....@....... ..............@....rsrc....+...P...,...$..............@..@.reloc...............P..............@..B................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswAvBootTimeScanShMin.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1447872
                                                                                                                                                                                                                                      Entropy (8bit):6.613928256274225
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:kbSToGTFS/Nvg/1Ml+raEarCgBr9YwBr0h0lhSMXl95sj51xTJkdV4KG:kbSTsNoC+GZiwh5Y1xTJIV4
                                                                                                                                                                                                                                      MD5:5210556292029F4BE2642F081F4C6231
                                                                                                                                                                                                                                      SHA1:0E30D8A311EDC8EF0A3E29F80B251D7D5B3C2D4A
                                                                                                                                                                                                                                      SHA-256:C62803347280377B6E10680AA48EB52B316CAFCB621DF13EF9B0E59BB3266D64
                                                                                                                                                                                                                                      SHA-512:7C7B636198ED2EAF74C94E7A613F0EBB554F04ADC2D1401CE7F11301F718B75D9E6DF6AF09AF49F2CB38F5AE2272ECC785EE1758CEBC769FA6043DC26F9BA444
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........k.8.8.8#.93..8T.k8.8T.9.8T.9...8T.9...8#.9...8#.9..8...8.82.9.8.8...8..9...82.9.8#.9.8.8?..8..9.8..9.8..i8.8..8.8..9.8Rich.8........................PE..d...,.$e.........."....$.............T.........@....................................c.....`..........................................1.......2.......p..(..........H...x)...........u.......................v..(...Pt..@............................................text............................... ..`.rdata..p{.......|..................@..@.data...8V...P.......@..............@....pdata.............................@..@_RDATA..\....`......................@..@.rsrc...(....p......................@..@.reloc..............................@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswBrowser.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):565688
                                                                                                                                                                                                                                      Entropy (8bit):6.62195905727824
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:0vdgSxBNgJcIfhV6fAcrq5lz+H/qKph0lhSMXl+zoQs:0p1gJc8L5l+Rh0lhSMXluV
                                                                                                                                                                                                                                      MD5:1EF704B70D47867F679924676AF7F781
                                                                                                                                                                                                                                      SHA1:51A0DB72E0AE38298E98B20F9D61781B9B8AEF45
                                                                                                                                                                                                                                      SHA-256:40ADACAAF56374D1F85F81C8464560FD8FBB6F4F6A68E2FF7F05AE2BC78F6369
                                                                                                                                                                                                                                      SHA-512:88076A5F7B928CE909CDD6B45DDAE9FDB5D3E957BE37119B52142B8DBBDDF8C9A9D764FA8B9F8C441553FA0216725794F7E2A50A9F7B07779B0F01D4D4B7E3B7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......o..+...+...+......'.............?.....J.)......;......!......s...".$.)......*...+...(...+...l......:...?..~...?..*...?.H.*...+. .)...?..*...Rich+...........PE..d.....$e.........." ...$.t...2............................................................`A............................................l...............0....p...=..Hx..p)......0...p...........................(...0...@...............X............................text....r.......t.................. ..`.rdata...............x..............@..@.data....N... ......................@....pdata...=...p...>..."..............@..@_RDATA..\............`..............@..@.rsrc...0............b..............@..@.reloc..0............j..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswChLic.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):217536
                                                                                                                                                                                                                                      Entropy (8bit):6.990724308974734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:pajj7Fo/qIyiregdJITs8wLFDVFM6++2tF/3B8EMhr64S0gb5U8LH:4xIflucLFDPMTJYhr64FgD
                                                                                                                                                                                                                                      MD5:77E265092F01EF72DD3E2BF6526EF631
                                                                                                                                                                                                                                      SHA1:A8BE67B8D4D7AC4F0A41CE484ABB00CEA549324D
                                                                                                                                                                                                                                      SHA-256:2C4F14D14184633B49C8A658E831A97AD22DD63C242D527CD4D6D7706B2C8495
                                                                                                                                                                                                                                      SHA-512:30F1AE60158D6904754ABB80B619F8C06078ECC4FB1B9186BB2D240CA3E4F03B90733AD2DD3DA6359E2592750B056855C2ECD367F46C7F958AD1EBA6150F99AE
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................].......].......].......].......*........m.........Y...;.......................i............Rich............PE..d...w.$e.........."....$.D...X.......=.........@.............................p.......N....`.................................................L...........HZ..........H(..x)...`......P...........................(.......@............`...............................text...KB.......D.................. ..`.rdata...f...`...h...H..............@..@.data...0...........................@....pdata..............................@..@.rsrc...HZ.......\..................@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswCmnBS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):436152
                                                                                                                                                                                                                                      Entropy (8bit):6.467531771075762
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:vxhvLrTamV2LP/hD+rs328cBcHOTsEZRTQqy23NTFUeBYa+naI/mqN5YrmcqfYKh:vxFgLnhu+rwscTvyurvIT7fYrL
                                                                                                                                                                                                                                      MD5:BE99E325F51893653FFFAF6A763C7E07
                                                                                                                                                                                                                                      SHA1:F83C36DC1320EA2BFF342673AA9738553A4A36DC
                                                                                                                                                                                                                                      SHA-256:C81C2E92E1637344A3EA458C05372B01DA2153AD7B99956E0C82EEB45573E7E2
                                                                                                                                                                                                                                      SHA-512:DCDEE8B6B785E1ED57C95140018EC5437EA78EE2368B14939DF4E3A11FF5F963AE54C876B67B6C1361A382E78E9486D6FEACDB6D6AEB7A23253B6EBB8D2B2456
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Wr.g.r.g.r.g.{...f.g....q.g..c.z.g..d.v.g..b.S.g..f.t.g.f.f.v.g...c.s.g...f.{.g.r.f...g.f.n.B.g.f.g.s.g.f...s.g.r...p.g.f.e.s.g.Richr.g.........PE..d.....$e.........." ...$............P}.........d..........................................`A........................................P....i..............H....`...@..H~..p)...........,.......................-..(...@+..@............................................text...|........................... ..`.rdata...f.......h..................@..@.data...h....P.......0..............@....pdata...@...`...B...2..............@..@.rsrc...H............t..............@..@.reloc...............|..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswCmnIS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):488384
                                                                                                                                                                                                                                      Entropy (8bit):7.012384914147751
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:a/Whh7MLMHA3ldwhRM4cowzcRviVkHUbet5G/cj8rHkZ:a/WhVMLMHGldHPGRqVk0i98rHk
                                                                                                                                                                                                                                      MD5:6060368CC480B340A4C10062649A57EA
                                                                                                                                                                                                                                      SHA1:FACB999B2E356871955F8AC8FFEF703F86B43E9A
                                                                                                                                                                                                                                      SHA-256:602B1DD52113321E2C826CF93DC398862C387103B57F5B6D50E3F4AF9BDAC438
                                                                                                                                                                                                                                      SHA-512:1D5A10D892B885EE0E67E209DF0B5D985901607A527B2BB019B1E264A1273BB60DB157C7BBA44E953900DC6C870CAE5C9E32513297F6A7AE3AABEB716BBBC8DA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........MF.l#..l#..l#......l#.+."..l#.+.&..l#.+.'..l#.+. ..l#.\."..l#..l"..l#..l#..l#...*..l#... ..l#...#..l#......l#..l...l#...!..l#.Rich.l#.........................PE..d.....$e.........." ...$.....J.................d....................................a.....`A.................................................'..d....p..P....@..."..HJ..x)..........0...................................@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata..."...@...$..................@..@.rsrc...P....p.......:..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswCmnOS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):202176
                                                                                                                                                                                                                                      Entropy (8bit):6.426360945937083
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:vvQqKBZGTJtVXjmiolxRL1FOFRedB3WU/C4FE3hMWWRS8d:XQJoXjmZxR1FOS1WUI3hMW
                                                                                                                                                                                                                                      MD5:2E907CD396E91B4D0341495313A94924
                                                                                                                                                                                                                                      SHA1:843DD9A16AFC5B9F0505E3161DD5AD8ABACAC129
                                                                                                                                                                                                                                      SHA-256:12C3152F9B0D1336415D12F976791D199666F79CA8BB8F912A6A5D5F5BE8975B
                                                                                                                                                                                                                                      SHA-512:3B92EBDBB0395DCC2DBD56694EC843D237E9F4C8217BE90735BEB6501E3D8470037907FB529DF24EEA9B83A97559EB187050BF92578F8A5DE543025F56BBD570
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......Eq...............hC.....n-.....n......n......n......n.......o.......b.......................o.......o.......o/.......G......o......Rich............................PE..d.....$e.........." ...$.......................d.............................@............`A............................................l".....,.... ..P.......h%..H...x)...0......@L...............................K..@............ ...............................text...x........................... ..`.rdata..@.... ......................@..@.data...............................@....pdata..h%.......&..................@..@.rsrc...P.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswDld.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):143808
                                                                                                                                                                                                                                      Entropy (8bit):6.219569845615847
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:6laez89XZATaVcq2myvX+QyQj0TLBRFOuKFUuNja06:XmSkvOQ3QXROuKFUuNS
                                                                                                                                                                                                                                      MD5:C64EF8D4E4F2A9B0DC4B1AD10DFF1EE6
                                                                                                                                                                                                                                      SHA1:106EBA7FB62540C133432E1A9A17749235D0C2BA
                                                                                                                                                                                                                                      SHA-256:407416C86C94096644EAA7343692B0BCCCC27D54892ED87E0D279D5A4EF9FE13
                                                                                                                                                                                                                                      SHA-512:B06B39CFC89164E384C377C7949338B3FCA8F25CB9027F2A42A077BDD22495DC91764CEFB605276513873F9EA2E59B88BCD4F36CD2531CA2F587533818545B8D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......S.....t...t...t.....t..p...t..w...t..q...t..u...t.......t...u...t...u...t...u..t...}...t...t...t......t.......t...v...t.Rich..t.........................PE..d...{.$e.........." ...$.r...........X........pd.............................P.......Q....`A........................................P.......L...@....0.. .......|...H...x)...@..................................(...`...@............................................text...[p.......r.................. ..`.rdata...l.......n...v..............@..@.data...`...........................@....pdata..|...........................@..@.rsrc... ....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswEngLdr.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):577976
                                                                                                                                                                                                                                      Entropy (8bit):6.2643292858960615
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:LAJeZj4YDvTpPRYj15KB/nDvgbj4SZoI7:kw4YDLpp5DvgF
                                                                                                                                                                                                                                      MD5:BD0428BDA477738F62A644FF472049DE
                                                                                                                                                                                                                                      SHA1:366D2C9EF6276CF8511A4C72D229FC9999256506
                                                                                                                                                                                                                                      SHA-256:C10FE1373A4DCE6BC226558C5B4A750B8EC0CF4B6E384AE8B713AEC945074A57
                                                                                                                                                                                                                                      SHA-512:02AE8785DD438170F19C13F7F0F717CB5B512EAC224CD90A2CDECABAEFB79972874B29F44201FF52506EB4D563CF3DA124D43144E52AFFBA6B2C56502CED18F4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......n..|*d./*d./*d./..r/(d./...."d./.....d./.....d./....,d./>...,d./#../=d./....+d./*d./.e./....$d./>....d./>...+d./>.p/+d./*d./(d./>...+d./Rich*d./........................PE..d.....$e.........." ...$.Z...Z......@1.........d..........................................`A........................................p...T....(..........P....p...S..H...p)......8...@z.......................{..(....y..@............p...............................text....Y.......Z.................. ..`.rdata..p....p.......^..............@..@.data...P....P.......<..............@....pdata...S...p...T...D..............@..@.rsrc...P...........................@..@.reloc..8...........................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswEngSrv.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):689592
                                                                                                                                                                                                                                      Entropy (8bit):5.825499748168699
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:WUuxN7BcdcQ00L+IJSXcV+6LFPMdV4Fgr:WUuxN1Adicc6JkdV4Kr
                                                                                                                                                                                                                                      MD5:767315BB8C2A574E5B2970F82978B007
                                                                                                                                                                                                                                      SHA1:027840CC78620BDCFA8CDCBB44BB9EDE80624057
                                                                                                                                                                                                                                      SHA-256:0BC479E85FE29DB1A63BB67106E385D93A87A4D1B815379E8754EA3B3AB8B40E
                                                                                                                                                                                                                                      SHA-512:8B1EC54AF977457B49BF0263CA2CA7264B8D7ED58A452DCD519E64689E50480CBB997246626F9DE9F7D1ABF19114335C519D1720584FF0FB722C11E7B2B37252
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@O.....Q...Q...Q.P.P...Q.P.P"..Q.P.P...Q.P.P...Q.Q.P...Q.V.Q...Q...Q./.Q.\.P...Q.Q.P+..Q.QaQ...Q...Q...Q.Q.P...QRich...Q........PE..d.....$e.........."....$.H...........+.........@..........................................`.....................................................|....P..PZ.......;..H\..p)......0...`K.......................L..(... J..@............`...............................text....G.......H.................. ..`.rdata..^s...`...t...L..............@..@.data....'..........................@....pdata...;.......<..................@..@.rsrc...PZ...P...\..................@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswIP.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):144832
                                                                                                                                                                                                                                      Entropy (8bit):6.388420764146429
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:IoTnurwdcBI7vEzEKopHsW4RfnfD3gQUj:IoTurk+I7vEwcR1Uj
                                                                                                                                                                                                                                      MD5:1BBE104F4B7E77B2EFCE36AB7E11FDFD
                                                                                                                                                                                                                                      SHA1:B638866FCBB720225F7B29F9AC41FED4F5EF8BE4
                                                                                                                                                                                                                                      SHA-256:607C8B4E8F9007313E2E4834C6D266951364761DFF5F9C363D52812DF0D500D3
                                                                                                                                                                                                                                      SHA-512:BB2D0EF9EF293B17EEDFC0D37065526BC29A1AF540F9CB1040C51A2035B686EC06EA9B7FDACF645AE030FCB31631FB3E9E5B7110297362C5CDD62979583AE049
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q....b.Z.b.Z.b.Z...[.b.Z...[.b.Z...[.b.Z...[.b.Z..PZ.b.Z...[.b.Z.b.Z.b.Z...[.b.Z...[.b.Z..<Z.b.Z.bTZ.b.Z...[.b.ZRich.b.Z................PE..d.....$e.........." ...$.j..........`E.......................................P.......&....`A................................................ ........0..@...........H...x)...@.................................(.......@...............0............................text....h.......j.................. ..`.rdata...t.......v...n..............@..@.data...............................@....pdata..............................@..@.rsrc...@....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswLog.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):980920
                                                                                                                                                                                                                                      Entropy (8bit):6.583678426018436
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:kMb/4yUlfKZiwi3IC442UVtITJh0lhSMXluwsJMRg0cJWN/L:kMb/4lTwi3X4rUsTQQMRtcJWN
                                                                                                                                                                                                                                      MD5:C186CA948DC47C92220C0A0D14FDD8D2
                                                                                                                                                                                                                                      SHA1:25A19976B11AD45AA3A75F89A80E04B72D02CA75
                                                                                                                                                                                                                                      SHA-256:91AB91FF510ABEF223383933FE230168A6EE988CF2A3EA2CBA7F492E18D11A99
                                                                                                                                                                                                                                      SHA-512:8ABA8EA73530A1C906D924786D046DBCD0F428B9C3DB68A803460D56F5095BA5BF2B32F863255420A3DFB8AAF9EB97A010EB4D9A553796710552B07B3C3544D5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........f%...K^..K^..K^By.^..K^ByO_..K^ByH_..K^ByJ_..K^5uH_..K^5uO_..K^$rN_..K^...^..K^|iO_..K^ByN_..K^.rN_..K^.xJ_..K^5uJ_..K^..J^..K^.xB_..K^.xK_..K^.x.^..K^...^..K^.xI_..K^Rich..K^........................PE..d.....$e.........." ...$.....&.......~.......................................@............`A.........................................|..(........... ..0........q..H...p)...0..h...(7.......................8..(... ...@...............h....q.......................text............................... ..`.rdata..............................@..@.data...............................@....pdata...q.......r...D..............@..@.didat..8...........................@....rsrc...0.... ......................@..@.reloc..h....0......................@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswProperty.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1276864
                                                                                                                                                                                                                                      Entropy (8bit):6.427055831094295
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:8R0nu4K7EfSKJzM+r0Ul+FhT/bTZ4c+78JuFulg5xV:8R0ZK7cSnbTL+78JuFw
                                                                                                                                                                                                                                      MD5:FE831CB0CC7280B5F8F3BE3FABAEA6A9
                                                                                                                                                                                                                                      SHA1:FD637643C6EE04AF35DD3F6B77D2D925DA256DFB
                                                                                                                                                                                                                                      SHA-256:578931C318F87655B5A3B6DF9A8629E4D383C689F2AD1740BAA19872272FE2FB
                                                                                                                                                                                                                                      SHA-512:A36E583BEFB22EECA5ECEF4F6059C0C437566206DBC901B584AF5EF55B4905B92F331CDA99B95CD018D152BAF6CDD71DCBFA367725C22ABA3CDBBE93BD177772
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........la....N...N...NBs.N...NBs.O...NBs.O...NBs.O...N5..O...N5..O...N.u.N...N5..O...NBs.O...N$x.O...N.r.O...N.x.O...N...N<..N$x.O...N.r.O...N.r.O...N.r.N...N...N...N.r.O...NRich...N........PE..d.....$e.........." ...$.x...........................................................M....`A............................................X...8........p..`..........HR..x)......................................(.......@................... ........................text....v.......x.................. ..`.rdata..L............|..............@..@.data....u...0...d..................@....pdata.............................@..@.didat.......`......................@....rsrc...`....p.......0..............@..@.reloc...............8..............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswPropertyAv.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1025464
                                                                                                                                                                                                                                      Entropy (8bit):6.297309406350922
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:kKrxI3KUZENBXchZwx4aolLzct6ZO76AXL7NAyzFUvzLkk:kKrxEZE7XsXLzct/6+L7NAyzgL
                                                                                                                                                                                                                                      MD5:81C33F521BC7143DF6FCD056A30CD750
                                                                                                                                                                                                                                      SHA1:E7F9425DB14F7037D0C217157DDC5A2837B482A6
                                                                                                                                                                                                                                      SHA-256:05BCDF58E1066B27F0A4434410E686901356B502ED78B8A238DD02096AA1D2E7
                                                                                                                                                                                                                                      SHA-512:5B55761D27D2064904F878E730374F43EFC0501A9F0FB112AA6B3B3CA7BF829F4BC458C205249FCCD858728175A78C5F480188D5D46EC00C9CA45E221B31E536
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......{.$.?.J.?.J.?.J.....>.J...N.7.J...I.=.J...K.7.J...I.=.J...N.=.J.6..+.J...O.>.J.i.O.<.J...N.>.J...O...J...K.-.J.+.K.4.J.?.K.b.J.+.C.D.J.+.J.>.J.+...>.J.?..=.J.+.H.>.J.Rich?.J.........PE..d.....$e.........." ...$.j...(......@.....................................................`A........................................."......d#..........h.... ......H|..p)..........x...........................(......@...............h... ........................text...\i.......j.................. ..`.rdata..|............n..............@..@.data...H....`.......H..............@....pdata....... ......................@..@.didat..`............h..............@....rsrc...h............j..............@..@.reloc...............r..............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswRunDll.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4071864
                                                                                                                                                                                                                                      Entropy (8bit):6.477104817928909
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:/MLQHYldPDZwngZmQsW9u0Zj5WhISKT/cZtBoqe3pmv8NdO2DK8thFuNvDbc7yT4:tAvTVW3WpA9
                                                                                                                                                                                                                                      MD5:26001381DEE6DE974F87E7463B07D70C
                                                                                                                                                                                                                                      SHA1:DB5D0564E77C293D38E8FFBBB466B1F20C886591
                                                                                                                                                                                                                                      SHA-256:D46735E39AE8B8FB95F6C55A02C84B6B11CE2CD517394552144DAEC6ABC7C9CF
                                                                                                                                                                                                                                      SHA-512:53BD78ACD63954C65C343F8B7782BA3624758F9EA5B4C7B4BEBB27E5FBAE87FD446BE16981F61589D2C5BF497D51928BC9BB4102135ABB98F9D039D8661C920F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$...........[..I[..I[..I...H...I..pI^..I...HI..I...H+..I...HQ..I...HT..I...H{..IR..IY..I[..IW..I...HZ..I...H_..I...HZ..I...HL..I[..I...IO..HM..IO..HZ..IO.rIZ..I[..IY..IO..HZ..IRich[..I........PE..d...".$e.........."....$..&......... >.........@..............................>.....P]>...`.........................................P.4.....4.4......`>.......<.....H.=.p)...p>.,]...t/......................u/.(...@s/.@.............&.(............................text...z.&.......&................. ..`.rdata...(....&..*....&.............@..@.data....]... 5.......5.............@....pdata........<.......;.............@..@_RDATA..\....P>.......=.............@..@.rsrc........`>.......=.............@..@.reloc..,]...p>..^....=.............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswRvrt.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):163768
                                                                                                                                                                                                                                      Entropy (8bit):6.363037806656051
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:vBLsWn0kWLyArOpNNOKzztCLUpaGen1yAlmQ:pwQqyVoKVCcen1yU
                                                                                                                                                                                                                                      MD5:158BE71612D6A4F4CD64357290069699
                                                                                                                                                                                                                                      SHA1:FF4804FFF0F4B8F9A03A23A9D7329741E6FAFBFB
                                                                                                                                                                                                                                      SHA-256:CD5899195A23018793874EB9908FA6F8B26171F4B9502D70C21BAE993E36C531
                                                                                                                                                                                                                                      SHA-512:F17A123AE445D450A1B2B2F7033C93FD23CC3144B2AA48183D52585570E1C086FDC28FF7DCAD4103530ED0AF77A37D4CCB2B25A90652F1CB27AAF7AA335BCD4D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}q}O9...9...9....n..1....n..=....n..-....n..?....b..=...0h..6...9........e..8...-o..)...-o..8...-o..8...9...8...-o..8...Rich9...................PE..d...y.$e.........." ...$............0n..............................................;.....`A............................................P..../.......p..H....P......HV..p)......................................(...P...@............... ............................text............................... ..`.rdata..............................@..@.data........@.......*..............@....pdata.......P.......2..............@..@.rsrc...H....p.......J..............@..@.reloc...............R..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswSqLt.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1042360
                                                                                                                                                                                                                                      Entropy (8bit):6.565713192863845
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:LdEP9Lo1acyRiR4UmOeBCNO/lcBJgco8ndfIyd:w9sacyRiR4UmOeBCNO/lcgFkdJ
                                                                                                                                                                                                                                      MD5:F31B49A79F0B322CFC78C0A8C1865A6C
                                                                                                                                                                                                                                      SHA1:482ACFC69335A61380E9A3AACCD314B60D5BC9F5
                                                                                                                                                                                                                                      SHA-256:287A37EB6ADCA6F77BCE54C9E67BF800AC73E58FE35BA0478CF07CFCCEC68F32
                                                                                                                                                                                                                                      SHA-512:326AE7A38E53A90906EC50740F4DD65DD9C60C78CB30CE1F7EE148F91E733F135022347367345B92418116520AFDB09711F03648FF2F1BD40D9F660358B88FE6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|*...D...D...D..e...D.dcE...D.dcA...D.dc@...D.dcG...D..oE...D..bE...D...E...D..bL...D..bD...D..b....D......D..bF...D.Rich..D.................PE..d.....$e.........." ...$............P..........d..........................................`A........................................ ...T"..t................0......H...p)..........p...............................0...@............................................text............................... ..`.rdata..Z...........................@..@.data....=.......4..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswVmm.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):137152
                                                                                                                                                                                                                                      Entropy (8bit):6.414678181656969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:aL2eh+yAi1y7kRvozLvehxxLbX+YAvwUZMcJijoHGCEpkhB3Q09P4lvINPFYO6a3:EUw1y62IEMcJgoHGKPQ0W1SPFYO6ah1H
                                                                                                                                                                                                                                      MD5:1CF40BAA81A9E51C7D2787617D914E71
                                                                                                                                                                                                                                      SHA1:972903402D6FA38946C279E87EECEC8A79C6086B
                                                                                                                                                                                                                                      SHA-256:23E7CA735C1A722EAF80B0671DAFA9227B9C1089D2AEDD2C05B38CBAEC01CC44
                                                                                                                                                                                                                                      SHA-512:45AD6BBA9F57C0B5695655F695C075CA72550C529BA3B0C12A4114CBC4F7C143E7B6200BF06A267655CE277CC228F8A3B8F7A8C4121F21BF4806364168EA9694
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\............'......'......'......'......P......................A......................z....................Rich............................PE..d...w.$e.........." ...$.V.......... /.......................................0............`A............................................L...L...........@....... ...H...x)... ..t...............................(.......@............p..X............................text....T.......V.................. ..`.rdata..nl...p...n...Z..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...@...........................@..@.reloc..t.... ......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswW8ntf.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):147896
                                                                                                                                                                                                                                      Entropy (8bit):6.369268892498332
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:QWLRju+j29FQv+kwDbSv94CA7A09An/lEgwIjpdBzkgoQygfBlLR9peUDZZF8w7m:dM+URsPEgfVdBIgygJlLNv8wC
                                                                                                                                                                                                                                      MD5:4418EF2681646D41D504CA90382F8053
                                                                                                                                                                                                                                      SHA1:C488AAB307F73C4509D8931E22E657C8BAD48392
                                                                                                                                                                                                                                      SHA-256:0328A99E9780C7BB0EF40A5AAAD0CFC4A3D501235198DCCDF52DBBEE2DE3C32B
                                                                                                                                                                                                                                      SHA-512:FB2E34F1A35A857667729E93D11EAB153442BCF0BC20EA27CF689C106E354E11F210D96181868123714685440B7836AF958A041DB8CF52F8174A29DB2599DDE3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..uW..uW..uW.C.S..uW.C.T..uW.C.V..uW.C.R..uW.4.S..uW.4.V..uW.....uW.%.R..uW..uV.GuW...^..uW...W..uW......uW..u...uW...U..uW.Rich.uW.................PE..d...|.$e.........." ...$.d...........Z.......................................p............`A........................................p...........,....P..H.... ..H...H...p)...`..|...............................(... ...@...................d...`....................text...{b.......d.................. ..`.rdata...{.......|...h..............@..@.data...X...........................@....pdata..H.... ......................@..@.didat..(....@......................@....rsrc...H....P......................@..@.reloc..|....`......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswavdetection.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1665464
                                                                                                                                                                                                                                      Entropy (8bit):6.58505808775366
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:PK5H09zlH+WKng2Ex3kj5i1Ae/zgc2GWTFisRc:FGNsqs
                                                                                                                                                                                                                                      MD5:E961F757598FD7FC1089225D892F9C29
                                                                                                                                                                                                                                      SHA1:6716E393CFBEE09C312AD1A1A6EFDE7CE9D58F77
                                                                                                                                                                                                                                      SHA-256:9732C6F2CF74663112D59B4C0A50C71054BE715F54D1530F3D4E8B651097E87F
                                                                                                                                                                                                                                      SHA-512:2C5BECAC0DE26C6EB85DC4E448F94FDC2E80C3B940B0FE4233070DAA4293D6DBDE638EAD75021AEB82AC56EF139759C357F3965C033C0C5DA8618DA714B4EE3A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......Z....................!.......?............................................H..=....O.......................#......K..........Rich...................PE..d.....$e.........." ...$............p................................................!....`A........................................p...p.......@....`..h.......x...H@..p)...p..................................(...`...@...............8............................text.............................. ..`.rdata..0...........................@..@.data....g... ...2..................@....pdata..x............F..............@..@.rsrc...h....`......................@..@.reloc.......p......."..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):737216
                                                                                                                                                                                                                                      Entropy (8bit):6.335791667332977
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:avA6rGjCC6SfcAuCn4V2RTj+tvBpaLcSDE2nU+e88qU+:avA6rG8SfEhtvVSQoasf
                                                                                                                                                                                                                                      MD5:F5E3A27D8FF968D29E8550D8D649EFFC
                                                                                                                                                                                                                                      SHA1:4739DF117C64A0AD8988E89AFD1207F1468B71B3
                                                                                                                                                                                                                                      SHA-256:7972471271BD7E7558EBF280390BF0C3E1F9CB86F45F96F66D79A9673195505F
                                                                                                                                                                                                                                      SHA-512:AC1E64D58D3C2DE5418BA21774164FA0161ECB034FEE822B4280901A15343D8084C74B43FAFC95D8D33B1F2C63EE2584187E20F03BE7074AB61EF40D3AD6BE44
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......EZ...;...;...;..E...;..E...;..E...;..E.. ;..E...;...N...;...;...;...I...;...Ch..;...;...:...D...;...D...;...D...;...;l..;...D...;..Rich.;..................PE..d.....$e.........." ...$.....x.......>.......................................`......q.....`A........................................ ...d............@...........k..H...x)...P......`Z.......................[..(... Y..@............................................text...;........................... ..`.rdata..H...........................@..@.data....+..........................@....pdata...k.......l..................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswdetallocator.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):185792
                                                                                                                                                                                                                                      Entropy (8bit):6.406262697699166
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:DxS4xsVK5grB5toAyf8vNwbKdN4W0cOiB0yw7tnj0WUjwt7n9VNqG7piZOHcX23v:kE5gl5toAyf8CxWQiWyw7ywtr9JoOHcu
                                                                                                                                                                                                                                      MD5:25BA92649A7DF2CC5CAB9893C3E9BEF1
                                                                                                                                                                                                                                      SHA1:4F58BE9AF075CD518B28B8D10D5EB148AF658FE9
                                                                                                                                                                                                                                      SHA-256:59C088B852A40CD36D82D4AA2F993967E9D9627C4C442E24F222418CD5FEF594
                                                                                                                                                                                                                                      SHA-512:86BA877376CBB221100D04212312D0A5B99AFE2C0350B1E4D63EB6E35C8B1A6F6622781BF32E17627810D78CF7F63561669B244F7D2A306AE22C9A3C1A2F3C8E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<..<..<....a.=......4......8......%......:..<..>..5........;..<.....(......(...=..(.c.=..<...=..(...=..Rich<..........PE..d.....$e.........." ...$............0.....................................................`A........................................................................H...x)...........?...............................>..@............................................text............................... ..`.rdata..............................@..@.data....*...........~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswhook.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):90048
                                                                                                                                                                                                                                      Entropy (8bit):6.0360667605514795
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:VWKR8asDbZVO3TtZM0+E2t/AJGIew97ux9:V18a0itJ+E8/A0P+o
                                                                                                                                                                                                                                      MD5:BB2EA60064BED37F2114C4973D45DBDE
                                                                                                                                                                                                                                      SHA1:A8FD7DC55315D48C561FD4897695E3CE0D3905D0
                                                                                                                                                                                                                                      SHA-256:8D212DFC2600ABAFDEBE5F2944C68F2A018E94D0AD8A68B1AD3B5EBC64D63CE5
                                                                                                                                                                                                                                      SHA-512:A40043177F07944398AE12A9A44F33A2B36457B5FC9ED6C7E9828D990592FF7894A4C4D06FDC9DA69BB39AF4903AA742D0E95E9C56D801D6A02CD85CCDAA56F8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y.Fj8..j8..j8...J..i8..j8..D8..~G..n8..~G..g8..~G8.k8..j8P.k8..~G..k8..Richj8..........PE..d.....$e.........." ...$.............................................................i....`.................................................$...(....p....... ......H6..x)..............p...............................................@............................text............................... ..`.rdata...).......*..................@..@.data...p...........................@....pdata....... ......................@..@.detourcp!...0..."..................@..@.detourd.....`.......&..............@....rsrc........p.......(..............@..B.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):801216
                                                                                                                                                                                                                                      Entropy (8bit):6.557465028217831
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:vTOz9azyrj8S7oRaWz2Wh0lhSMXleECzB:biKyrj8S0RaVjOEQ
                                                                                                                                                                                                                                      MD5:FD0C3F74A1FB12BB6C9E60C9397BEA06
                                                                                                                                                                                                                                      SHA1:972E5ED343DA5417F61DA67FD59C8B915B6E2F77
                                                                                                                                                                                                                                      SHA-256:3A05B925B821F196A363B720AE433BD36F1F26D12C35E2A7BA27334B92924B41
                                                                                                                                                                                                                                      SHA-512:16E90E3B1613FE3EF1B4AC8368AF86890D2673ADC4E24B6B4B4F85AC3FAE96A1E59D98152AB46BEF4FC8F82B37FD86459F201E8F422A375F100DE6C4684828FC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........,.[.M...M...M...3...M...3...M...3...M...3...M...3...M..m8...M...5t..M...M...M..|?...M...M...O...2...L...2...M...2...M...Mp..M...2...M..Rich.M..................PE..d.....$e.........." ...$............0................................................n....`A.........................................\......x].......p..........._..H...x)...........).......................*..(....(..@............................................text............................... ..`.rdata..............................@..@.data...$........*...r..............@....pdata..._.......`..................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswidsagent.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9136568
                                                                                                                                                                                                                                      Entropy (8bit):6.512511552550919
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:OtTf2yUO8fwn9U0BqwTTvjq2Qgp5oce3s7924z:O9afwn9z8uT+jgpWYDz
                                                                                                                                                                                                                                      MD5:049B61B65C25C6DA23BEC475DB6D3BB8
                                                                                                                                                                                                                                      SHA1:922ECE8C6F428FED254EB38FB2E8EB66AA503BB7
                                                                                                                                                                                                                                      SHA-256:0CFA7BECF350836E4BC6837F82BAE837F35FC7C2143591E9662CCC2991FE8FBF
                                                                                                                                                                                                                                      SHA-512:29BBD77869F93CE73A07B8B414F47A86CBE9F1C29E357C4E144EC3BDB16805ECF84C10DE8108BC0A0DE6EB42E390898891BBC02966412686F419A310899755BD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........$U..J...J...J.R...J.R.N...J.R.I..J.R.K...J.%.L...J.l.N...J.4.N...J...J...J.4.O...J.%.I...J.%.N..J......J...O..J...K...J.R.O..J.%.K..J...K...J...C..J...J...J......J.......J...H...J.Rich..J.........................PE..d...s.$e.........."....$..f..0%.....p..........@.....................................t....`..........................................}}......~}.........(.......$&..H@..p)...........hp......................ip.(...0.i.@.............f.@....}}.@....................text.....f.......f................. ..`.rdata..x.....f.......f.............@..@.data.........}.......}.............@....pdata..$&.......(...V..............@..@.didat..............~..............@....rsrc...(...........................@..@.reloc..............................@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):897464
                                                                                                                                                                                                                                      Entropy (8bit):6.585469857855305
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:GuzQKRd/hD6aoRqWvOdlTvUu9w6MeDO0:8KRVNoRqCgTvh0e60
                                                                                                                                                                                                                                      MD5:C9B99E8A42238C58782090AC7ADF1E59
                                                                                                                                                                                                                                      SHA1:862BDA388A637A674BFDEA8B04ACD644F5494EF0
                                                                                                                                                                                                                                      SHA-256:843EC8E2F2C704C6784604E060D065B64471CD288FDB53A0E97A433013434F32
                                                                                                                                                                                                                                      SHA-512:E4EC3BCB3BA543B86450D5C4A2B9A597B68AAB9007FFC59E81548C6CE07E8EA5CAD9554D1FFBCB6FBF0FEB932153AC407B52614F0ACBB5C3DF62B7E68026F192
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..J<t..B..J<...B..J<...B..J<...B..J<...B...:...B...B...B..=0...B...B..iC...=..*B...=...B...=v..B...B...B...=...B..Rich.B..........PE..d.....$e.........." ...$............P&....................................................`A........................................P...P....................0..D...H...p)..........P...................................@............................................text............................... ..`.rdata..,...........................@..@.data....:..........................@....pdata..D....0......................@..@.rsrc................v..............@..@.reloc...............~..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswpsic.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):480696
                                                                                                                                                                                                                                      Entropy (8bit):6.707834590050898
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:1vMLmHApldDqrKM38hX5UtwewWoAvGe8ph0lhSMXl+of99S:9MLmH8ld+gfezoUGXh0lhSMXlLlA
                                                                                                                                                                                                                                      MD5:B3D128690C1000EDAEDF4E8D1DF3A838
                                                                                                                                                                                                                                      SHA1:58472983C28BB5901EA08BA76F830354FC6A39D9
                                                                                                                                                                                                                                      SHA-256:B165720F197FAE08AA8F58DE5F3BB97697A563AA242B3BC21A04B5B8E86A5BB0
                                                                                                                                                                                                                                      SHA-512:67A785D8012CAD0060AF56B86D4C2C210D520AB39B5D33546EB68B0585954912C455FAE5BD5149690816FA6B3365343EEAC067F8B05674CF2BBE859CF10B3695
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......A....}u..}u..}u.....}u..q..}u..v..}u..p. }u..t..}u...p..}u......}u..}u..}u...t..}u..}t..u...|..|u...u..}u......}u..}...}u...w..}u.Rich.}u.................PE..d.....$e.........." ...$.....P......`................................................k....`A............................................d...D........p.......0...5..H,..p)..........PH.......................I..(....G..@............................................text............................... ..`.rdata..V...........................@..@.data....1..........................@....pdata...5...0...6..................@..@.rsrc........p......................@..@.reloc..............."..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswremoval.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3103160
                                                                                                                                                                                                                                      Entropy (8bit):6.50909223570264
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:mMLfHAldYfLY/VRpaRfFhQ6Ywn72SlHKvMvnsdI0NQvFmt5bHpdpq6mrrfb2uRqi:E4pvx7Ive7L
                                                                                                                                                                                                                                      MD5:A0EF362127E6120A210B0FE8325AF5B6
                                                                                                                                                                                                                                      SHA1:490096DC56B7B375AD853C5099FE66AF43A6E788
                                                                                                                                                                                                                                      SHA-256:476CE4A63A262DACEAF757A6C8EA11C01069A2BB51B1F463EB5A11C7A701F90C
                                                                                                                                                                                                                                      SHA-512:F110F480372AA61AF51B3D8269CFB17A5247087060106E7C97C3EC47C8C78AC812FD36468CF9A1E2C2411CF5BF5F136FAF792D49D08D190AEAF16FDF0AFC8D6B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......aKx.%*..%*..%*...T..&*...T..-*...T..!*...T...*...T..#*..._..$*..%*..)*...D..-*...X..&*...X..1*..,R..0*..%*.. )..1U...+..1U..$*..1U..$*..%*..$*..1U..$*..Rich%*..........PE..d...).$e.........." ...$..$...................+.............................../.......0...`A........................................Px-......x-......`/......@......H0/.p)...p/..Q..@Y)......................Z).(....X).@.............%..............................text...\.$.......$................. ..`.rdata........%.......$.............@..@.data.........-.......-.............@....pdata.......@... ....-.............@..@.rsrc........`/.....................@..@.reloc...Q...p/..R..................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswsecapi.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1805752
                                                                                                                                                                                                                                      Entropy (8bit):6.5395537344438734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:ZML/HbldumfH7aVzuCZJN7gzPnac/Lv3ebBSplDq5IZyQb7uRIVwb:xRuvycIz27qb
                                                                                                                                                                                                                                      MD5:69DACB584EDCA1A21599028E5B2D047C
                                                                                                                                                                                                                                      SHA1:018BF20B2650036B75EC210E3FD497E24F55175B
                                                                                                                                                                                                                                      SHA-256:18FCEB2671D39DC35603BD7A1F8AE9AA31B9B589EAD367A4526C5A6264B4D7A5
                                                                                                                                                                                                                                      SHA-512:EECA5F25C310D130B3759F1216890A337481DBB5321D049EF64B935D3E3B7570BCC7D75DF8A97D6D1CEC5C5FB776783DAEE1D10F69970839365AF01BCE65A45A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......,K..h*zHh*zHh*zH.T.Hk*zH.T~I`*zH.TyIl*zH.T.IM*zH.T{In*zH._.Ii*zHaR.H|*zHh*zHd*zH.X{I{*zHh*{H.(zH|UsI)+zH|UzIi*zH|U.Hi*zHh*.Hi*zH|UxIi*zHRichh*zH................PE..d...3.$e.........." ...$.6.......... ................................................T....`A........................................p/..l..../..................4...Hd..p)......L&.. ...........................(.......@............P..8............................text....4.......6.................. ..`.rdata.......P.......:..............@..@.data....t...p.......N..............@....pdata..4............b..............@..@.rsrc................4..............@..@.reloc..L&.......(...<..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\aswwinamapi.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):124352
                                                                                                                                                                                                                                      Entropy (8bit):6.399802621904294
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Y3LQe5P5SRuojGyV97QHVLlu/QJZh+7QvYUIS3phiYL:8LcuoGyV9cF+4YUI8bL
                                                                                                                                                                                                                                      MD5:FF8572F9B0F0CA4DDD972B998C3C5871
                                                                                                                                                                                                                                      SHA1:235653A2515F90C582331B41C348F5549322CDCC
                                                                                                                                                                                                                                      SHA-256:C3F2509ACE7D14D8AADBEE314B4A5F5C117D16A129D0ECDD85BB998004C59FAB
                                                                                                                                                                                                                                      SHA-512:FE18DAE086853EE2AE19A8551783FB18062C6689529088C3BDF10E1420D3FDB035450375E061329BE1139B7468855D41A529283A94BB4283836D8465A53EBC95
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................L.......L.......L.......L.......L................e.....;...........o............................a.............Rich............PE..d.....$e.........." ...$.@...........B...............................................}....`A...................................................................|...H...x)......<....m...............................l..@............P...............................text...l?.......@.................. ..`.rdata...V...P...X...D..............@..@.data.... ..........................@....pdata..|...........................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.71364264787421
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:+OAWAhWeW4pICSjRof0cVWQ4GW/gYbOEU+9YX01k9z3AWB2c:+jWAhW82xlcdUOQGR9zBB2c
                                                                                                                                                                                                                                      MD5:0909E61C8C9C717976828F65C987E5F9
                                                                                                                                                                                                                                      SHA1:B5AFFABB8AFDA55EBB1F404EDAB69C6C239AFFE6
                                                                                                                                                                                                                                      SHA-256:03FFDB036329A25BEACF905D62611A13E3DFDDA6CBD2D13AF830258E8CF40EC0
                                                                                                                                                                                                                                      SHA-512:7F78746E40DA64631C08D0E173FBDEB40BEED180932B42382D9F3AC0CDB4348D2A5B1C29770BB98F5D4823CFD66ECAC2285AFBCAF109F82C8B75C7711F10C49D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...B4............" .........0...............................................@............`A........................................p...,............0...............0...%..............p............................................................................rdata..t...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.745792799529898
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:p9qWAhWGW4pICSjRof0cVWQ4iWnYU7h+Il+jX01k9z3Az3TzRL:mWAhWk2xlcQtEjR9z83/RL
                                                                                                                                                                                                                                      MD5:6B33E6F1D77CEC0901EA8E91473BC18B
                                                                                                                                                                                                                                      SHA1:A397D2C6AEAD0B3E57D413A8D4AF7F28E67F4166
                                                                                                                                                                                                                                      SHA-256:449631A3F5FADEF72ACC2C2F84765208D0CA014EC1FE93FB9AD805EEC1D40EAE
                                                                                                                                                                                                                                      SHA-512:8F5214E38202719F6A7549B2B97AD24288974CFB6CF0DA1E9EEC5B3B2092220F2330A260B17E28AFA90B90226666A765A4E64FE91107E2063CDE8E285F64773B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....=.........." .........0...............................................@......n.....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.569418929626657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:JWAhWSWCYtvnVWQ4WWd/q+KKnAX01k9z3Adaoy:JWAhWtCqTKAR9zsao
                                                                                                                                                                                                                                      MD5:2B4A3A51E075AB9819C6D6BC40EFB4B5
                                                                                                                                                                                                                                      SHA1:BC52C10DED8B087C73229DC2F98714B5A368F521
                                                                                                                                                                                                                                      SHA-256:D718E1B6C352112C2F8E36B4BA5ED28E6179257FD2FE944C4A0D404B5C15B5AE
                                                                                                                                                                                                                                      SHA-512:13B07DC2247D51DAD1AB9BC7DF93E0D3E1BD6CC4FD16F9AFF87CEFFD40A56933D569A5FB82177DEA7B6EA04EBF9F909F95451D123126155A13DE6A85F747C592
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...FBe..........." .........0...............................................@...........`A........................................p................0...............0...%..............p............................................................................rdata..X...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.566717694457395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:YWAhW+W4pICSjRof0cVWQ4GWk2QYIN5vCX01k9z3AiRDZXobo:YWAhWc2xlcSbUJCR9zdRFX1
                                                                                                                                                                                                                                      MD5:607703B245D9B4FC69A8B5363FF626FA
                                                                                                                                                                                                                                      SHA1:DCF4626787EA220B19E08CC5BF9E55553A3A2AEF
                                                                                                                                                                                                                                      SHA-256:F65B1B3EA2767F98F0C29118E85B06F4E61654BEC34B60B3ABB593B24EC29AF4
                                                                                                                                                                                                                                      SHA-512:92D761F733F2C678946894CA72459B0E6DC62CD3ABE1073653104689AB48C19603E6E1109C07B2F110822B424430F22D112F87C629B99D0B3CCC16E179549628
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...@4............" .........0...............................................@......3>....`A........................................p................0...............0...%..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.615131561223465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:9f7xeiIFRWAhWWlReaLMB+6R9zqoHLdg5CG6:EFVros29zlacj
                                                                                                                                                                                                                                      MD5:059129BAE1776F03C59D3BA66A6F6DEE
                                                                                                                                                                                                                                      SHA1:33B1DBCABA1D16EAF5413F1378119CECC1298724
                                                                                                                                                                                                                                      SHA-256:A83AF0F79ABB5E5C818C6F38A38DA80E531081F3255CB006ED4C29635CC0B9CE
                                                                                                                                                                                                                                      SHA-512:6A7DA7E58620BC1CE4B6D3CAB1E0B746FC9FCF05A84D85931F845412301880786FBC63B31611D9442B5A1CFA72558966375EF14EDC749473E2B7C988DD20B675
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......v.........." .........0...............................................@......2M....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.554332090212878
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:nWAhWqW4pICSjRof0cVWQ4GWGjwUBuvdOEU+9YX01k9z3AWW9q7fUV:nWAhWg2xlc7BulOQGR9zBaqjE
                                                                                                                                                                                                                                      MD5:9FA3992F5DAC5EA5DFA15B9669C68154
                                                                                                                                                                                                                                      SHA1:A453FB6C4064DA8C01AD03A4EA3C0434EFE82635
                                                                                                                                                                                                                                      SHA-256:9057131F628E547C14754D545140AD6544E64606358104DA50841E9A1B03F442
                                                                                                                                                                                                                                      SHA-512:AD73F3952DDA55CFAA6A0D6A0233DF785650F5965CAA4859B6C1577E3FBD6020E60B4B26338387690CC48B16A186D2B530708A71D2671AB17EE8904399DE292F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....cc.........." .........0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26080
                                                                                                                                                                                                                                      Entropy (8bit):4.837118118155243
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:1NtaNYPvVX8rFTsfWAhWBW4pICSjRof0cVWQ4aWJLk4xOEU+9YX01k9z3AWBwCy:rPvVXBWAhWn2xlckOQGR9zBBwb
                                                                                                                                                                                                                                      MD5:817F9A76B7EADC1226B006CCBDD38A11
                                                                                                                                                                                                                                      SHA1:8B81897CDD4D48BEFA389C1DF2D0B887FFEB58CB
                                                                                                                                                                                                                                      SHA-256:99ED148FFBB35829480412DC64DA6AD24DFABE2F9A0EFF9BA1493455D7127677
                                                                                                                                                                                                                                      SHA-512:53D8B2561862C6B2465665D761612AAA8B7ADC887058260FBF970AAC0FB006317283ADA01468B1E042FD9DD44DEF90451793AFEE297ED787086645CEBCE45CD2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...!..e.........." .........@...............................................P............`A........................................p................@...............@...%..............p............................................................................rdata..L........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.585310852882511
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:hsIkWAhWW7WCYtvnVWQ4OW0mOOt5equ/X01k9z3AFpYlQ:h9kWAhWWCK56/R9zgWy
                                                                                                                                                                                                                                      MD5:E334F2FE1E0E6D5D6966F139ED328D97
                                                                                                                                                                                                                                      SHA1:68B2CD826F3DFA59531397EBB3F382DEC9AF5FE5
                                                                                                                                                                                                                                      SHA-256:D56EAE93C55ABDC8EB77D132777049634E28A9B59FD4B2101D51351546B984D1
                                                                                                                                                                                                                                      SHA-512:FB6EE02F06447C906A4353D93CE247E14A9A1EA4255819A88E395AFE2E3775FE3AEB622B7A97D86086D88C739BA4D2E2FBA9E8FD6467E167FC75D595C9182327
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@......~.....`A........................................p...L............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.669696963438038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:iCuWAhWGkW4pICSjRof0cVWQ4iWwLuCFaqDu0K9X01k9z3ATd83:zuWAhW/2xlcuCFYj9R9zsdM
                                                                                                                                                                                                                                      MD5:7F0EF1CF592D04B082B65F75584652CD
                                                                                                                                                                                                                                      SHA1:F7B9A2851A66A6A8EB509F2541B6CCC3B551F2FA
                                                                                                                                                                                                                                      SHA-256:9F496E181B1C862C7A7D03C09D9B0A5361535C98ACBB1A9D50A27BCFB0A2BCC5
                                                                                                                                                                                                                                      SHA-512:30D2D695773E7BFD67DE8691C40E571B3B91858E72EAB3D78C84902B359108E9988247BF81689AB15FEF6ED0A9EF62031F1937C6E7CE4CE8E1A34970BA23E727
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....mR.........." .........0...............................................@....... ....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.587345105035237
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:jPWAhWWMhWCYtvnVWQ4OW8vpgVt5equ/X01k9z3AFpT46cuwY:jPWAhWWMAXp456/R9zg5Tcu
                                                                                                                                                                                                                                      MD5:1902B85A588178857E9637902E5A1B85
                                                                                                                                                                                                                                      SHA1:31AE4CF76A34CCBD92FDBE60BEE080998741EF4D
                                                                                                                                                                                                                                      SHA-256:5E48C99DD6318B017686BDE507CDCB9D6ECF25F4F78F345845B865E443F1EE66
                                                                                                                                                                                                                                      SHA-512:0755E9C0ADC9E374060C851D4F7FA62633EC07DDE0BBFD56FFC9BC8ECFF5B9EFD6FA8418C43E838770EED43A54A48FD61A41226D9EA84834275A4A36C7796472
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......0.........." .........0...............................................@...........`A........................................p...`............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.702065061071228
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:UxlwWAhW8sW4pICSjRof0cVWQ4aWQVKbOEU+9YX01k9z3AWl9:UxlwWAhWV2xlccbOQGR9zBl9
                                                                                                                                                                                                                                      MD5:892E47390F34AAC7D20AFE63FFA92F20
                                                                                                                                                                                                                                      SHA1:4A78A77AE1D5BDBA55534167F781A3C8675C7ED3
                                                                                                                                                                                                                                      SHA-256:6070FFB5E20ED032D460D323DF981D369FA68045FAB130FD100803A00AB88C23
                                                                                                                                                                                                                                      SHA-512:8B37866EBDCA5047673D984BD779B1DF052E3D44E3FABC3A4CE2E747489BAA2BD86ADD629D95C76CF08150F74281D89D46372EF64266B90304CF7DD581AF3A93
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...)\Ix.........." .........0...............................................@......^K....`A........................................p................0...............0...%..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.616496394521552
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:aDWAhW+W4pICSjRof0cVWQ4GWgQirmYIN5vCX01k9z3AiRYCj0+y:aDWAhWc2xlc1frJUJCR9zdRYn
                                                                                                                                                                                                                                      MD5:D8999E328AF5EE1EB23C216336637CB7
                                                                                                                                                                                                                                      SHA1:A7BDE6C833E4D6DDEFCC4050997B1583FF1FFA42
                                                                                                                                                                                                                                      SHA-256:4EA02B683513A157E21824B1C1E9EBB782D22F14209B67961F97B1F79673D3ED
                                                                                                                                                                                                                                      SHA-512:4F041ED2DAF781B7F86B4459E74330650B2687EE46DFB961ED7A0716AC7AD2082A631CB619CC6D3C7D19F550BC030553B9656AEBA14F969DD52DF0B40A0E418F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......d.........." .........0...............................................@......|.....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.839363272167962
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ETvuBL3BBLRWAhWWfWCYtvnVWQ4GWPMk07iK2YdX01k9z3AcxvEaJcmIF:ETvuBL3BHWAhWWGvXgwR9zvsuE
                                                                                                                                                                                                                                      MD5:6337654372AA9ADF6A8FC97D9676A33D
                                                                                                                                                                                                                                      SHA1:B790F4828E7AA18CD0EAE77E78C67DDD66F3EC5E
                                                                                                                                                                                                                                      SHA-256:6FC551CFBCAA0F90ED24DD09FA117E9FB3B6755A3FC0251D33CA64862A9A3414
                                                                                                                                                                                                                                      SHA-512:4A888D71747C64CB4A964D8DF956C5ED9E3DE9E8CF30D804E3BA76E8C35502E1802423CE527A419935B0D8C8E4C0F6168657B2734AB79D01AFC946521A88D528
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...P.1..........." .........0...............................................@.......6....`A........................................p................0...............0...%..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):5.324569432191895
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:RnaOMw3zdp3bwjGzue9/0jCRrndbDWAhWWVAKwR9zvhQ:gOMwBprwjGzue9/0jCRrndbPJM9zG
                                                                                                                                                                                                                                      MD5:D4BAD006E413ACE7D729B1249C49B92F
                                                                                                                                                                                                                                      SHA1:CF0DFF1B371316C8517619FDEFF81C583268BAD3
                                                                                                                                                                                                                                      SHA-256:245D48BFCE5CF6E9C5093E995D6AB5988E2401D32530FD6863BD5F8FD688D780
                                                                                                                                                                                                                                      SHA-512:D1A5001633F1CCE60DB2687DA28706F66644613672FA8487B065E3AA8D77DDCC96D9272C665D894B243E222E1C104BE10BE1DFF8E5D007490E50F2BD2A708D0F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....3..........." .........0...............................................@......aF....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.731117607281418
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:FqPWAhWnW4pICSjRof0cVWQ4eWsxiRh+Il+jX01k9z3AzRf:F2WAhWl2xlcJw3EjR9z8Rf
                                                                                                                                                                                                                                      MD5:714E850AA29E808568933C5ED8C7DF5A
                                                                                                                                                                                                                                      SHA1:AD84833BCAC69B5217705E1C4D33D54C856525E1
                                                                                                                                                                                                                                      SHA-256:4A244EEA4596EBDE0F9094CC6DFEEB5ABB3C4385225BB0630EF55A431FE1C4F2
                                                                                                                                                                                                                                      SHA-512:3A220AD4E2FD49F40F7FE5FDFC53608B114661F31993C0329E993C5D733B6D6F3A366EB46F93AAA9D5CAD90766B21D85E5CCD09CB9C5AB905118D70702A3ED11
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...dIx..........." .........0...............................................@......A.....`A........................................p...l............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.6757492996691825
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:8WAhWpW4pICSjRof0cVWQ4iWa1O7IL0sAWAC/X01k9z3A5S0tL:8WAhWv2xlcTO7XzC/R9zuSIL
                                                                                                                                                                                                                                      MD5:9AD2E67F2B1F04B760DEB00B889FAB53
                                                                                                                                                                                                                                      SHA1:465314C9BDD359840F7DA11A619AD0B409C271D8
                                                                                                                                                                                                                                      SHA-256:5662035361E37F6C5E4A5A19DE134DF2EC20BD4C0F1BE803203B37C95EE61265
                                                                                                                                                                                                                                      SHA-512:CDB358848D48CD3913E7249EAA45470BEE4BA9F9D92D975215018477A57DB930C16B349541DA2D82A2F9131220EC3B3CF9FF471CA411C2F705BFE916E8736BE5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....2............" .........0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21992
                                                                                                                                                                                                                                      Entropy (8bit):4.858532007429405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:eF3aWAhWaW4pICSjRof0cVWQ4mWBSMyEBsvH3Tz7PX01k9z3Aeu6C2m+fmBfNUJP:eFqWAhWQ2xlci72vH3rPR9z/unVhBf4P
                                                                                                                                                                                                                                      MD5:772D6C07E47E77A4479C7A9ECCFEAC4D
                                                                                                                                                                                                                                      SHA1:B88DB71FC80EB57182DB6DC6AC00B022E1E47CB3
                                                                                                                                                                                                                                      SHA-256:2C9A8F8D47B49D04A82E8E689AE9F6552482B1861EB8398F3733E97327191C2A
                                                                                                                                                                                                                                      SHA-512:F87BB803E818372F57319AF97227834673CCE9988C81FFD4A3D1C6D7038C6F7398E06A7133A17F063CAE152AD27666A6D18F87ED77BB46DBE141C1272BC3AC84
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@............`A........................................p...H............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):5.203730016113422
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:1ck1JzNcKSIGqwWAhWX2xlc4VEOQGR9zBxOwJ+Go:5cKSjy2xeOQ69zDz5o
                                                                                                                                                                                                                                      MD5:9AC788A87032640E046F305413585503
                                                                                                                                                                                                                                      SHA1:41B74CECF0F78134204DD3D8AADDFAE34D6AACBB
                                                                                                                                                                                                                                      SHA-256:363825ADB27D5A5BD249FE58460A977077F823E50DAC7509E124FCBAC1512128
                                                                                                                                                                                                                                      SHA-512:CC725796AF3F7793CE6E6FAA96A201EBF5E77ED00DFAC3211A66A95EE071E559C9EFB8E47AE0287D9CC1FEDED559000A582A2138736AB8C628325428C78E648C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......Y.........." .........0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..4...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.7606594391551855
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:E8QpUwzDfIe+WAhWhW4pICSjRof0cVWQ4WWVPsUuks9gICQX01k9z3AbgHb:EtDfIe+WAhWH2xlc2UUu/P/R9zJ7
                                                                                                                                                                                                                                      MD5:31F60BF9A22A86CB8879FCE5C1022254
                                                                                                                                                                                                                                      SHA1:23CDAA4D6AE0E953D083B968558A2AF49BF95A4F
                                                                                                                                                                                                                                      SHA-256:53AFAC76A7124A132A7C11261F3B6BA8D6A5466E7E8F683C8D12AC370B7D6B62
                                                                                                                                                                                                                                      SHA-512:C41EBB39CC0939B38D788B692E75C10C78A806CC8844D8526FF25869777EEFD086518CFD817EBB700E20B3937401D6C0F7F506BCD479FAFE1B801507376F4BA6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...%p_W.........." .........0...............................................@......\.....`A........................................p................0...............0...%..............p............................................................................rdata..,...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.550817141020882
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mWAhWWEWCYtvnVWQ4aWenDvWrkAmSGL16X01k9z3ANoziLtpWuhO6Mr:mWAhWWfVLMB+6R9zqoziLtC6M
                                                                                                                                                                                                                                      MD5:948E3C479E87AD905A3689BC94CBF86B
                                                                                                                                                                                                                                      SHA1:C9B2DCC45FEB9B0BCD52122B51ADF98D7FA5B0E5
                                                                                                                                                                                                                                      SHA-256:982FCC32D7614CB921CC5203970E3997A33B31AA1D91F14DB5DB25A582DCC3AF
                                                                                                                                                                                                                                      SHA-512:6F15478BA5E7B403580B4B52924866E52ADCD112D82900DD17A2CE67EFA10306A5A86E1BA5CAB76BBE3577E2497B83ADAFD6CF6C39A81C35B53B528E8BF6B440
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@.......#....`A........................................p................0...............0...%..............p............................................................................rdata.. ...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.718338890121096
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:MGeVTgqWAhWACW4pICSjRof0cVWQ4iW7WsWGaN4NhrJgX01k9z3AiP7t3t:MGeVTgqWAhW12xlcRTN4tgR9zBP7t3t
                                                                                                                                                                                                                                      MD5:57745A06849D90CD5C79CCBEC559E7B5
                                                                                                                                                                                                                                      SHA1:71D3D3C0998E648EF6B061F7C65850C6A2A8593E
                                                                                                                                                                                                                                      SHA-256:890DBB72C4C35266BD658C663C1242CFA3B50CF51E2873E986B7AB2E055AF4A4
                                                                                                                                                                                                                                      SHA-512:CA28053575E40EB805F366A7363257B3D40A6FA8EF46FFB5B58FF17CFB0EA2668F5CDF2661355E94866B73B914950C09940F5C32FEF5F9A22439932E35391DCA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....C}.........." .........0...............................................@......L.....`A........................................p...<............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.62677676857865
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:90yyMvJWAhWWJWCYtvnVWQ4GWuqhBf3kDvWrkAmSGL16X01k9z3ANoELjLDH:tyMvJWAhWWoGf3kLMB+6R9zqoELz
                                                                                                                                                                                                                                      MD5:1862F49D5C2BA7C2BBC78BC517CB0B38
                                                                                                                                                                                                                                      SHA1:DBDCA39D6D9D166F9CB5B8855D456653419136C2
                                                                                                                                                                                                                                      SHA-256:90BA9DA43D6705D76905E630505BD1FD097D1899C9BCA3241AD0DE5AB08EE366
                                                                                                                                                                                                                                      SHA-512:C9C85EC2851F5B793DE07E672365E6DB28F1150ED6B6057D15BE828A36029F4BA9E0D4CCE12C7D424DA4C94713C18AE256D9ECBA9E59AB88AF639ADF56ED6A3B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....%fN.........." .........0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..<...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):5.111227798238419
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Xgwidv3V0dfpkXc0vVaLXWAhWWMMHNwR9zvoM:wHdv3VqpkXc0vVa/jM9zQM
                                                                                                                                                                                                                                      MD5:AFC4DB1AE7EB74D1B43EDA3D7EA5B43C
                                                                                                                                                                                                                                      SHA1:F31B2C1161024EC2F89C72631631E11FD5CEAC60
                                                                                                                                                                                                                                      SHA-256:FB4B382E2DFA80B3427A98C51D3270B1E80B5C2A10FDAE1A72B7C464E57FC6A7
                                                                                                                                                                                                                                      SHA-512:A014E4BBE207FD707A87AAA0228241FA7C414062AF8922F51E46210B958284096357B21F89E59141FEF28039A999DC6AC832EC7FC38BC4895E88FBED6B9A45A0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....>F..........." .........0...............................................@......_.....`A........................................p...X............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.7995619414217705
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:YtZ3ZtYWAhWWaWCYtvnVWQ4GW24LBiK2YdX01k9z3AcxvcXN:YtZ3gWAhWWV0qwR9zvUXN
                                                                                                                                                                                                                                      MD5:5DEDF9F86BA1366D9E920F33EB03721C
                                                                                                                                                                                                                                      SHA1:605312CE6D623889A1D404354EE653414A7E4920
                                                                                                                                                                                                                                      SHA-256:0CED53F1AC2ADC9525047D2C2A7592300DC48A5F52AD8B740CE22E3F3AAD85FF
                                                                                                                                                                                                                                      SHA-512:BED8C7A74E57F4CD44BD0EDBC1BBB1F528CE261D7AD6A5545C33974C223BA910D648F0CBEA8BF0736DEB5AEDD3B257F373CBBC4F9765D12C56A78E823D05D4B0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@......u.....`A........................................p...x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.858100199217766
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:NgdKIMFemVWAhWLW4pICSjRof0cVWQ4iWY3FsIL0sAWAC/X01k9z3A5V4xyFss:iHUWAhWx2xlcIXzC/R9zuV4a
                                                                                                                                                                                                                                      MD5:177009944EA3860B58C09DA1871DB999
                                                                                                                                                                                                                                      SHA1:01CF9CAB3AEC3A1EA89111269F8CB036E73916D6
                                                                                                                                                                                                                                      SHA-256:F353BFE02E30F4FD5CDC89BD7F44703257F229A09F0D815D7794DF902F67D1A1
                                                                                                                                                                                                                                      SHA-512:279D1E663ECC151DD2DD15462191EF41E668C7A2BFCB7930B8D568FACF7695A030948C3AF7F9907226B00DEDE255A7F30169083AE2CE544F2381548DB31C9981
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......d.........." .........0...............................................@......A.....`A........................................p...H............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.793237988742561
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4cWAhWJW4pICSjRof0cVWQ4GWoyVyNOEU+9YX01k9z3AWneGG:4cWAhWP2xlc/zNOQGR9zBhG
                                                                                                                                                                                                                                      MD5:70F8ACDE94E2C3952B7BA7F56A4EBFB4
                                                                                                                                                                                                                                      SHA1:955064391F0C9B41362CDDBFF7A070AB3888AD3E
                                                                                                                                                                                                                                      SHA-256:91DECDDC6E80D742755A1F65261D10C3C0D059AAEA6389BB2DA6FD3AA7EC5289
                                                                                                                                                                                                                                      SHA-512:71087A283D560F08E43B1A183258F1153AB5091D5D318CF4EE0FC8385285592C377D8E68A0F06D3F0BE84202AAD6DC7376B56057E23B6B3753A445323580F287
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@...........`A........................................p...H............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.57424834373488
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Q/WAhWPW4pICSjRof0cVWQ4iWTO6aqyjNq5lOeSjX01k9z3Ar1oRBcv:mWAhWN2xlcz6aRj05seyR9zI1oLk
                                                                                                                                                                                                                                      MD5:D91E6C55A2304AA59D24E76F34884535
                                                                                                                                                                                                                                      SHA1:04EBC0BC4932C09C3DC7D9259FE7C9A6166B7233
                                                                                                                                                                                                                                      SHA-256:8875816A3809753C04ACD961244608E9A47127523C1D5E50CDDBD83A4627821C
                                                                                                                                                                                                                                      SHA-512:19C1E2458C5475DE2B41013FB18DCF3D149C88C0B3816596B67C90F7BDCED3D5214FEA97DC3782F56F8A276F93FD28CF519018257BF432C00435EF6BAE60A8B9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......#.........." .........0...............................................@......Fy....`A........................................p...<............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.887102104227407
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vUWAhWDW4pICSjRof0cVWQ4WW4O1Jks9gICQX01k9z3AbgmZt:cWAhWp2xlciJ/P/R9zJmZt
                                                                                                                                                                                                                                      MD5:A1BEE0AF7BD944FAE7F14174D9DFDFFC
                                                                                                                                                                                                                                      SHA1:EA699130CD63857569BF34826B9CBCB5ECFA1A21
                                                                                                                                                                                                                                      SHA-256:2C557F6A21DB6C99AF6184637B5EFB57E44B40FAE892230A43E96AB05AB27D40
                                                                                                                                                                                                                                      SHA-512:C6E9473EC6CDFC0BDD1B8F9F42BDCF3D31855B6E106B811CA52D2ECA895328889451726FE12ECAF0AF9A238D74C10E79BCF0870F056E7E85CCDB9BE49F4515A8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...8.?;.........." .........0...............................................@......N.....`A........................................P................0...............0...%..............p............................................................................rdata..@...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26080
                                                                                                                                                                                                                                      Entropy (8bit):4.85347828224575
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ljQ/w8u4cy1WAhWfW4pICSjRof0cVWQ4GWSYnuC1/or7o0X01k9z3AntFe:dy1WAhWd2xlcyF1Z0R9zMtk
                                                                                                                                                                                                                                      MD5:B9D80EFA3F5B0B75C523D4CED4DA1FD2
                                                                                                                                                                                                                                      SHA1:F493358454A273D0DDC6467C9AD82BF460DCEBC2
                                                                                                                                                                                                                                      SHA-256:44EBDE7F2681C0B8518E55CA242261B24F326994F089A4EF6C060F8DDA04D62D
                                                                                                                                                                                                                                      SHA-512:D597C0E7C5309B9631966B01FFF7E166C0DD0FC9D63534D588D47F9DEEE593CB2CF79CD490145AEFD472B9493DD65144E875D5870742C8D09FA4C7D459259FEB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....A............" .........@...............................................P.......Q....`A........................................P................@...............@...%..............p............................................................................rdata..>........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.703414053422508
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:WLGju+OHWAhWUW4pICSjRof0cVWQ4iWd6yjNq5lOeSjX01k9z3ArH3Qsscj:WLGjuJWAhWq2xlc8j05seyR9zIXQss0
                                                                                                                                                                                                                                      MD5:6E245FDD89BB6F88F56784ADBDCA0B0A
                                                                                                                                                                                                                                      SHA1:9AC5D68FF969F984F74E6A8CDED8E683B98FFA36
                                                                                                                                                                                                                                      SHA-256:0E195A8D013A329A06DF877A4569A3EC772F112AD29295F086C6D3E53F322FB5
                                                                                                                                                                                                                                      SHA-512:601248C38540DCBDDD61FD26203DF39EF5D450827570F01CDF0E415873E098913D82CA6E3C7B21A9BCAE267B4CB67E970237CBD1C6320B8FFAB58C9FB675A3CD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................." .........0...............................................@......]g....`A........................................P..."............0...............0...%..............p............................................................................rdata..r...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):5.167040098082105
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:SSnWlC0i5CtWAhWWLWCYtvnVWQ4OWfwNv7JGlD/Jn9VOMbSX01k9z3AW3c10cBr:SSnWm5CtWAhWWyjGlD/LVNSR9zl3+r
                                                                                                                                                                                                                                      MD5:E4FCBF91666504C1EB70644DC4C5F479
                                                                                                                                                                                                                                      SHA1:BF96622C082EEC928920A052BFF477CB0C9E0573
                                                                                                                                                                                                                                      SHA-256:58D9A9B2442C10140DB98BA705E8C7B7B9AC5A2C030D3286A66DEBF63B615C1B
                                                                                                                                                                                                                                      SHA-512:9DD34F36144010B3C1400ED1B1DB8AC8E97997A0D2C803858ABEACA75E26D19DC56512714B566EDEE581CA20C813C3CAFD47A3F774A1596B31E23208B1EEE4F5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......0.........." .........0...............................................@............`A........................................P................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21976
                                                                                                                                                                                                                                      Entropy (8bit):4.830942356399538
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PcFY17aFBRYWAhWWjWCYtvnVWQ4GW5zwDvWrkAmSGL16X01k9z3ANopLOID2GxED:0Q1WAhWWKEwLMB+6R9zqopLOXiED
                                                                                                                                                                                                                                      MD5:374D505CED3719D875AC316CE365B1D5
                                                                                                                                                                                                                                      SHA1:24DA4D65EB7A9116C626BF16C3BC95B563F10176
                                                                                                                                                                                                                                      SHA-256:1EDF013E890072987B8957B77BAECC37140BC01581E5DE6B020AE454BB57F8BF
                                                                                                                                                                                                                                      SHA-512:D9B82D1679AFD85C660EA985D6F57CC13FD35B4D7B8104C6D9CE1F182789B615A573B68D5F1DA6C25682CB35068AE0AAD3C1C9B4509F339FA1A83A9EEB7F74CA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...G..d.........." .........0...............................................@............`A........................................P................0...............0...%..............p............................................................................rdata..f...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22000
                                                                                                                                                                                                                                      Entropy (8bit):4.790530283361049
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:98iWAhWsWCYtvnVWQ4iW0ClCFaqDu0K9X01k9z3ATdqheuRp:9tWAhWHqCFYj9R9zsdq3
                                                                                                                                                                                                                                      MD5:152925BE0E3A0FF77B0979BCAE7A7583
                                                                                                                                                                                                                                      SHA1:4AC4BB649B42893A8D5BA345A1C92AB2DDD1DDDE
                                                                                                                                                                                                                                      SHA-256:2E23B53441BA6B0779B222C120D44EB9A156D55CC3648F76216017EF06F9A16F
                                                                                                                                                                                                                                      SHA-512:17B41057B82B1EB037A59715970496D402AC00A59FCBE67245203F117FC38F1B7E7F5B78872850AC4FD7A5DCF4A3EC561DFDB3FB0E827EC7043978B535E9EE26
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....h\..........." .........0...............................................@............`A........................................P...e............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):30200
                                                                                                                                                                                                                                      Entropy (8bit):5.109996502126957
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:RQM4Oe59Ckb1hgmLJWAhWP2xlcACl8R9zni1c:KMq59Bb1j9+2wlQ9ziC
                                                                                                                                                                                                                                      MD5:BF69D049653E504A7A1F8B55A6DDE7BC
                                                                                                                                                                                                                                      SHA1:737A1CBF1FDDC0AE93A0A99D2FEDDD474F4B85BF
                                                                                                                                                                                                                                      SHA-256:E6E839C6D205F91ADAA3D980F843BAB3131B8A25E06D152D0F70A6E98FBE0FB0
                                                                                                                                                                                                                                      SHA-512:A8D834D46FCAF03AA53BD48B4CEC816E0FD599B06B16A14006E402BFAA5A470F47DC6A55C1A94314D635AF55FF2322EB242B0C535A02FC830DAC83E375ADC6A2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...J..R.........." .........P...............................................`.......C....`A........................................P....%...........P...............P...%..............p............................................................................rdata...&.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):30200
                                                                                                                                                                                                                                      Entropy (8bit):4.939072825452394
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:TA/kPLPmIHJI6/CpG3t2G3t4odXLJWAhW42xlcdxql8R9zni2:k/kjPmIHJI6fF2oxqlQ9zi2
                                                                                                                                                                                                                                      MD5:4847091828AD3B0734418343C712CFFE
                                                                                                                                                                                                                                      SHA1:24E69B32DBA65631B92493B7AABD68D141CF21E3
                                                                                                                                                                                                                                      SHA-256:D9388848EBFE27138998518332BB507E5DBEB1D8851E9ED0300F15E14B6958C2
                                                                                                                                                                                                                                      SHA-512:5E8061CC226F3471E3964C04CDC5FBD3A607C9ABD22A11A1E818EAEC42B20AE873FA80CFCE7F47B8F8844F3127CE98282C737F25666D20DED47704E0DB6F29E3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....T............" .........P...............................................`............`A........................................P.... ...........P...............P...%..............p............................................................................rdata..D".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):75232
                                                                                                                                                                                                                                      Entropy (8bit):5.192576382674742
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:SLraHgDe5c4bFe2JyhcvxXWpD7d3334BkZnjP/22jzzq:IaHgDe5c4bFe2JyhcvxXWpD7d3334Bkm
                                                                                                                                                                                                                                      MD5:533B418AFD2EF8E423F42D414CDAF5EF
                                                                                                                                                                                                                                      SHA1:09D3A595BAD8F0E7AB5604FC02EF832D11A26B88
                                                                                                                                                                                                                                      SHA-256:66F910721F4477EA238603E5C14C858D1E26FC2CEAAB3B48294CAC069790202C
                                                                                                                                                                                                                                      SHA-512:EB73C82A91CE67F8D0265AC4F0739849E5696EC0069AB6508660368B8D382A230DC88EEB89AACF8BC9FC6B7E31C009521FDEEB979F4EBE6E80CFEC083129CCF1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....+..........." ................................................................$u....`A........................................P....................................%..............p............................................................................rdata..............................@..@.data...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):4.844044363530328
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:gadyqjd7VWAhWTW4pICSjRof0cVWQ4GWtv8YIN5vCX01k9z3AiR3Kjc:gaQUWAhW52xlc43UJCR9zdR3Ko
                                                                                                                                                                                                                                      MD5:DC3FE259A9B778480C2405FDD7405C9C
                                                                                                                                                                                                                                      SHA1:D28A588217738AF932FC43B809ADD215EB932856
                                                                                                                                                                                                                                      SHA-256:B33A762F0EB072033044E7EE89505B695F357C958D4107CE6F1C4D68F88D3277
                                                                                                                                                                                                                                      SHA-512:54F58F5A0D1AECFB9A6C8F12B5AAC30E26EC427DCCC097F8015D690A0A2244603E80810C19FB8EB2EE7AE9122D14829B3AAA81C69C77B6B4C5751D040C3849F7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....w>..........." .........0...............................................@......M.....`A........................................P...x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26072
                                                                                                                                                                                                                                      Entropy (8bit):4.99171912400366
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:iHUW9MPrpJhhf4AN5/KiZWAhWWMoWCYtvnVWQ4OWSj5t5equ/X01k9z3AFpGhS:iHUZr7/WAhWWMjh56/R9zg3
                                                                                                                                                                                                                                      MD5:80E80532239AA8929EC0FDDEDB7AA8AF
                                                                                                                                                                                                                                      SHA1:312E743535E66735D782CBAFFACF94C6C791EDAB
                                                                                                                                                                                                                                      SHA-256:D3641BBAEAA5A7E7D4EE0EE0EC64CCEE0327CFBA3D10B89094144EB70A0867A9
                                                                                                                                                                                                                                      SHA-512:87E7A5496BB2DFB9BED4E9B9913DB2656B335B916EB1277EBEBC33AC9D6622BED50A22293DCC02193F846BE5E0B4B0F032DFBCC673955AA90F04CF81B47A9305
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...4{.+.........." .........@...............................................P............`A........................................P...4............@...............@...%..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26072
                                                                                                                                                                                                                                      Entropy (8bit):5.262742024708906
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PA2uWYFxEpahLWAhWWPcWCYtvnVWQ4GW8/T0siK2YdX01k9z3AcxvT8w8:PIFVhLWAhWWPXh0fwR9zvLI
                                                                                                                                                                                                                                      MD5:58A8C2D2404AD7BF6FCA8BDFBB8A5B3B
                                                                                                                                                                                                                                      SHA1:6E834364437BFD23B48E66D8D891966860528D08
                                                                                                                                                                                                                                      SHA-256:EB7851E182A4675BB34633869938FF3579779A92A6C094194EFBC970F3765DCC
                                                                                                                                                                                                                                      SHA-512:D44E3B47DABD29621A3FADAED16074A46B646E1190FFCFFFB7EC835B8CD6EEFAC88570812E41A490DAAE485A1D71FB2D035C91E73B65C2FBDE649FDA8733CEB9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...+b............" .........@...............................................P......C.....`A........................................P...a............@...............@...%..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26104
                                                                                                                                                                                                                                      Entropy (8bit):5.261519723110946
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:JozmT5yguNvZ5VQgx3SbwA71IkFQ72N+Xzg9z7/1:JozmT5yguNvZ5VQgx3SbwA71If72N+D4
                                                                                                                                                                                                                                      MD5:D7164AE82B7332432BF2EB7FC7774E72
                                                                                                                                                                                                                                      SHA1:221D79C77A8A80068621A0EB8688DDB86224408C
                                                                                                                                                                                                                                      SHA-256:08D811FF57EFE50D9F365C76EC29E095474E0679E06BB4D0D4D0134B0120B40D
                                                                                                                                                                                                                                      SHA-512:D1A4CFC0A21509382606F4650A67556B0616283231E71BB1870CCAA5DEBA42FD77583C3130D60D632E98F5ACC4763F57A2ED932AA2EEEF49601618761ACD9429
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....w.e.........." .........@...............................................P............`A........................................P................@...............@...%..............p............................................................................rdata../........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21984
                                                                                                                                                                                                                                      Entropy (8bit):5.225581899943725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:nND6WAhWyW4pICSjRof0cVWQ4GWK9bcK0OEU+9YX01k9z3AW9eO:MWAhWI2xlcjcK0OQGR9zB9J
                                                                                                                                                                                                                                      MD5:6AA7B1323C5D8E314F2FB42F855E9B12
                                                                                                                                                                                                                                      SHA1:044CD0167DE5E9C1B014E07287C90473C96944A5
                                                                                                                                                                                                                                      SHA-256:9C5880C395B4E7DB4B8D6DE49C75909ABDAEEEF0B041C1703C7339B05D7D2866
                                                                                                                                                                                                                                      SHA-512:E99A14C8772662DBABCAA504BC61EF616590BB6F7384ADF8AE0637E0A365F94C67FE4222B978605B7A2EEEAA62505E57C32857B17B51F4B2E9A0D8A033F0A204
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....p..........." .........0...............................................@............`A........................................P................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22008
                                                                                                                                                                                                                                      Entropy (8bit):4.77907639420577
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:rPjfHQdu3WAhWPW4pICSjRof0cVWQ4WW8tqDk+KKnAX01k9z3AdSPBMp29:ffRWAhWN2xlctqDkTKAR9zsS5Mc9
                                                                                                                                                                                                                                      MD5:7B7F4484966036FF86A7E4CD303D3871
                                                                                                                                                                                                                                      SHA1:18A789E9D1E9DF0FDF22E94D71A18C483CDEB611
                                                                                                                                                                                                                                      SHA-256:7D3D88332D4744C9B6BE81E2BA8D42CED7657CE7879A26F5B8A8D3BB2331ADA0
                                                                                                                                                                                                                                      SHA-512:39E986994A99361FADCCCBF5BD861CE9C4C6DE65CE5E3DA4D390B234FFF34D7C561637EC012CCDB2757794ADC222BC80DE19A60A8917FE65FC221FDB3054149C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...w............." .........0...............................................@............`A........................................P...^............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\avg.local_vc142.crt.manifest.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (536), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27821
                                                                                                                                                                                                                                      Entropy (8bit):5.369470604181648
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Zwuy03GBz0YFaaE9eE2/h4FgeY1Mm3rGFJcZkaWUEQBLt4FE5DCY5qt7iSHXhp38:PiaFfwCW
                                                                                                                                                                                                                                      MD5:5E95536082AC7099045201E3650B9584
                                                                                                                                                                                                                                      SHA1:414EAD1ABBDF3B7F5D653A18D17417E3B29CCDB1
                                                                                                                                                                                                                                      SHA-256:B251998897440079279B708A01BBC197F0193DF944052F11274A9A9367B6164F
                                                                                                                                                                                                                                      SHA-512:3C76AB758E84B09F7B91EEFC2984570E6DD5FDD97769DE9021333D6363B9D80DCE134BC007E65C2A10FE8C10E0BEABE22A01D6C58E4C998D16BC973A03B583A8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="avg.local_vc142.crt" version="14.0.0.0" processorArchitecture="amd64" publicKeyToken="129215daab62721f"></assemblyIdentity>.. <file name="api-ms-win-core-console-l1-1-0.dll" hashalg="SHA1" hash="fa2af55bc5c5bf53833e545f1eda4987099a0f18"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>ta/6u4r9pV67H0BO2racbCOa/+Y=</dsig:DigestValue></asmv2:hash></file>.. <file name="api-ms-win-core-console-l1-2-0.dll" hashalg="SHA1" hash="ac26fd665a6d9db7ec07a037dc41491a73e781fe"><asmv2:hash xmlns:asmv2="u

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\concrt140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):317320
                                                                                                                                                                                                                                      Entropy (8bit):6.285201532205746
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:ft219yeaeO+1g29918EBf2wFrwtngwui28zinWVnWzgBoGEJq:1001en92EBfUx8zK
                                                                                                                                                                                                                                      MD5:22A0056FFD1C0B3081CA56F441CEC3C9
                                                                                                                                                                                                                                      SHA1:81EAAED525B7C714261F840F7CDB5164E45D734E
                                                                                                                                                                                                                                      SHA-256:782910B23F8A65EC477F886F7BCBDC67103354AF263BD30C0DCCABBFBC506BA1
                                                                                                                                                                                                                                      SHA-512:72CC4C4625555FD2FB2276A0A062D39FF2AC7B55A212CE6F58FBD7F58CA5A4A0D69E43A7B72BDAFA803C84BC400AFB5C274E455E5846C83D35D3F9BCE88BE41B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.R_X.._X.._X...*..]X..V :.UX..?"..XX.._X...X..?"..WX..?"..[X..?"...X..?"..^X..?"V.^X..?"..^X..Rich_X..........................PE..d......n.........." ... ..................................................................`A.............................................M...+...................6.......'......x...p5..p...........................04..@............................................text...\........................... ..`.rdata...M.......N..................@..@.data....@...@...:..................@....pdata...6.......8...h..............@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):571312
                                                                                                                                                                                                                                      Entropy (8bit):6.492350759123951
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:Rsjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLd:Rs/5U4RBaf+QEKZm+jWodEECsL
                                                                                                                                                                                                                                      MD5:7DB24201EFEA565D930B7EC3306F4308
                                                                                                                                                                                                                                      SHA1:880C8034B1655597D0EEBE056719A6F79B60E03C
                                                                                                                                                                                                                                      SHA-256:72FE4598F0B75D31CE2DC621E8EF161338C6450BB017CD06895745690603729E
                                                                                                                                                                                                                                      SHA-512:BAC5729A3EB53E9BC7B680671D028CABEF5EA102DFAA48A7C453B67F8ECB358DB9F8FB16B3B1D9EA5A2DFF34F459F6AC87F3A563C736D81D31048766198FF11E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T4...U...U...U...'...U...-8..U...U...U..p/...U..p/...U..p/...U..p/...U..p/...U..p/T..U..p/...U..Rich.U..........PE..d...,pd..........." ... .H...b.......3..............................................r.....`A.........................................H..h...."..,...............8:.......'......8.......p...........................@...@............`...............................text....G.......H.................. ..`.rdata..b....`.......L..............@..@.data...P:...@.......(..............@....pdata..8:.......<...F..............@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):25520
                                                                                                                                                                                                                                      Entropy (8bit):6.052725299275264
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Pu1vZLEtU/POoKFYdWcp5gWaSKLHRN71dEjR9z0gi:WpqtcPOj6XLA1dEF9z
                                                                                                                                                                                                                                      MD5:9C1447BC98B6633B3E6964C5BA68483A
                                                                                                                                                                                                                                      SHA1:57743AFCFD13ECE2830B8F44AF744BBD10DE7263
                                                                                                                                                                                                                                      SHA-256:7D52238FF5A7AF6F4A5E229B1A7465A20FC17E2B401DA5DA9215A3073BF238C2
                                                                                                                                                                                                                                      SHA-512:A63FE4059ED519C3FD56CE012B08C8A7836A8563B738A19B2EA8A8FC7E48B4637A68D357CAE754E0A3D4A3509968BCD67DE69365925EC0F67209FE6E4E2555D6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.e............................t.......t...........>...t.......t.......t.......t.......t.......Rich............PE..d...YQ............" ... .....&............................................................`A.........................................?..L...<A..x....p.......`.......<...'...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..2....0......................@..@.data........P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):187312
                                                                                                                                                                                                                                      Entropy (8bit):6.543851526562827
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:sYRRZqoOwZfxWsy0f8FM0YGal4cxFL24T7bMXm1cF9cr70z5ThmdrVZt:swfqoIuf8q0Y2QFLjbM2Tegdr
                                                                                                                                                                                                                                      MD5:27816FB67FB85A331AAAC2929D7D9C53
                                                                                                                                                                                                                                      SHA1:8730FD669EEACAD5325D3D4BA4E08E563FE7B504
                                                                                                                                                                                                                                      SHA-256:EE22B3403268CBAC3F280F1A49A7FA285C0D01DA601F6914D6FE6AAC43068EFA
                                                                                                                                                                                                                                      SHA-512:E3D0C7B7C2C564DF482034E075F967115CA87B7EB9675CC61D741D27F6058E42835041F058D7FBB18573EA21A1FB1BA6ABF41DE81194128157473C0DFFD04B7E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".C.f.-.f.-.f.-...,.d.-.o...j.-...).n.-.....e.-.f.,...-...,.a.-...(.s.-...-.g.-....g.-.../.g.-.Richf.-.........PE..d.....;..........." ... ..................................................................`A................................................X............................'...........M..p............................K..@...............P............................text...+........................... ..`.rdata..6...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):57224
                                                                                                                                                                                                                                      Entropy (8bit):5.176488316243265
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:rHL4+YhCv6vHKOIrHA3X2QLcE1xvHOQ69zl/:3RPSqOqg3X2QLcE1xqzl
                                                                                                                                                                                                                                      MD5:A2FD4CDCDBB750C519F4AD1ADAE439CC
                                                                                                                                                                                                                                      SHA1:045C69BFF67CA1FEDFEE941A78AE6464E5BC3A11
                                                                                                                                                                                                                                      SHA-256:A94B88A257E64514A7E19BBEC522391F2838AC9307D597ADB2D3EAF88F854DE3
                                                                                                                                                                                                                                      SHA-512:6A75C2D86E58D64011FF15355EDCD213EFBECE764C03F5190056C31031AD73805D04719C496C2D8BFB8B686B1DFF8894E559C9B10C560A469779863FC682671C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z5...T.P.T.P.T.P.&.Q.T.P.,NP.T.P~..Q.T.P~..Q.T.P.T.P{T.P~..Q.T.P~..Q.T.P~..Q.T.P~."P.T.P~..Q.T.PRich.T.P........................PE..d....2............" ... .:...........>.......................................@............`A........................................@f..D....k....... ..........P........'...0..|...pX..p...........................0W..@............P..H............................text...^9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...........B...d..............@....pdata..P...........................@..@.rsrc........ ......................@..@.reloc..|....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21392
                                                                                                                                                                                                                                      Entropy (8bit):6.282301676714795
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:9vhXafwUhZWi3EWQKLHRN7re1x85zR9znk2:9soiKA6109zv
                                                                                                                                                                                                                                      MD5:CA46540F86E9ABE819EBAAF8CDE16681
                                                                                                                                                                                                                                      SHA1:70F3762CC6021A1E3ACB98108513DFD19613B76F
                                                                                                                                                                                                                                      SHA-256:14F943547D1FDB125059EEB9DFB146597AF96CAAC3EA9902578595E9B0C71FB4
                                                                                                                                                                                                                                      SHA-512:25C5F4491B565E8BC7EDB4F219E7B883F99D9B5BE787627FDB7619B5CB04305AFE9EA36C3EEC53E57E8F7174A65E48F903DBE49BAA272B618B276626292B45D2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..)a..za..za..z..{c..zh.5zc..z..{b..za..z@..z..{f..z..{c..z..{m..z..{`..z..Yz`..z..{`..zRicha..z................PE..d.....N..........." ... ............P........................................p.......F....`A........................................p(..0....)..P....P.......@.......,...'...`..,...."..p............................!..@............ ...............................text............................... ..`.rdata..B.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1123832
                                                                                                                                                                                                                                      Entropy (8bit):6.648839167675594
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:3JG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypF:RVGrT6SAk3e
                                                                                                                                                                                                                                      MD5:932DCB8D7D06F4B89FC3915726C418B7
                                                                                                                                                                                                                                      SHA1:33A1FDBFC3DFA0A1B7D2FA3B2E8BAD8E8C71E961
                                                                                                                                                                                                                                      SHA-256:A73BD7D75F368AB2FE949DCDDBB25CD5D5975FF9091761A01B98F5E26DE543EE
                                                                                                                                                                                                                                      SHA-512:FA24B5F9A4192FBFE737506899DC052C51F48980992CBDDA878DEEF01ED0280CA455BED0C813089503DA3CCAC92A0289DD8FDFE64CBF6BABDF70D7BAB531540D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:K..:K..:K..K..:K..;K..:KK..K..:KK.:J..:KK.9J..:KK.?J..:KK.>J.:KK.4J..:KK..K..:KK.8J..:KRich..:K........PE..d................" .....0..........0^..............................................z#....`A................................................................. ...........%...... .......p............................Z..8..............(............................text...X .......0.................. ..`.rdata......@.......@..............@..@.data....&....... ..................@....pdata....... ......................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):334736
                                                                                                                                                                                                                                      Entropy (8bit):5.958683677566097
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:caGpFE+VAtdoFb6/FrlBu+MbNNSUgzCZXdbQL:caf+VHFe/dlBqKUfQL
                                                                                                                                                                                                                                      MD5:25A304A65AB778E0170F46D54F8CB566
                                                                                                                                                                                                                                      SHA1:D2E3570F5E021C90DA834EA81CE130BEF4BF9252
                                                                                                                                                                                                                                      SHA-256:C6A8856D3EEDAC7B032E7A8730FAF22707C9E23C2E289D500DAAC0DFA5DE39A6
                                                                                                                                                                                                                                      SHA-512:D4EA79D54E40A0E0DEDCC21905556A8E98A28559B281EA35C54F2D08998F49E98C41048D3886C9DF383B6AA7DC931971588C0DDBB1E19847B4784CDF512BD5E5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...H..H..H..0|.H...2..H...2..H...2..H...2..H..I:..H..H...H...2..H...2..H...2..H...2..H..Rich.H..................PE..d...I9............" ... .....x......P{.......................................0.......)....`A.............................................>......,................ .......'..............p...............................@............................................text...6~.......................... ..`.rdata..n...........................@..@.data........ ......................@....pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):98736
                                                                                                                                                                                                                                      Entropy (8bit):6.474996871326343
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
                                                                                                                                                                                                                                      MD5:F12681A472B9DD04A812E16096514974
                                                                                                                                                                                                                                      SHA1:6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
                                                                                                                                                                                                                                      SHA-256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
                                                                                                                                                                                                                                      SHA-512:7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vcruntime140_1.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):38304
                                                                                                                                                                                                                                      Entropy (8bit):6.3923853431578035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
                                                                                                                                                                                                                                      MD5:75E78E4BF561031D39F86143753400FF
                                                                                                                                                                                                                                      SHA1:324C2A99E39F8992459495182677E91656A05206
                                                                                                                                                                                                                                      SHA-256:1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
                                                                                                                                                                                                                                      SHA-512:CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\avgToolsSvc.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):875960
                                                                                                                                                                                                                                      Entropy (8bit):6.754686899321394
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:JuA9FciwemI78f23Wic2h0lhSMXlhcDdKIlJkdV4KM:JuA9F/h8u3BcDKBJIV4
                                                                                                                                                                                                                                      MD5:FF5BAD5A6DCB033641EB4C3879ADECBB
                                                                                                                                                                                                                                      SHA1:46BD8BDBB55190A5C077025980904B9933FF36E6
                                                                                                                                                                                                                                      SHA-256:06FE7D9F31FB9166A50108BE5B718752B7BBA4FCAB676BDDC343DB4E682C6988
                                                                                                                                                                                                                                      SHA-512:7ABFC8AE2C6E3934F6AB1D89A15328D9224874C444E88B3B6D7F435883F35BED09F67956D28F43C0D30A5DF7F03C67722FF8703AEAC714EC3415FB987A0A91B0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......S..)...z...z...z..(z...z..Fz...z...{...z...{...z...{...z..{...z..{...z..{...z...{?..z...{...z..{...z...zY..z...{O..z...{...z..Dz...z..,z...z...{...zRich...z................PE..d...<.$e.........."....$............P..........@....................................e"....`......................................... v.......w...............0...Y..H4..p)...........v.......................w..(.......@...................(s.......................text...<........................... ..`.rdata..............................@..@.data....k.......X..................@....pdata...Y...0...Z..................@..@.didat..@............P..............@....rsrc................R..............@..@.reloc...............,..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\browser_pass.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):450496
                                                                                                                                                                                                                                      Entropy (8bit):6.326723586993949
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:Qxu9X7zALhtKgNfehvHXesihK/9twbNb7o+xW0NkqKphn7g9UOo:lhALhAgxehvHXeJhKuN0qK389
                                                                                                                                                                                                                                      MD5:B93F330EB069E1508395F704DBB530AE
                                                                                                                                                                                                                                      SHA1:17D4F1D2DBA55FF72C13F4AC089BF5E409D4013D
                                                                                                                                                                                                                                      SHA-256:8A84603E3D35D0143EE0F6E77141E7DE7619D1F4A03A613257A07F7BEC15E59A
                                                                                                                                                                                                                                      SHA-512:A04FBFE2892DE6B1A1CB3EC01756894145BE71A96BDFF9977AD63FBDBC2EA4BFEAF5FFBA70AD4CD1D5A19D385CB9E6EE7D88C97F2267F77D54D3B5586E3288EC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......0g..t.gHt.gHt.gH.x.Hu.gH.xcI|.gH.xdIv.gH.xfIr.gH.tdIv.gH.tcIv.gH"sbIw.gH}~.H`.gH.xbIh.gH.sbIu.gH`yfI|.gH.tfIf.gH"sfIw.gHt.fHU.gH`ynI".gH`ygIu.gH`y.Hu.gHt..Hv.gH`yeIu.gHRicht.gH........................PE..d.....$e.........." ...$..................................................... ............`A........................................P...|...............P........D..H...x)......$...H&.......................'..(.......@...............P...4...`....................text...{........................... ..`.rdata..|...........................@..@.data....P...@...B..................@....pdata...D.......F...^..............@..@.didat..h...........................@....rsrc...P...........................@..@.reloc..$...........................@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\burger_client.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1678784
                                                                                                                                                                                                                                      Entropy (8bit):6.454079807412992
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:KBbbIwpHRIYKexjfsMFo1297IZSSepbKVxgOZZCd/HTxLXHRxBY69TXVA:KBbbp/IYhxjfsMFoE97VdRmx3+JTxLV
                                                                                                                                                                                                                                      MD5:A369F1135103AA66BED19045E81A44F1
                                                                                                                                                                                                                                      SHA1:4663C407B4EA4440348509D31B1A675CF1F22DC7
                                                                                                                                                                                                                                      SHA-256:6EF25876446F5354A1D1C7835183C34010D667F6CD99D795CD711EB4D8FBFE34
                                                                                                                                                                                                                                      SHA-512:14828328D56FD7B11D0C135B7E582B4EC0FDC574FE7635E89651DE879D7BB64C8B800D3F2BABDF2BF6ED3EDAC2999900583FAFB609898D5518E9DA05FA53B9B6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......k.B./.,./.,./.,....$.,..(.'.,../.-.,..-.'.,.../.-.,...(.-.,.y.-.-.,..(.'.,.&..5.,.y.(..,..).0.,...)...,.y.).-.,...-.4.,.;.-.'.,./.-..,.;.%..,.;.,...,.;.....,./.....,.;.....,.Rich/.,.........................PE..d.....$e.........." ...$............................................................&.....`A............................................p..............`...........Ht..x)......4 ...W.......................Y..(...@<..@...........................................text.............................. ..`.rdata...'.......(..................@..@.data....z.......`..................@....pdata...............J..............@..@.didat...............H..............@....rsrc...`............J..............@..@.reloc..4 ......."...R..............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\crts.cat.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):116588
                                                                                                                                                                                                                                      Entropy (8bit):6.905886759101653
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:fxvKgQe/4YLB4eliAm6zXR75CD8+HANNLM2YPi/CfyD6Hcs0HxnRYWBvX/AJ5tX8:fxC9YLB4GzXR75CwMiWnGHfvXu7mPxj
                                                                                                                                                                                                                                      MD5:9E8B474F9A3268AEAC77DDE0139C1A56
                                                                                                                                                                                                                                      SHA1:AA594D8C8871FDB5522409D9B205DAFAF0513A60
                                                                                                                                                                                                                                      SHA-256:BFD12F6FE148C4C42B7C1B1161F96E34CBC6E26841DBEDD1E8B78882F2C22C61
                                                                                                                                                                                                                                      SHA-512:35D4358862C52D59C7D02427DBE6F79EB0775531DE05E83E32A4E96E4B3EE72E5EB15F5BB0AD5A15D168D0D30241AAF4C1888E8AE7D06D211B93D1E7C25C9E24
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:0...g..*.H..........W0...R...1.0...`.H.e......0...}..+.....7......m0...h0...+.....7......u&..DKC.].#..]...221026085620Z0...+.....7.....0...$0... .C.6Q..wK....A{.....-.LMw.C.^..1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .C.6Q..wK....A{.....-.LMw.C.^..0... ....9'U-..C.t....E.d.....K2.1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ....9'U-..C.t....E.d.....K2.0... ..5!..;...MKl..8.u....f..2.xy..t1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..5!..;...MKl..8.u....f..2.xy..t0*...8d.)......._...Y.P1.0...+.....7...1...0*...q..w.q........k....1.0...+.....7...1...0... ....y...x..XX..2.f.C.G......C1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ....y...x..XX..2.f.C.G......C0... .9.L..u....C....u6....6..Xznx1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .9.L..u....C....u6....6..Xznx0... .B...%.

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\dll_loader.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):47544
                                                                                                                                                                                                                                      Entropy (8bit):6.284452804030511
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:zv/+NVUNhppnD13s1rGL3PU9wJTl0etfHO0uREAZcuJVWnlYii4AMxkEt:L2VUDpd181rk3PU9wxl+EAZpWl7xx
                                                                                                                                                                                                                                      MD5:5807BBF7BE13EEAD3D8355CFAB785201
                                                                                                                                                                                                                                      SHA1:0FF3791F4839ABA6E2D3A80631CBE97AAA9185A3
                                                                                                                                                                                                                                      SHA-256:15AC4279323FD99D3A0A1E675B24006EF8AF21D693FFCDA98C6AD23B52091426
                                                                                                                                                                                                                                      SHA-512:CC3FFB88DE31D64924A15D76264972C4F5CF07F511A4E0F1154D7C39A2B9921314E9D4F41417D26B0544B87FDAF660EB2638A19D3A87D07EDC9384B0999F209F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z...)...)...)..?)...)...(...)...(...)...(...)...(...)..Q)...)q..(...)...)u..)...(...)...(...)..=)...)..U)...)...(...)Rich...)........................PE..d.....$e.........." ...$.N...D.......D..............................................m.....`A.........................................|.......|..........@.......h...H...p)...........g.......................h..(....f..@............`...............................text....L.......N.................. ..`.rdata...'...`...(...R..............@..@.data................z..............@....pdata..h............~..............@..@.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\dnd_helper.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):964536
                                                                                                                                                                                                                                      Entropy (8bit):5.877780331459086
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:0uLx+yUhQ4WUFo449Dch0lhSMXlJnb4VLF:0uLx+5f3Fo449dm
                                                                                                                                                                                                                                      MD5:2A55A260A6B1128AC61A33B471EA5D2C
                                                                                                                                                                                                                                      SHA1:565B077790BE9021CFCBDED66A7A8AFBDF5ACA6B
                                                                                                                                                                                                                                      SHA-256:1DC5B84AA79F51509F64897BA83B1C08C8AC9CA4C1D2CC4BAFCE532913947909
                                                                                                                                                                                                                                      SHA-512:26D475A3495305E0C22C82C18E9F53DD9704EA5BE0A701BAB9EAB7999E5288713F9C0AB07AD896E38FDC4F4512A4A352D609DC4885F0F5B98072786293CD9B29
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........s....@...@...@...@...@...A...@...A...@...A...@j..A...@j..A...@..@...@...A...@...A...@{..A...@{..A...@j..A...@...@...@...A..@...A...@...@...@...@...@...A...@Rich...@........................PE..d.....$e.........." ...$.Z...H......`....................................................`A................................................`...........X....`..pV..H...p)......................................(... p..@............p......d...`....................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P....@......."..............@....pdata..pV...`...X... ..............@..@.didat..0............x..............@....rsrc...X............z..............@..@.reloc..............................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_manager.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):468408
                                                                                                                                                                                                                                      Entropy (8bit):6.370849217281267
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:V0LfGYY3jLZghbu/j5LKASbSVmpYQgEUs0YjB39qUEwezIM9Y0f:V0LfGDqhqj5LKcciQgmJ5tee0
                                                                                                                                                                                                                                      MD5:48D115911D6822AB3B2BC335833F62D4
                                                                                                                                                                                                                                      SHA1:5A34430989C44FBC81A5231E79ABD95EB5D7C802
                                                                                                                                                                                                                                      SHA-256:5C02092D66763225EC2562F4CBF8F63C841C4353263CB3448513766FE55C1CCE
                                                                                                                                                                                                                                      SHA-512:D30660449E1008F801C6E911F2E60170EC29EBCFF769C5245125F86E57E47318731FC2A4DB4151E45BF71500DEA19A8DCCB1F6FD5698DD7EC6CB1B16E1CDB66E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........A.D ..D ..D ...^F.E ...^..L ...^..F ...^..L ...R..F ...R..F ...U..F ..MX(.T ...R..H ...^..^ ...U..E ..P_..A ..D ..:!..P_... ..P_..E ..P_D.E ..D ,.E ..P_..E ..RichD ..........................PE..d.....$e.........." ...$.|...................................................@......Af....`A............................................d...t...h.... ..`........K..H...p)...0..................................(.......@............................................text...{z.......|.................. ..`.rdata..............................@..@.data...0.... ......................@....pdata...K.......L..................@..@.didat..x...........................@....rsrc...`.... ......................@..@.reloc.......0......................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_manager_burger.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):488376
                                                                                                                                                                                                                                      Entropy (8bit):6.3920159299755985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:q9V2xKxlTDnmfnlwK852GurTysaE16JOI962P:q9VNFDQnqhuriJG
                                                                                                                                                                                                                                      MD5:14C2CD64DA7CC75D187FD182ABB67B58
                                                                                                                                                                                                                                      SHA1:2295601A6F0F052682999A5422171D589A8F4CCF
                                                                                                                                                                                                                                      SHA-256:964D67FB97013E2F79713F838D0D3FB88097B64BBEEBAC629CBB4AF439F6AFB0
                                                                                                                                                                                                                                      SHA-512:6ED20C05EBCE466FEDBE7824968AAD2624248C577D76EFD8F797FD83CB8D8AB9923970CCBBE967E375259FD975956E5DC7958EDEFAE9D0786693C432F5CED429
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........v"'..Lt..Lt..Ltsi.t..LtsiHu..LtsiOu..LtsiMu..Lt.eOu..Lt.eHu..Lt.o.t..Lt.eMu..LtsiIu..Lt.bIu..Lt.hMu..Lt.bMu..Lt..MtD.Lt.hEu..Lt.hLu..Lt.h.t..Lt...t..Lt.hNu..LtRich..Lt................PE..d.....$e.........." ...$.............u..............................................O.....`A......................................... ......."..|............ ...L..HJ..p)...........2.......................3..(.......@...................P........................text...<........................... ..`.rdata..j...........................@..@.data...p....`.......@..............@....pdata...L... ...N..................@..@.didat.......p.......2..............@....rsrc................4..............@..@.reloc...............<..............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_manager_er.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):276408
                                                                                                                                                                                                                                      Entropy (8bit):6.435479968002735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:s+y1oWRSLMDoGfNJgJfwh0Fu5ALScXxoUfS4UmmJ2M+AYMZw7DApBVJRdC5o0aoj:K38Mjo4DQmJJ+AYMyApBVJRdHa
                                                                                                                                                                                                                                      MD5:32D0BB1873678C3E968A9947D60E4003
                                                                                                                                                                                                                                      SHA1:283507EEE0A62B8DD38D3C7507F86F5FFA3D148B
                                                                                                                                                                                                                                      SHA-256:9812132AE3FB7837919EF962B5B484FC15C947E591F92DE78E934B056144FEE7
                                                                                                                                                                                                                                      SHA-512:98E9EDB7E398177D349B60AC8079C13BB31720609681EF3F8CF0CF2F98A98B5D3CC7E2C9B628EAAB8C7BD9BBC542399D0533AD86615B17A18EC314B0BCB7E665
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........e;...h...h...h...h...h...i...h...i...h...i...hx..i...hx..i...h...h...hx..i...h...i...hi..i...h...i...h...h...h...i...h...i...h...h...h..h...h...i...hRich...h........................PE..d.....$e.........." ...$............ =.......................................`......d'....`A........................................0\..t....]..,....@..........|,..H...p)...P..................................(...@...@....................V.......................text............................... ..`.rdata..|...........................@..@.data...p{.......r...^..............@....pdata..|,..........................@..@.didat..X....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_manager_ga.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1108416
                                                                                                                                                                                                                                      Entropy (8bit):6.431845160547087
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:ii9wnCJzV0yNFTcOLTbpottcHgbZENWzVTWN6:ii9wnex0gFgmTNktxVagVT
                                                                                                                                                                                                                                      MD5:D2B1645C1815986D4E3FE70727B43C2B
                                                                                                                                                                                                                                      SHA1:D155ED393A2976237E1156EEA909FB33B9682800
                                                                                                                                                                                                                                      SHA-256:C7010B9126FCE8861C7F7A323A92046747D279F7B131735E707C6DA5594000B1
                                                                                                                                                                                                                                      SHA-512:C31FC3283EB195E55F53294CD67A6F47A62B66EF5398C56F8EDA2B877E3AAECA996EAAF8270EF7726DD00AFC921BAF4FD0F265E763B2B5F6F4EA2A278F697858
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........]...<z..<z..<z.CB...<z.CB~..<z.CBy..<z.CB{..<z.4Ny..<z.4N~..<z..D..<z.}R~..<z..I~.y<z.CB...<z.%I...<z..C{..<z.4N{..<z..<{..>z..Cs..<z..Cz..<z..C...<z..<..<z..Cx..<z.Rich.<z.................PE..d.....$e.........." ...$............................................................LW....`A.........................................)......0+............... ......H...x)..........(...........................(...`...@....................#.......................text...+........................... ..`.rdata..4{.......|..................@..@.data...h....`.......N..............@....pdata....... ......................@..@.didat..x...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_routing.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):668088
                                                                                                                                                                                                                                      Entropy (8bit):6.447728263315976
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:X8Ogjnh4MH9RFIPrZ1HRigtNyZr1cTuyvV0D:X7gjnh4MH9LIP11HRieNyZr1cTuyvV0
                                                                                                                                                                                                                                      MD5:21F9DFB8569B4063CD7B237A8A4166CA
                                                                                                                                                                                                                                      SHA1:3FD208FDF2C8D4D42860A3D6CA05CBB984F0E2B1
                                                                                                                                                                                                                                      SHA-256:DE5C14F0BDF7AFCB68FE37BE14B135744BFBAA6B62339CFB65B7064A5CF88CFB
                                                                                                                                                                                                                                      SHA-512:6C09EC5C4E55D3BD7F928C95645A023BFCEDEA21ECAF415045D22D8B7F84D5EC40ABF39F9F37184B19A4A8C6E95411496CBC5160BDE8DFF965C62835A98CE7EB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........................l.......................j.....j...................j...........{................................n...................Rich....................PE..d.....$e.........." ...$............PH.......................................P............`A........................................p...L.......h....0..`........c..H...p)...@.. ...X...........................(...`]..@............0...............................text............................... ..`.rdata..|....0......................@..@.data........ ......................@....pdata...c.......d..................@..@.didat....... ......................@....rsrc...`....0......................@..@.reloc.. ....@......................@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\event_routing_rpc.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1159608
                                                                                                                                                                                                                                      Entropy (8bit):6.439781124943574
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:xJ03bWfuHizGbpI3y0ndNWuHv+l5DTWUi:xJ0Sz4IRdNzv+n0
                                                                                                                                                                                                                                      MD5:8A0F03FEFAE35ECBCF777AD8F1D87907
                                                                                                                                                                                                                                      SHA1:8189B7BD8F3F352C2B6F370B917606938D0A8B70
                                                                                                                                                                                                                                      SHA-256:FF7175687C700E54C5F6DA872DCF8A7ADA67F70C6DC7FDE249598F10C8185006
                                                                                                                                                                                                                                      SHA-512:CFA6561392716FC4DC9161322032C67C1F1E8271044451B49CE7F417864D4F53003F4CC97F20306065DD9F3B5CAFF711C230F805ADF90F8114BDC673F325EC5F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......14,_uUB.uUB.uUB..+..tUB..+F.}UB..+A.wUB..+C.}UB..'A.wUB..'F.wUB.|-..eUB.# G.vUB..+G.hUB.. G.tUB.a*C.qUB..'C.fUB.uUC..TB.a*K.:UB.a*B.tUB.a*..tUB.uU..tUB.a*@.tUB.RichuUB.........................PE..d.....$e.........." ...$............ X...............................................-....`A............................................d...............x.......d...H...p)......H...............................(...@...@...............`............................text.............................. ..`.rdata...?.......@..................@..@.data...............................@....pdata..d...........................@..@.didat...............`..............@....rsrc...x............b..............@..@.reloc..H............j..............@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ffl2.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1257912
                                                                                                                                                                                                                                      Entropy (8bit):6.395542605972075
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:s2r1E5kQXjCHxFhi+E2XJYHURO/F639viphpZ4TfwUVoE:s2r1uazi+/XJYqO9wcJZ4Tf
                                                                                                                                                                                                                                      MD5:F567B40B43FEED7B3529868654F39B27
                                                                                                                                                                                                                                      SHA1:C08892B4A191F7C5390CBF06196D061E283CF2DA
                                                                                                                                                                                                                                      SHA-256:B55706A83C0A7EC818DBA1DC9ABEAFD4BB96253A9DCEB64D6DB9DC9912DBC393
                                                                                                                                                                                                                                      SHA-512:4466632A040F09339EE615620A69AF2AA82F5EDCA52D661B82F6FCF1E4074F77EC6A4A31E87591B4251B8CB487039874EC97E33E63993A05C0CD0AA3412DEDD9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......4S;.p2UOp2UOp2UO.L.O{2UO.LQNx2UO.LVNr2UO.LTNv2UO.@VNr2UO.@QNs2UOyJ.Oj2UO.\QNv2UO&GQN.2UO.LPNP2UO.GPNq2UO&GTNt2UOdMTNz2UO&GPNs2UOp2TO.0UO.@TNm2UOdM\N.2UOdMUNq2UOdM.Oq2UOp2.Oq2UOdMWNq2UORichp2UO........................PE..d.....$e.........." ...$.....^...............................................P............`A............................................4...........0..0....`......H...p)...@..@...............................(....t..@.......................`....................text............................... ..`.rdata..(...........................@..@.data...@........p..................@....pdata.......`.......4..............@..@.didat..0.... ......................@....rsrc...0....0......................@..@.reloc..@....@......................@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\firefox_pass.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):524224
                                                                                                                                                                                                                                      Entropy (8bit):6.6154302904560405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:x0d2ompnCuiXd0XVXYCkAd03XEaKoDSNph0lhSMXlBXBWflCFxmFH4rZABf:+d2+uu+XYCkJTOph0lhSMXl+lemVf
                                                                                                                                                                                                                                      MD5:04B0D671B04A13D7A1952A571ABC172E
                                                                                                                                                                                                                                      SHA1:E78B8C1F73003075AC806C1F7ED0FE37800AE977
                                                                                                                                                                                                                                      SHA-256:8EFB454FA4C07B8E730B18E3B88F345F5A26B0416403B72D17E591ABA13B8D53
                                                                                                                                                                                                                                      SHA-512:1D0DDCBBDE73124732BE156A78E4E7EC1EAA7A414EA55423E368922239C66DFBB095089BDA653B581AB7494858911F4311DCADF6A5E98F61B8607B649AB6F4A7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........o..<..<..<L.W<..<L..=..<L..=..<L..=..<L..=..<;..=..<;..=..<*..=..<.9<..<;..=..<...=..<..<\.<...=..<...=..<...=..<..U<..<..=<..<...=..<Rich..<........PE..d.....$e.........."....$.......................@..........................................`..........................................(.......)..T................?..H...x)......x...@r.......................s..(....q..@............ ..8............................text............................... ..`.rdata...?... ...@..................@..@.data....@...`...6...P..............@....pdata...?.......@..................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\fltlib_wrapper.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):118208
                                                                                                                                                                                                                                      Entropy (8bit):6.097533935640017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:/M0psBcWiLSjePEnsyH7kqH3csELUmYZ3Zkmprltliy7BxH:/MSW+qyO7kqHMjUmYUmp1iyj
                                                                                                                                                                                                                                      MD5:830D7A27C78821D2C9462BEA412198AB
                                                                                                                                                                                                                                      SHA1:EE4A5612F1E58280F687C2667197657FC811A63C
                                                                                                                                                                                                                                      SHA-256:5EC46B52FA5622BE09658794C16DE93BF2F46CC17DF9BAF2762CF6CEBE5EBB9F
                                                                                                                                                                                                                                      SHA-512:383DBC8D343FB71B66738D6541590273589D3869B42C3E3641E37BCC8BD9A4C6DC95D1808052F76025FD1C5E9F4442F585DCB6E6AA88AE9053F1BDCAEF19DB7B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......R....i.D.i.D.i.D..uD.i.D...E.i.D...E.i.D...E.i.D...E.i.D...E.i.D...D.i.D...E.i.D...E.i.D...E.i.D...E.i.D..gD.i.D.i.D7h.D...E:i.D...E.i.D..wD.i.D.i.D.i.D...E.i.DRich.i.D........PE..d.....$e.........." ...$............................................................$....`A........................................@g..P....i..........p.......T...H...x)...................................!..(.......@............................................text............................... ..`.rdata..Xv.......x..................@..@.data...()....... ...b..............@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\gaming_hook.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):492480
                                                                                                                                                                                                                                      Entropy (8bit):6.797322464979677
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:tgMLZHAzld2w45AzX95dFph0lhSMXl+W30ERW:WMLZHuldSAzX9Dh0lhSMXl0ERW
                                                                                                                                                                                                                                      MD5:E3EC647384B451F263BD8D65D534043E
                                                                                                                                                                                                                                      SHA1:2AFC60F69D3634A1B5571F8994B8D56AC362236D
                                                                                                                                                                                                                                      SHA-256:9B4ACCD7833B93B5A04924ABE7FED1937E7F51C88C67E91AF45DF5856CB70F1D
                                                                                                                                                                                                                                      SHA-512:7821B94606C89DB8E203873C8E28126341BB28D1B906D2701B42EF8763FAFEDEB655214915345AD1438DFE5F41C2DCEC135743AA7B14F6B4B20976EB560ACFAD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........m._O...O...O....rm.K....r..E....r..K....r..b....r..I...O...C...Ft..\....~..C...O..._....y..N...[s..2...[s..N...[so.N...O...M...[s..N...RichO...........................PE..d.....$e.........."....$.....\......@t.........@.....................................W....`.....................................................T............P..`0..HZ..x)......\....|.......................}..(....{..@............0...............................text............................... ..`.rdata..N....0....... ..............@..@.data........ ......................@....pdata..`0...P...2..................@..@.rsrc................N..............@..@.reloc..\............V..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\hns_tools.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):638392
                                                                                                                                                                                                                                      Entropy (8bit):6.441390546044095
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:o76Z6ySKjx6uybTZ644MqciLMt0wdL28Qls:o76Z6ySugVbVFqciL+0wZ28N
                                                                                                                                                                                                                                      MD5:9F48FBA14BA757A0D7A3A7BC7C095DAC
                                                                                                                                                                                                                                      SHA1:61AC37F0EEBF1FF8EDD4EC3C90D9C484C22EE7ED
                                                                                                                                                                                                                                      SHA-256:44386DF3BA7BDA4B080F54AEBCDAC788FEABE4C2BBCB91AB7AF53720B7139F49
                                                                                                                                                                                                                                      SHA-512:F260DB8B0BB5127E9D9487202A447787057E33809B88C610D7DB552144C25B31BC4BF7E30E302A3FA5BD5481059429AE5047553E3720F996CCDF6A02C53EF814
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......i...-.eH-.eH-.eH...H,.eH..aI%.eH..fI/.eH..dI+.eH..fI/.eH..aI/.eH$..H?.eH..dI!.eH..`I1.eH.`I,.eH{.`I..eH9.dI&.eH-.dH..eH9.lIn.eH9.eI,.eH9..H,.eH-..H,.eH9.gI,.eHRich-.eH........................PE..d.....$e.........." ...$.................................................................`A........................................ k..X...xm..|.......8....P..(_..H...p)......4...XO.......................P..(.......@....................d.......................text.............................. ..`.rdata..b...........................@..@.data..............................@....pdata..(_...P...`... ..............@..@.didat..p...........................@....rsrc...8...........................@..@.reloc..4...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\jsbridge.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):28608
                                                                                                                                                                                                                                      Entropy (8bit):6.261142206453784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:PQ/foqmATM6Q+u/zoYqng8SdIYiif3PyAM+o/8E9VF0Nyvls:4c+++kzoTg8xYiiyAMxkE0
                                                                                                                                                                                                                                      MD5:55FE193CF74C76C7043DC5CF1DD51EE1
                                                                                                                                                                                                                                      SHA1:70588456204D8A28E44BE5BA3FDBDC7BEA23B8D9
                                                                                                                                                                                                                                      SHA-256:7ABA5F4C8E36116C41932AB987A125D050808AFC7E7AE415F3F7D692045189D9
                                                                                                                                                                                                                                      SHA-512:11AA1CC96AF040BF99608F5077861217B1C0B3A0B8A2CADA3C5C6F62723C64AAE9EC31BF793015417FBF17F38A761972C49B96284BD78E3D0F45FB4A6B8C4875
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(';.lFU.lFU.lFU..8T.jFU..8P.bFU..8Q.dFU..8V.oFU.4T.oFU.e>..dFU.lFT.QFU.x9\.dFU.x9..mFU.lF..nFU.x9W.mFU.RichlFU.........................PE..d...;.$e.........." ...$.....2............................................................`A.................................................=.......p..P....`......HF..x)......X...p4..............................03..@............0..h............................text............................... ..`.rdata.......0......................@..@.data...x....P......................@....pdata.......`.......0..............@..@.rsrc...P....p.......4..............@..@.reloc..X............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\libcrypto-3-x64.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6305616
                                                                                                                                                                                                                                      Entropy (8bit):6.0612014636471985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:+Q+X1U2elBygtOU+Uf21CPwDvt3uF+DCn:ngC2elIgtOU+Ue1CPwDvt3uF+DCn
                                                                                                                                                                                                                                      MD5:78B1A2901240FF8B2EF23014D67D4DE2
                                                                                                                                                                                                                                      SHA1:99F3158DF92D45B4E7383A72BBCD3319F6285FEF
                                                                                                                                                                                                                                      SHA-256:32B92873305A2DC8C4FF1652B9755C798F796205106B8151740BCDC9FB5564DB
                                                                                                                                                                                                                                      SHA-512:0607FF3DBA6F436F0B12B0D0827B442489DE2DCC9BED123AAB97067827D6B87F2DB558EAC11EA24EC55F6732DDAE13878DAC323D89A70730E175A58D21CB980A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S...S...S...Z.F.C.......Q.......X.......[.......W.......X...S......S...p.......>.......R.....*.R...S.B.R.......R...RichS...................PE..d....M.e.........." ......G.........X.........................................`.......`...`..........................................X.....8[_.,....._......P\.......`.P)...._.P....T.8...........................0.T.8............P_.8............................text...$.G.......G................. ..`.rdata........G.......G.............@..@.data...!.....[..V....[.............@....pdata.......P\.......\.............@..@.idata..j$...P_..&...._.............@..@.00cfg..Q....._......&_.............@..@.rsrc........._......(_.............@..@.reloc........_......2_.............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\libssl-3-x64.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):835408
                                                                                                                                                                                                                                      Entropy (8bit):5.612276330060018
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:cPVykU4OslexTQXGRIQnRHOzAzDoQ2CYaB001sQib:ww4Oi4TWGRRnRuzAzDoQ2CYO001sQib
                                                                                                                                                                                                                                      MD5:C2806034AE3FC813F0B051FEEC66671F
                                                                                                                                                                                                                                      SHA1:C7DE5FD0F8BB3D4571B5FCE729DF7E979EDE84BD
                                                                                                                                                                                                                                      SHA-256:2F50EEAF06CAC4F82628E35EC6102CA112A19DE6B9663EF81926985FF2AFF74B
                                                                                                                                                                                                                                      SHA-512:DDE110F28728D18E42F9084FB397635F9E5CC2ECDBC0380A1EACA522EE5CF8D88559201D4BE0C4AA74BD28CD3FEBC0E01DBDE49D1540889E4B7A6DAC072DA861
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................................................................................a................Rich...................PE..d....N.e.........." ................K...............................................Zx....`..............................................R...W...................W......P)......X....z..8...........................0{..8............@...............................text...T........................... ..`.rdata..............................@..@.data....W...p...P...T..............@....pdata...`.......b..................@..@.idata..fc...@...d..................@..@.00cfg..Q............j..............@..@.rsrc................l..............@..@.reloc........... ...v..............@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\log.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):361920
                                                                                                                                                                                                                                      Entropy (8bit):6.697266069899337
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:ZM6toEEQxxRFY0I67ph0lhSMXlBXBWfSGIWrfx9:ToDYFY0I67ph0lhSMXl+Sb
                                                                                                                                                                                                                                      MD5:615A1ACF769203A3B0D591DAB0EE9826
                                                                                                                                                                                                                                      SHA1:5EE1FC32D7CCC7200A3A89C5F3454AC35B01DC21
                                                                                                                                                                                                                                      SHA-256:CAF3D979C828B44874BF91AE7D0F1664E6CD85037DBF0BF82C482ABC0E4E29DB
                                                                                                                                                                                                                                      SHA-512:B2C811FAABF4F68043CF67177F8A5B03FECB64DB366BCA7B85F1DFD40E74AA5CF45D7E51A4AB02EE3D82FBD4A07965822B7DB0A83B7E1404925392737C3815C3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........Y[.85..85..85.0F..85.0F1..85.0F6..85.0F4..85.GJ6..85.GJ1..85..@...85.GJ4..85.0F0..85..G4..85..84..95..G<..85..G5..85..G..85..8...85..G7..85.Rich.85.................PE..d.....$e.........." ...$.R..........................................................Ux....`A........................................0...8...h...........(....`..l'..H\..x).....................................(...0M..@............p...............................text....Q.......R.................. ..`.rdata.......p.......V..............@..@.data...H&...0......................@....pdata..l'...`...(...&..............@..@.rsrc...(............N..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\mfc140u.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5649312
                                                                                                                                                                                                                                      Entropy (8bit):6.731304727756214
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:RxfTJazUpJGBLLFLOAkGkzdnEVomFHKnPR:dazaJGB/FLOyomFHKnPR
                                                                                                                                                                                                                                      MD5:FE883283E045D3FAC57CC6F0AB9BD835
                                                                                                                                                                                                                                      SHA1:9E7F911AF8B4A7E2E7195011CB127543A740ED3B
                                                                                                                                                                                                                                      SHA-256:D52171CD1981E7B2D4307644096BD77AFEB2455D48A387586FDAB3766ED8C4DC
                                                                                                                                                                                                                                      SHA-512:2D2E159E042BA3332B7B5224B4501D550B0629640C4853FE6E624A731F8888E53D50BBD232DA51FC0542CA0EEC12EA108E557E58DF89850891EDBF6B78F3CD4B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......I.c..........................................m.......m......................m.......m.......m.......m.......m......m.......Rich............................PE..d................" ... ..-..X).....0G,.......................................V......^V...`A........................................p.:.......;.......?.`....P=..8....V..'...@U.,p..`.5.p............................q..@............0-.X....:......................text...l.-.......-................. ..`.rdata.......0-.......-.............@..@.data....6....<.......;.............@....pdata...8...P=..:....<.............@..@.didat..H.....?.......>.............@....rsrc...`.....?.......?.............@..@.reloc..,p...@U..r....T.............@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\mfcm140u.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):86448
                                                                                                                                                                                                                                      Entropy (8bit):6.1590546105881385
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:anKBniWvGh1yOnU6U+JGf0swukfpMjLz5YMWZz:vB/Gh1FU6U+JGf0ssEv5o
                                                                                                                                                                                                                                      MD5:524C1BE70B874FC43E14962A5E12B61B
                                                                                                                                                                                                                                      SHA1:6DEA21489DD3C468DE77804755D8AA5B4388A004
                                                                                                                                                                                                                                      SHA-256:879B4CE9CBAB5839B6AB97E003F3D453B402665F1CD178892570F51A1EAED206
                                                                                                                                                                                                                                      SHA-512:60B96A7574408D59CD09B4C6F724953ED4C13F8C8AAA7A00DAFC14C23BE3EC7FE598CE920C23841CE0131F04B6255F637DB7E7A1A7AC8262A204889FEDC6EA5E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\....dlL.dlL.dlL..hM.dlL.6.L.dlLx.mM.dlLx.hM.dlLx.oM.dlL...L.dlL..mM.dlL.dmL.dlLx.iM>dlLx.lM.dlLx..L.dlLx.nM.dlLRich.dlL................PE..d...H............" ... .F...........O..............................................o.....`A........................................P1.......2.......p.......`.......*...'...........y..p...........................px..@............p..x............u..H............text....A.......B.................. ..`.nep.........`.......F.............. ..`.rdata.......p.......J..............@..@.data...X....@......................@....pdata.......`....... ..............@..@.rsrc........p.......$..............@..@.reloc...............(..............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\module_lifetime.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):62392
                                                                                                                                                                                                                                      Entropy (8bit):6.162173179448033
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:Be8ant5WSB3XT2Zl9vivoChvEDXb74LdJcTqZu4H2v1Ud9RYiinAMxkEw:Be8ats+2BKvoCVEIJcTqZuqes9R7uxc
                                                                                                                                                                                                                                      MD5:03168D3AB34FE22A216F4EFF0746197A
                                                                                                                                                                                                                                      SHA1:06FAD66066E516B6E48C7B4A15163E8945D97FE4
                                                                                                                                                                                                                                      SHA-256:664B7F8A622024767F6FCCB194A98C66B871394DB97C25449CD52223B9FFB077
                                                                                                                                                                                                                                      SHA-512:88D6A77D2C63B2FC3423FEE183A5B5D9CC03802EFA36482046FC2C73DD8D992C52D8BA1A64DFEAA9A178D3FF85CE6B78E17D04CDB135FEB51EED64C5DA0CFDF1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................L.8....L......L.....L.....;.....;.......V....;.................L....................:......R..........Rich...........PE..d.....$e.........." ...$.p...^.......2...................................................`A................................................8...........X...........H...p)......D...X...........................(.......@............................................text...kn.......p.................. ..`.rdata...7.......8...t..............@..@.data...............................@....pdata..............................@..@.rsrc...X...........................@..@.reloc..D...........................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\nos.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1158592
                                                                                                                                                                                                                                      Entropy (8bit):6.41092368438679
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:mNQ5Z2XwXIMLTXOrtIyYQANN6rjo8o6YPuT816+6p:mNQ5Z2Xs7LOrt4/6voB/uTk6p
                                                                                                                                                                                                                                      MD5:3D4946BAEDF9B35C42971ECF8C652A31
                                                                                                                                                                                                                                      SHA1:23AD09EA8127060821A271C9B7F6745C42AB2972
                                                                                                                                                                                                                                      SHA-256:7C10E100B9B7DE170AC3A7D985D0D84737D9BA0F979EF14C8F4F9B1E6E5585FE
                                                                                                                                                                                                                                      SHA-512:8CB2C556931F8425CC383E399361A0650D5BE778C927ABA135EAD2A218C1A5419976EDA3AD63B987090402DBD257967E75AD0F41668F897BE8AC6B2AAFE26986
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........p...#...#...#A.Y#...#A.."...#A.."...#A.."...#6.."...#6.."...#..."...#..."{..#.7#...#'.."...#A.."...#6.."...#."...#...#...#."...#."...#.[#...#..3#...#."...#Rich...#................PE..d.....$e.........." ...$.v..........................................................u#....`A............................................4...$...0....... .......X...H...x)......<...............................(......@...................t...`....................text...+u.......v.................. ..`.rdata...............z..............@..@.data...(....@.......&..............@....pdata..X...........................@..@.didat..0............h..............@....rsrc... ............j..............@..@.reloc..<............r..............@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\ntp_time.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):430520
                                                                                                                                                                                                                                      Entropy (8bit):6.424314299847503
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:k4NjgMzpMPTsLS4OUNzCbfUJIAzunfx2HcUJN:PpgMzmPTsLSqWbfV8H/
                                                                                                                                                                                                                                      MD5:925F7019E7029F8A6EF2F32225320611
                                                                                                                                                                                                                                      SHA1:93CDEEB8D3015FEB386C628C9A3D35AD3164EA20
                                                                                                                                                                                                                                      SHA-256:ED02F5945740A457DDADA6CC6BB693DD988B6999EFE4DA155C43E47BBD2F470A
                                                                                                                                                                                                                                      SHA-512:00D2238EB350C8A497D2A0BADDBAB0EF79D040670AEC7BFC4AA0FA9A5CB3ECD3F20B87CC398662EAF61E0D3E1AC1625C95AAAC410F0F6E8A95103F4BF8261812
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......l;..(Z..(Z..(Z...$^.)Z...$.. Z...$..*Z...$.. Z...(..*Z...(..*Z..!"0.:Z...(..&Z...$..7Z.../..)Z..<%..-Z..~/..*Z..(Z..E[..<%...Z..<%..)Z..<%\.)Z..(Z4.*Z..<%..)Z..Rich(Z..........PE..d.....$e.........." ...$.....p......p...............................................J!....`A.........................................<..P...`=..|.......X....0..(D..Hh..p)...........f.......................g..(....9..@...................X2.......................text............................... ..`.rdata..ZN.......P..................@..@.data...0....`.......T..............@....pdata..(D...0...F..................@..@.didat...............V..............@....rsrc...X............X..............@..@.reloc...............`..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\overseer.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2181560
                                                                                                                                                                                                                                      Entropy (8bit):6.565723643809428
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:KMLPHrldfIVwlxcLm3J4XnesyCZA/zIWTm2bB5XTAndMQJIV4:16YM2bzcndjo
                                                                                                                                                                                                                                      MD5:56588F31225886D9561B25B37473C2F5
                                                                                                                                                                                                                                      SHA1:7A538F3E844D77DD3CA9EEE4085515FB7FEB010D
                                                                                                                                                                                                                                      SHA-256:B2D74FC21A99CA12C5D71F1B990F3C0B30936A2CF3988836AF7FC25B40D2848B
                                                                                                                                                                                                                                      SHA-512:3B7CF9DC0D7C373F8553372E097A6D1499BE92CC52F9F32752C6FAF6D0D74C95CE7E4603E012A654A97A2B289AB0C4F9E4706316BD459268E94233EB7BC74568
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........O..U.n.U.n.U.n..\k...n..R.._.n..Rj.F.n..Rk.:.n..Rm._.n..\m.E.n..\j.u.n..[j...n.\V..W.n..[k.T.n..@m.T.n..@j.Y.n.U.n.Y.n..\h.T.n..[k.V.n.U.o../n..\o.J.n..Rg...n..Rn.T.n..R..T.n.U...W.n..Rl.T.n.RichU.n.................PE..d.....ud.........."....".....t.......(.........@..............................!.......!...`.....................................................,.... .H\....... ..H !.p)....!.\...............................(.......@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\..... .....................@..@.rsrc...H\... ..^..................@..@.reloc..\.....!.......!.............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\perfstats.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):81856
                                                                                                                                                                                                                                      Entropy (8bit):6.2115913448743685
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:6vb6ZFcni5Xx31szWFYsYeZF/s8ogcl0Cum+X8cfj9l87loPLX+S1bozUkTJ8T4n:L7c7WNYcublzHZUBLX9gU/cwzH7nSx/
                                                                                                                                                                                                                                      MD5:3558E7F142AE0B002444085DDA4738B1
                                                                                                                                                                                                                                      SHA1:F6EF27FDA27F7D4097FD322C363BA06DC97CA4FB
                                                                                                                                                                                                                                      SHA-256:B58372732B881F01EACC5DEEAD7B59CF6A083A80321946AA84DE625F37E83AEA
                                                                                                                                                                                                                                      SHA-512:F5473C72F591047AA0EAA6549F7DCF0E67292D3DF59A5B5457CCBFD712CDFA645424D60338265F967FC33AF5E813784F91CA8BF1C13CAF1A0B08AF6EE20C2A74
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......S..C..d...d...d......d...`...d...g...d...e...d...g...d...`...d.......d...e...d...e...d...e..d...a...d...m.3.d...d...d......d.......d...f...d.Rich..d.................PE..d.....$e.........." ...$.....z.......w.......................................P.......3....`A............................................x...x........0..8.... ......H...x)...@..\...............................(...@...@............................................text.............................. ..`.rdata...H.......J..................@..@.data...............................@....pdata....... ......................@..@.rsrc...8....0......................@..@.reloc..\....@......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\process_monitor.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):535488
                                                                                                                                                                                                                                      Entropy (8bit):6.406371017862614
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:5g7kqCeZq0g3HucZpZ84Jz05YqTwJA7mQmoiJUaPv:+7dc3HucZUZYnQVin
                                                                                                                                                                                                                                      MD5:C1F39823280B1E12F0AC9CA65395EBAC
                                                                                                                                                                                                                                      SHA1:DAFBD854C782627A0E602E17798D3EDA38FB8B8A
                                                                                                                                                                                                                                      SHA-256:309C5602332CCA4F9FBA73FAD1C1C7377909523DD7E8DD4F3093D5A8C3B71ED2
                                                                                                                                                                                                                                      SHA-512:6C5C6440380A08F5BC9AE0F873C75311D80565CF4E3F8F295C231C15E75955F152BBFC383DFF0FE2FB4C169E5A2A9BFF55C85B28AB221B41637AEDC4A400164A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.............s.s.s....s...w.s...p.s...r.s.~.p.s.~.w.s....s...v.s.o.v.s.~.r.s...v.s..r.s.r.4.s..z..s..s.s...s...s..q.s.Rich..s.................PE..d...W.$e.........." ...$............@y.......................................`......@d....`A........................................p...........|....@..h.......TQ..H...x)...P.................................(....4..@...........................................text............................... ..`.rdata..>...........................@..@.data...x...........................@....pdata..TQ.......R..................@..@.didat.......0......................@....rsrc...h....@......................@..@.reloc.......P......................@..B................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\protobuf.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2554704
                                                                                                                                                                                                                                      Entropy (8bit):6.624895062782414
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:zTbU/zyo9QDpF58wQkClyH6fgWcquAUzLVJMhaz9ZJxWF2VlStw5w4GubGZ8f/TC:ogBQmkN3DlF
                                                                                                                                                                                                                                      MD5:C54E7EC57E1FD9155AC8DB7D5A4C5AC8
                                                                                                                                                                                                                                      SHA1:C74D4BA9044C379C672D613168A70C7398DFAEED
                                                                                                                                                                                                                                      SHA-256:7BEF0F11011C0563E927789BC82B44BAD51C44A7607DB3AED5FEECA1751EF08B
                                                                                                                                                                                                                                      SHA-512:CB6C8B51AAB9BF43BAB581AE036BDCB0E0CE8FEC3EF1815530EE10885B90AA484BCE8CB0B7D28F10A7431AED58F707EB2A05E3574661BDCF73BDDDDA61AAB484
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8|..|...|...|...ueg.l....h..t....h..x....h..g....h..z....r..~...'u......|......*h..,...*h..}...*h..}...|.c.}...*h..}...Rich|...........PE..d....._c.........." .........<......P........................................0'.....l.'...`A............................................Xs.../%.......'.(.....%..(....&.P)....'.....p...T.......................(......8...............P............................text............................... ..`.rdata...|.......~..................@..@.data...`p...P%..R...4%.............@....pdata...(....%..*....%.............@..@.rsrc...(.....'.......&.............@..@.reloc........'.......&.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\sched.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):367040
                                                                                                                                                                                                                                      Entropy (8bit):6.775431057949792
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:AcDf6xPo4CT6BuzR5vnHac7iwAhS+CIQLFDPMTJYhr64Fgw:AcbsxCTJn6c7KSAQLFPMdV4Fgw
                                                                                                                                                                                                                                      MD5:CB54A921A1FDE8F90741B62AC67A24F4
                                                                                                                                                                                                                                      SHA1:6728D46588134265BBA5D476E400D454063E6800
                                                                                                                                                                                                                                      SHA-256:98FB640D588CD575106623F9D6ECE33A312BC5BB4922F0A53C014A37C15420B9
                                                                                                                                                                                                                                      SHA-512:3040A4E47CADA2E50A98776DEB91A05D946FF96FE7D801EE3274296FEC85DD27E15D99AB440128ED586DEE2180E7234EC9D6857B77176326DA804B0A718E1E8F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......".y.fc..fc..fc......gc......lc......dc......`c.....dc.....dc..o...rc.....jc......Dc.....gc..r...oc..fc...b..r...\c..r...gc..r...gc..fc..dc..r...gc..Richfc..........PE..d.....$e.........."....$.....2.......X.........@.....................................T....`.....................................................|....P...[......(,..Hp..x)......x...............................(.......@......................`....................text...;........................... ..`.rdata..............................@..@.data... @.......4..................@....pdata..(,..........................@..@.didat..(....@......................@....rsrc....[...P...\..................@..@.reloc..x............l..............@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\serialization.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):488888
                                                                                                                                                                                                                                      Entropy (8bit):6.336153039310209
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:UxQhFrVUwTSymTKmkRnyf0rd7KvFjEjLXI2SIXI4YJMIAe0y:Uxi9V1r0f8rdIGS6InJJ0
                                                                                                                                                                                                                                      MD5:18C25B1F1309F90D17E861145677C649
                                                                                                                                                                                                                                      SHA1:58BDD9DFF1A0C8D4B2BC646ABB5512288A123600
                                                                                                                                                                                                                                      SHA-256:BD8A0F1228F35DAF695F53C2EFBFC3C754B3B117CABFBA4DD6E1DEAD5DB1C172
                                                                                                                                                                                                                                      SHA-512:3A025E33D0398AB99276D9B31CB878C9147413578AD86C3C5317313773F0FFCA2D57DA47B77FC79189F0E20BA3BC7291EFE6E02D9BBDC4ED901339CD1CF9DD37
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........~.L...L...L....aJ.M....a..D....a..N....a..J...m..N...m..N....j..O...Eg$.\...m..@....a..P...j..M...X`..I...L...m...X`..d...X`..M...X`H.M...L. .M...X`..M...RichL...........PE..d.....$e.........." ...$.V.......... C....................................................`A........................................ ...........,.......`.... ..@G..HL..p)..........x...........................(......@............p..........@....................text...KT.......V.................. ..`.rdata..B....p.......Z..............@..@.data........ ......................@....pdata..@G... ...H..................@..@.didat.......p.......2..............@....rsrc...`............4..............@..@.reloc...............<..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\setup\aswfc217c30ad6ad913.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2194), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18035
                                                                                                                                                                                                                                      Entropy (8bit):5.647824586371176
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Dw9+iXHcV2gJJi0YkdTJ3p+qOlG1srr7dl9D3e7A5obqAY:O+iYJiaJFOlWw/D3es5oGAY
                                                                                                                                                                                                                                      MD5:637DCC5D11B6EB98BDC309EC36701DE8
                                                                                                                                                                                                                                      SHA1:1ED8107B7B5EACCF4A9069BEB53CFB9C0BC88B22
                                                                                                                                                                                                                                      SHA-256:CE0F73CEA417942AFE49F0F902D85EC18AC16A7ED5D3AE758AE825FFB0F7C152
                                                                                                                                                                                                                                      SHA-512:BA4A0323A5EEB9DE9EAC3F8DFFE2CB38FCA840F78E2907C3F50748BCAC14696003CA25D0F7C0EB402C0D3EA0D9125CEFDC479147A1CAC16858C9C072BB3C37A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=2..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..userLdrModuleFlags=0..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATisON=0..DohMode=3..Pinning=0..[OPM]..def_base=e

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\setup\config.def.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2194), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19781
                                                                                                                                                                                                                                      Entropy (8bit):5.654210075241176
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:D6JEiXHoV2gCJi0YjYPT4s3p+qOrTZBG1grr7dlRD3eJcmozRkEGY:CEiXJis4sFO5BWszD3emmo1km
                                                                                                                                                                                                                                      MD5:DEDBBC581F705F55410EBB56AB5B15F7
                                                                                                                                                                                                                                      SHA1:53F63C47F706D947083073F6318CA5711B0C99B5
                                                                                                                                                                                                                                      SHA-256:DB2D0CB5DC008F905D6D6ED7F3932A19902DA7EDA146205B5D6BC8E7B8EED6DB
                                                                                                                                                                                                                                      SHA-512:2CFA0158E497176B21D6DC67CDF0DBF05991992CEF8B51C798F13B33998338240313B0B4D83941F8E2114490A33B368D7459689AAE5406B38B8C2C50156DF829
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[WebShield.WebSocket]..Enabled=1..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=1..MaxRequestSize=16384..OutlookEnabled=1..YahooEnabled=1..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Offers.SecureBrowser]..ShowInIntro=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..userLdrModuleFlags=24..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_cmp_safeprice=0..ais_cmp_safeprice_chrome=0..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\shepherdsync.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1933240
                                                                                                                                                                                                                                      Entropy (8bit):6.472294626761962
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:B3EZFxfLRoba8yd+BgfJ5Jlm6CTyWJp5EIEOHd8twhT/WY9Oat05:B3EZFhSba8yd+BgfDJg6HWJpms9HhTu
                                                                                                                                                                                                                                      MD5:4E07984EC873779AF51194842FCABEC4
                                                                                                                                                                                                                                      SHA1:81898A3AFBCF147D78B8B34E565EDDCB204CDA38
                                                                                                                                                                                                                                      SHA-256:315E68EE15CA8133692B90C7D93F897D0ADF7DF549908896DB426E4562B557BB
                                                                                                                                                                                                                                      SHA-512:D3017B9DCB033AA917C3C45C72FF3038A0C60F52BA2C6C6391A7E1DA35E7ABD9210BA35C2381EEF16B9B346CE756D1B973514DC315EB454298D59C0109DA5877
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.........j.............V.......V.......V.......V.......!.......!...............h...........l...0...............V...............!..........................................................Rich............PE..d.....$e.........." ...$...........................................................q.....`A............................................p...............P...........HV..p)......................................(....O..@...............p...........................text.............................. ..`.rdata..dd.......f..................@..@.data...........\..................@....pdata...............H..............@..@.didat...............8..............@....rsrc...P............:..............@..@.reloc...............B..............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\shred.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):369592
                                                                                                                                                                                                                                      Entropy (8bit):6.4674339613189025
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:3itA1qHYpDToiZgWqTsWZifa5tMaFxPVT:N1ya2Wg5JFX
                                                                                                                                                                                                                                      MD5:6B54A41584302F9958EFDAC3F3375B6F
                                                                                                                                                                                                                                      SHA1:118E7E1966D192B7D93996305BA23285922FAAEF
                                                                                                                                                                                                                                      SHA-256:44A8990DB4D8419F9AA6D65FFDB9147C790D680BEF234E624F3C0F9C759DCFA6
                                                                                                                                                                                                                                      SHA-512:92B07DFC019C53DFB548D839872DE7A4361A4136EF5EE8B34745324E32D3B205EF635C569D2BC3E03BE4F5E19F5FC3CD7619BA4CD902AB0EF7F3E3D9D69798E6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......O.j..q...q...q.......q.......q.......q.......q..@....q..@....q.......q..@....q.......q......-q.......q..]....q...q..1p......&q.......q.......q...q...q.......q..Rich.q..........PE..d...t.$e.........."....$.............H.........@..........................................`.....................................................,............`..,:..Hz..p)......h...............................(.......@...............`...x........................text............................... ..`.rdata..|...........................@..@.data...8........v..................@....pdata..,:...`...<..................@..@.didat..X............j..............@....rsrc................l..............@..@.reloc..h............t..............@..B........................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\snxhk.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):378808
                                                                                                                                                                                                                                      Entropy (8bit):5.942153252095299
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:WbjLghfu0nJxARDpZLWTk2NsihXHAw8xHM:ThfjyDpoTk2U
                                                                                                                                                                                                                                      MD5:BBE4B0043FAD8DA88E9AB4D34B118966
                                                                                                                                                                                                                                      SHA1:BE78645B7308DC6CD86C777224819312B9B58713
                                                                                                                                                                                                                                      SHA-256:7E4D0361E11C2BD879FA3EEABCF2BFD8C0C7DBFE8EA975E9E7515C8CFED940AE
                                                                                                                                                                                                                                      SHA-512:875000C47C5DF6689324AEAE80802A08DB1976FE976D3ABD4AB89FBAA315ABFE53364E08279969F4648B2F95BD98EE1A8378A557F765D4406AB1F5BA31ECACE5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................w.b....w......w......w....................gyl...gyn....gym............................`.................Rich...........PE..d.....$e.........." ...$.............K....................................... ............`.............................................l.......<....@..h.......@)..H...p)......L....|.......................}..(...p{..@...............P............................text............................... ..`.rdata..P...........................@..@.data....'..........................@....pdata..@).......*..................@..@_RDATA..\....0......................@..@.rsrc...h....@......................@..@.reloc..L...........................@..B........................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\streamback.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):837560
                                                                                                                                                                                                                                      Entropy (8bit):6.456568842581789
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:TqSHk5vSSXA8eT/GKrYgC+6yMcqyz5p17xBgKj:TqSHkMDzaKrYgC+dMcjBgK
                                                                                                                                                                                                                                      MD5:8E60E78ADF04E5AB6EC225CDF550C680
                                                                                                                                                                                                                                      SHA1:03A9F7BB24EE8C584F511E2719B5FA1C77DD6653
                                                                                                                                                                                                                                      SHA-256:432B80B8E9E64C80CB4C9D793F226D4223D86EF7FACE487BAF9D5742EFA9EBFF
                                                                                                                                                                                                                                      SHA-512:7B17682D5AA8B3C309E43BD7EC62C6663EEEB03920E4CB79BFAD81FD76CAD9F5AAA3CD11597B9AFD011313BAB7DD311D75CF78DADB27D04C65BEF22F7272D854
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......A......D...D...D..E...D..WD...D..E...D..E...D..E...D..E...D..E...D..9D...D..E%..D..E...DS.E...DS.E...D..E...D..E...D...Di..D..E~..D..E...D..UD...D..=D...D..E...DRich...D........................PE..d.....$e.........." ...$............0L....................................................`A.........................................;..`....<..........P....P...}..H...p)......................................(.......@............... ....5.......................text............................... ..`.rdata.. {.......|..................@..@.data...p............b..............@....pdata...}...P...~..................@..@.didat..x...........................@....rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\task_performance_logger.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):248768
                                                                                                                                                                                                                                      Entropy (8bit):6.4062411106476755
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:0cn20/T7/s6nuu2Bdjoe/W0nAH1qD+B3TBfD1kyZ+3DR3PyXB3YlYet+oyWee1P7:520LTDnI7O0nAV33TB3BolYet+oyQ
                                                                                                                                                                                                                                      MD5:59C62AA173742E352C61792C79CC6ACD
                                                                                                                                                                                                                                      SHA1:92515625052397D738D2C266BE68C281DAA04D6E
                                                                                                                                                                                                                                      SHA-256:3E77C3F18FCF7E9460F248365ACEBF368A8DD5A308EF7DE312C4F3E7A1DA3EA8
                                                                                                                                                                                                                                      SHA-512:53D135087B5C99A97EDBAA153CA8E188E8648563596A8723CB49EF4CF97CFA5AC7AB66CAF6914B4ABE5B47B1B6F60BD0FD9E449383A99191A96CA050AFB44379
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........W`..W`..W`....G.V`......_`......U`......Q`......U`......U`..^.).Y`......R`......[`......U`......N`..C...R`..W`...a..C...}`..C...V`..C.E.V`..W`-.V`..C...V`..RichW`..........................PE..d.....$e.........." ...$.&..........................................................9k....`A........................................ ...........@...............H*..H...x)......................................(....y..@............@..(.......@....................text....%.......&.................. ..`.rdata..H....@.......*..............@..@.data....I...@...@...(..............@....pdata..H*.......,...h..............@..@.didat..............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\tasks_core.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):461240
                                                                                                                                                                                                                                      Entropy (8bit):6.362568088833396
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:7eYw+eI/F0GdzaRMwNDTsKYQPFhyPhUimjcqDsldIsu:7eGXd2MwN0zGFhEqsls
                                                                                                                                                                                                                                      MD5:12BDCD4617AA7FE99041330BA15FEA8A
                                                                                                                                                                                                                                      SHA1:8D64DFA17BED36BBE3AAA2968125F6E758A8AFE0
                                                                                                                                                                                                                                      SHA-256:28E0A0B9C739424A2E467DD8F0B75EAD8FE096B1048E50E85FD31CF3D55E9CF6
                                                                                                                                                                                                                                      SHA-512:6AC945601C94ACD5A18D1340C67C99F090BE2E98452AAA99680E65C19ED1F7028D16D0EE3E40829C37DCB1097EA865251BFFB89709B429BF8C5B909078FA5ED6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......3-..wL..wL..wL...2..vL...2...L...2..sL...2..qL..>..uL..>..uL..~4a.gL..>..yL..9..vL...2..lL..c3..rL..wL..8M..c3..KL..c3..vL..c3..vL..wLe.uL..c3..vL..RichwL..........PE..d.....$e.........." ...$.b...................................................@......a.....`A........................................P...........T.... ..P........I..H...p)...0..P...............................(...`...@...................,...`....................text....`.......b.................. ..`.rdata..tp.......r...f..............@..@.data..............................@....pdata...I.......J..................@..@.didat..0...........................@....rsrc...P.... ......................@..@.reloc..P....0......................@..B................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\vaarclient.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1252280
                                                                                                                                                                                                                                      Entropy (8bit):6.429263482422374
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:fXBvl4ge5iH4RGaKGG5diw808kF6WFIYT0DGsz:fFlYiH4EaKtGVFkEtYT
                                                                                                                                                                                                                                      MD5:EC7EDCB7006F1B6DA62328387D1724DE
                                                                                                                                                                                                                                      SHA1:959047F17224A06CAB7C84345D9DC406A10DE12A
                                                                                                                                                                                                                                      SHA-256:C6EE776E93277D6DEDAB15055E8B9D5AEB11CB5112DE308544D6FEB79D545B12
                                                                                                                                                                                                                                      SHA-512:F8359731A1AC174739F1847DB60C3342C1FB026E9C77FCEA2E32C183D8CBD6EBF63F30EE8996C4959DD5CB1CB6F1C81C69B7046B06385C0C4A7A26C50812F00A
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........_ .>N..>N..>N.'@...>N.'@J..>N.'@M..>N.'@O..>N.PLM..>N.PLJ..>N..F..>N..PJ..>N..KJ..>N.'@K..>N.AKK..>N..KO..>N..AO..>N..KK..>N.PLO..>N..>O.D<N..AG..>N..AN..>N..A...>N..>..>N..AL..>N.Rich.>N.........PE..d.....$e.........." ...$.....*......0........................................@......`.....`A.........................................s..L...,u....... ..P....P......H...p)...0......(...........................(...0...@....................q.......................text...{........................... ..`.rdata..............................@..@.data............n..................@....pdata.......P......................@..@.didat..@...........................@....rsrc...P.... ......................@..@.reloc.......0......................@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\wsc.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4233152
                                                                                                                                                                                                                                      Entropy (8bit):6.490979576277336
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:zMLVH/ldXb50lA6VE4BF9fN1owHTcNhUg866sSHYl2UV6zhyZpVTkh6JgJ84v0a3:r7fnIU7+qyZphkhCm
                                                                                                                                                                                                                                      MD5:DC1124B64C39D41178EAD4169E4A1C42
                                                                                                                                                                                                                                      SHA1:9DC59DA757F57F38962E0F62666AD69E27754DE3
                                                                                                                                                                                                                                      SHA-256:9AD8C940416DEEEE30F70128D796C1AE6671019BD73E2DD0607187B11F8BB40B
                                                                                                                                                                                                                                      SHA-512:3E0A735FFDC9C496F9F9A32F59727B1D225AC59BA4EFAD47A5DEEB9A74BF413763042C73F38A764F6D88EB3FC9729A175106884A6B362A0CD080329F285EBFE7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$...........Y...Y...Y.........*...X.....".].......I.......4.......S.....V.....z.....X...P.L.[...Y...U.......].....X.....@...Y......M...A...M...X...M. .X...Y.H.[...M...X...RichY...........PE..d...u.$e.........." ...$..(..6.......C.......................................PA.....vrA...`A........................................ H7.\...|H7.......@.X.....>.....Hn@.x)....@..^....1.......................1.(.....1.@.............(..............................text...|.(.......(................. ..`.rdata.......(.......(.............@..@.data...xe....7......`7.............@....pdata........>......2>.............@..@_RDATA..\.....@.......@.............@..@.rsrc...X.....@.......@.............@..@.reloc...^....@..`....@.............@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\wsc_proxy.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):109480
                                                                                                                                                                                                                                      Entropy (8bit):7.403777853441298
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:gnwLFDVFM6++2tF/3B8EMhr64S0gb5DpxXs:PLFDPMTJYhr64Fgnhs
                                                                                                                                                                                                                                      MD5:75CA8458D560E6F26A7EE0475E650458
                                                                                                                                                                                                                                      SHA1:208C3669B1CF9FCBD514D71D95E4A905CC908989
                                                                                                                                                                                                                                      SHA-256:CF9C722DE59B6A7EBBA99620E45693F6F9AFFA8BE26A361FB5D6662E539DAC3A
                                                                                                                                                                                                                                      SHA-512:4AF84FB6FF1BC9D1469B6AFD9F7C0DE7A8401FADF72551939E3F0EF150B30E3187D686C900C9A0AFCBE35049EF37AA0D278BA895BBAA5D7E27FEA4B08AAF2CC1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I...I...I..."...I...I...I...=...I...=`..I...I...I...=...I..Rich.I..........PE..d...\.s`.........."..........^......P..........@....................................H.......................................................|"..(....@...V...0......Hd..`G........... ..p............................................ ..H............................text............................... ..`.rdata....... ......................@..@.pdata.......0......................@..@.rsrc....V...@...X..................@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\wsc_proxy.exe.manifest.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):958
                                                                                                                                                                                                                                      Entropy (8bit):5.229700828556077
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:TMHdt43mv18wcGkVnQfV3k6tSGKh6uHSzyi+KbF6I1ysyUvSdaMN2U5Nciq2xA5o:2dt4Q7c893DMxHhE5MPgisK
                                                                                                                                                                                                                                      MD5:7CEFA19BB1EAA218E139641AFE5F7EBB
                                                                                                                                                                                                                                      SHA1:A7E9779E8638EB304F6ED251C598BD49D050BC2C
                                                                                                                                                                                                                                      SHA-256:1E7FEF380E3B0A873EC4F19E089AF82D40E1999163F4018C316E93EFD725A8CD
                                                                                                                                                                                                                                      SHA-512:0336C0984F01FC432442A12A5D3084DFB05C9B1E44A253D1073288CFD5CE0DA4A0841CA6989047697107D553D7A04F354A6898F1D00F2F7EFD6469DD50A49F1C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /> Windows Vista -->.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /> Windows 7 -->.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" /> Windows 8 -->.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" /> Windows 8.1 -->.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" /> Windows 10 -->.. </application>.. </compatibility>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false" />.. </requestedPrivileges>.. </security>.. </trustInfo>..</assembly>

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\AavmRpch.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):599992
                                                                                                                                                                                                                                      Entropy (8bit):6.56743183204461
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:B8usglpkr/kQEl1mJZetTzVSaLLLSFvQ53+gHyibmDXj53mE+N:B8usGJAvetTb/LSFvQ53+gHyibmDXl30
                                                                                                                                                                                                                                      MD5:A244B2D7704277F00A5D9081DBC797FC
                                                                                                                                                                                                                                      SHA1:2695B88129E58476157A55879FC470C00DA8242C
                                                                                                                                                                                                                                      SHA-256:A2E62BDD0E9EBD4E4B724054150063A9A1E465399E5A046D40A4B3A30370A5DF
                                                                                                                                                                                                                                      SHA-512:3F4B881E1E5C04877126EEF42EC79BAC968E80B2DE02712E5C37575C7BD3222EDBC747D6E7A6EB6DF39DFE916CA6F328952F900AF28EFAFF97B5D9158A5ACC63
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........g]..4]..4]..4...4\..4...5W..4...5Z..4...5Y..4T.`4M..4...5F..4...5\..4I..5Y..4...5_..4...5R..4]..4...4I..5q..4I..5\..4I..4\..4].d4\..4I..5\..4Rich]..4........PE..L.....$e...........!...$............p_............@e.........................@......jg....@A............................|...<...,.......h...........H...p)......Dv..$...............................(*..@...............<...4........................text...z........................... ..`.rdata..............................@..@.data...............................@....didat..,............|..............@....rsrc...h............~..............@..@.reloc..Dv.......x..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\AvDump.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1157568
                                                                                                                                                                                                                                      Entropy (8bit):6.787616988944324
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:xcDnXsd4Lit88iyXEoiHaX3UVjRldh0lhSMXlcNXJkdV4Kp67AtB:Gv+rd6EUVjRlUmXJIV4XMtB
                                                                                                                                                                                                                                      MD5:94A5656B1E84A1D44F248C82DB8AA160
                                                                                                                                                                                                                                      SHA1:8CCDB4A21FCE368EE96844223310398FE7E44F01
                                                                                                                                                                                                                                      SHA-256:7B5E32456A56B9D05D75DDEACB142673099BA25CCBE7CA166936BFEB68E34AE2
                                                                                                                                                                                                                                      SHA-512:01B50AB4E256DDC8C3B3034B48B3C245669D1E958F6539B7CCEBA3EA3320D5906A53BF96C8F23EE487DF04807E8C08748FA4330DD1CFFA1DC14E8F4148A30CF1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......)n._m...m...m....}..b....}.......}..z....qK.o....q..~....q..z....{..d....q.......z..l...dw%.o...m...n....}..b...m.......yp..0...yp..l...ypI.l...m.!.o...yp..l...Richm...................PE..L.....$e...............$.....0.......'............@..................................>....@..........................C.......C..........HY..........H...x)...P......0L.......................L..........@...............@....A..@....................text............................... ..`.rdata...W.......X..................@..@.data...<z...`...T...@..............@....didat..(...........................@....rsrc...HY.......Z..................@..@.reloc.......P......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\RegSvr.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3658688
                                                                                                                                                                                                                                      Entropy (8bit):6.622405145369975
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:Ogz9UyPxsJGeKFvD0xHjtd9RkAUG5jwev+t6LVXiHtwqpR478vuFH+JHc1yr0gS9:OgWIxsJNKFvD49RmGl+t6LVXiNwEm
                                                                                                                                                                                                                                      MD5:911944EB39F6F35FABEAE35F6367117C
                                                                                                                                                                                                                                      SHA1:611B1F46469ABCC840C260921DF12AE51603FFA8
                                                                                                                                                                                                                                      SHA-256:A4C8160C08E1FEE7374F41A5920F1B7D5B19E2DF039CB45B4772E59400D434F3
                                                                                                                                                                                                                                      SHA-512:71299578866A96DA4C07ACFED45AA57E1D2475AB679341F5A80196439632F443F0A0B2D4ED00984BA8B1318311740BA4CD60B145DE19C3727C87874E108146DF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......8O..|.z.|.z.|.z..\....z..P..x.z..P~.o.z..P....z..Py.f.z..\y.h.z..\~.`.z.|.z.p.z.uV.~.z..[..}.z.*[..x.z..[~.}.z..\{.k.z.|.{../z.hQs.n/z.hQz.}.z.hQ..}.z.|..~.z.hQx.}.z.Rich|.z.........PE..L...5.$e.........."....$..#...................#...@..........................P8.....j.8...@.................................t.........6. ...........H.7.x)... 6.p/....+.......................+.......+.@.............#..............................text...O.#.......#................. ..`.rdata...W....#..X....#.............@..@.data...p...../..|..................@....rsrc... .....6......r5.............@..@.reloc..p/... 6..0...z5.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\ashShell.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3465152
                                                                                                                                                                                                                                      Entropy (8bit):6.666779106926433
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:S5k9vBVLKutRp9eJA5UnjWjUqoKVfRSkymb9Mxxrejk6yS78vuFwdpwl1GzyyJSR:S54BVLNtXcfq1fJaxxrejX12/xI
                                                                                                                                                                                                                                      MD5:A8573494557626363808A70A64308345
                                                                                                                                                                                                                                      SHA1:3F6E3FA2896214793E2175E742495D83B58A8569
                                                                                                                                                                                                                                      SHA-256:2EEBFAC789F3856BFFE4DABEE1E105D03F0B79609D24EC5EE070C8B68311A988
                                                                                                                                                                                                                                      SHA-512:37017502409BA4BA16883C15A2463CB0549692A84C814B46A83FFDE61EB9A311DE78C7EC3B5B1D4C348D428C7E17FED50FA85F862F02AAC8CA17F67B3142FABC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......'.k.c...c...c...............`.......r.......y...............w.......}...j..a.......b...c...o...5...g.......b.......~...c.......w...j...w...b...w...b...c...b...w...b...Richc...........PE..L...@.$e...........!...$.. ..........Y........!....d.........................p5.......5...@A..........................+.....<.+.......3..A..........H.4.x)...P3.`.....(.......................(.....X.(.@.............!..............................text..... ....... ................. ..`.rdata........!....... .............@..@.data.........+.......+.............@....rsrc....A....3..B...\2.............@..@.reloc..`....P3.......2.............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):608704
                                                                                                                                                                                                                                      Entropy (8bit):6.749475325282624
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:KY65cUxcV3Ya8HKjc7IXgNOph0lhSMXle91h1eJk:xUxqYa1jc7NEh0lhSMXl8gk
                                                                                                                                                                                                                                      MD5:A23D512FFC3253189766803809A65F23
                                                                                                                                                                                                                                      SHA1:8F658BD3D998DD4D86E7805D289BB68924F6BB0E
                                                                                                                                                                                                                                      SHA-256:983AEAA6FDA925D9D407225D50967A8C44769E20E1E3E490D9DEAA53430125CA
                                                                                                                                                                                                                                      SHA-512:5A4603AD4802ABBB85B32ADA229CD06506C94B6C3CB8F82A80CE7D3275CBA269DDFF3129FFAD86B203CF48FD49A9ED310616787A2BEE9F731FABC06FC540534D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........:...[...[...[..*)...[..*)..W[..]%...[..]%...[..]%...[..]%...[..*)...[..;....[...#x..[...[...[..*)...[...[...Z...$..{[...$...[...$...[...[|..[...$...[..Rich.[..................PE..L...u.$e...........!...$.$..."......`........@............................................@A......................................... ..X...........H ..x)...0..dJ..`D.......................E..........@............@......P...@....................text....#.......$.................. ..`.rdata.......@.......(..............@..@.data...DF..........................@....didat..............................@....rsrc...X.... ......................@..@.reloc..dJ...0...L..................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswBrowser.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):486848
                                                                                                                                                                                                                                      Entropy (8bit):6.847470716928102
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:U6GvYq5ZrEygrAXjR/Hph0lhSMXleMxVjNhG:DGvYq5ZrEdrSJh0lhSMXlRG
                                                                                                                                                                                                                                      MD5:0464FE1A8F3BC3B5DB6F802C16B8E6C2
                                                                                                                                                                                                                                      SHA1:B6FA8485907DEDD71A1A61A7FF6EB8D61F2250C3
                                                                                                                                                                                                                                      SHA-256:50969EA774C5BD76190FC7A70A4C7E4C495AAC677DDE286D859E8AFA67D448FE
                                                                                                                                                                                                                                      SHA-512:F2FADF3B239EFBB99545C0CA846448BA9FA3445AB1ACD28E32906F66BDB7FCC8F374021031B856B82C342C0A945C6E8A2E93E428D2279D0EB6661398E3530AAE
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............h.Q.h.Q.h.Q>..P.h.Q>..POh.Q>..P.h.QI.GQ.h.QI..P.h.QI..P.h.QI..P.h.Q..)Q.h.Q/..P.h.Q.h.Q.h.Q.h.Q.i.Q>..P.h.Q...P.h.Q...P.h.Q..EQ.h.Q.h-Q.h.Q...P.h.QRich.h.Q........................PE..L.....$e...........!...$............................................................!#....@A........................p...l............@..0...........HD..x)...P...3................................. ...@............................................text............................... ..`.rdata..............................@..@.data....<..........................@....rsrc...0....@......................@..@.reloc...3...P...4..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswCmnBS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):383936
                                                                                                                                                                                                                                      Entropy (8bit):6.66058206955698
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:VRWiDXXTVz8aWbMhMPfVmqgwLCugyxXOakI3C2qBvD5gpMflP5hEu390rkKKqKxz:nJjlTW0goqgwLC/BmS2AvD5gpIlDEw4G
                                                                                                                                                                                                                                      MD5:04EA0C8C53A2EEF1DA4B4AB59B1C8FAB
                                                                                                                                                                                                                                      SHA1:7E9B937FAC0E80AE4869C396432CEAFAE62CE136
                                                                                                                                                                                                                                      SHA-256:F6D8EF82CB789F50B65E2C04262BE2F4E3CDC93251FA1A0985254E5008E08882
                                                                                                                                                                                                                                      SHA-512:50E81586B55665360CC170A11E36E46BFBAF7EDAFCBB9EAC955B5D7635A52A50D97188FF39AF22FD424F90BDD88699E539A10D1BE64CB15883C9841200232D51
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........................s.r....s.....s.....s.....s...........................................p................Rich...................PE..L.....$e...........!...$.R...d...............p.....d.................................R....@A........................0...tg...`..|.......H...........H...x).......2................................. ...@............p..@............................text....Q.......R.................. ..`.rdata.......p.......V..............@..@.data...`............t..............@....rsrc...H............v..............@..@.reloc...2.......4...~..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswCmnIS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):388024
                                                                                                                                                                                                                                      Entropy (8bit):7.230225285025376
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:PwoAX9VGtJFW51mNplWdZVGHF29hjQu6M4+Z+KqejMYK96VLGooooEuH5VsLkHD6:4VVGtJFW51mNplWdZVGHF29h03zKq5Xw
                                                                                                                                                                                                                                      MD5:59987E70E1CD9C5C28321485BE6DAD5B
                                                                                                                                                                                                                                      SHA1:AFC3FE52F2D73E8A4F9BF7116CDF276688F11626
                                                                                                                                                                                                                                      SHA-256:38202849409BAFF705CD8313452BC5B3F4CD60AF5A9F587886682BB3A947CD07
                                                                                                                                                                                                                                      SHA-512:4909BC4080DA9BE8197664A2037FCBB4525897AACF2DA08E624E81FAA0FE6C59141F54F5C0C950D0C4A48CFE57FC6AEA323B404C2CF0344CB75F645AE40CFED4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..tO.tO.tO....tO.".N.tO.".J.tO.".K.tO.".L.tO.U.N.tO.tN.tO.tO.tO..F.tO..O.tO....tO.t..tO..M.tO.Rich.tO.........................PE..L.....$e...........!...$............0..............d......................................@A........................ ..........d.......P...........H...p)......T......................................@...............|............................text...G........................... ..`.rdata..^...........................@..@.data...............................@....rsrc...P...........................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswCmnOS.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):171968
                                                                                                                                                                                                                                      Entropy (8bit):6.720314790977908
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:yGUeIPFqQcofwuwxgvx90tKVm4qAYz2MqUqB5kvkApmDcjK3ptx88cS:PojcozS+Hm4rYNHkAIAjK3ptx+
                                                                                                                                                                                                                                      MD5:6260F3F8F099F2D44D6C9091A29CBC92
                                                                                                                                                                                                                                      SHA1:1440208739AE2C9A99BF0A43F56746F7DE333B97
                                                                                                                                                                                                                                      SHA-256:7E7E39F575B525EFF71CDA8F7B0BAC594B1D47A5AEFC99C139BE4B003D9DF3F7
                                                                                                                                                                                                                                      SHA-512:876898FC5DEB63D26EA5CFB8DF0386A8F2C5BC7CD6C17AE048ED262DE789DA9541166C384C51D298EF4FAF0F301FBF0067C7AA42C5A62D240304267DB4F69542
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........U.f.U.f.U.f.\...[.f.....W.f...b._.f...e.V.f...c.@.f...g.Q.f.A.g.W.f..g.R.f.U.g.f.U.f.W.f.A.o.G.f.A.f.T.f.A...T.f.U...W.f.A.d.T.f.RichU.f.................PE..L.....$e...........!...$............0..............d.....................................@A........................P2..."...T..........P...........Hv..x)......4....%...............................$..@...............|............................text............................... ..`.rdata...j.......l..................@..@.data........p.......R..............@....rsrc...P............T..............@..@.reloc..4............\..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswProperty.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1185720
                                                                                                                                                                                                                                      Entropy (8bit):6.6165531560678605
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:33zCO+IRnrodJxhl9zkcsJGpNAeF2LoJ5VIP36X1KCbRB7Kwp13gPlY78puFyRbC:mhRl9xiefQ6f77KyWlY78puFos
                                                                                                                                                                                                                                      MD5:F9379B4B405B8DF6860B4169B193269D
                                                                                                                                                                                                                                      SHA1:95F133C1E974685AB1198B1228930BEC49B2C7D6
                                                                                                                                                                                                                                      SHA-256:0DEE50E0462473979F0EBB01733A1F05710DE86D164C1CC51100102CBBA81838
                                                                                                                                                                                                                                      SHA-512:9A21E7ED0A7EEF6711C5FF78AEDFB27D38FE3B56334406CD143C75DC3AE0402CAC2696317649EA8D3612234391CA28A57A45F4046E4AC988B2132F81BFD31E2E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.........K...%...%...%......%...!...%...&...%...$...%.m.&...%.m.!...%.......%.m.$...%... ...%.|. ...%...$...%.. ...%...$.i.%.|.!...%...,...%...%...%......%......%...'...%.Rich..%.........................PE..L.....$e...........!...$.............g............xd.........................0...........@A............................X...........P..`...........H...p)...`.......................................-..@...........................................text............................... ..`.rdata..............................@..@.data....U.......J..................@....didat..\....@......................@....rsrc...`....P......................@..@.reloc.......`.......$..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswPropertyAv.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):902080
                                                                                                                                                                                                                                      Entropy (8bit):6.480316876083702
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:3gqgr1aI2AdDHiFQfGsJGN78P7i92b57FKtsl5ify:bmDzt7F1ey
                                                                                                                                                                                                                                      MD5:B05841B2CE7675B77D59FBC92BB84F35
                                                                                                                                                                                                                                      SHA1:F012A0395B037FBEB9ED6CD3919D6CEA6F8E0DA3
                                                                                                                                                                                                                                      SHA-256:50503859DCCB672A615E6BCE87B23D4B9E76CAD7EC8A6039474BE31493C19A12
                                                                                                                                                                                                                                      SHA-512:11C5490275078244A33025BDCE85E6D3FE140E40CF4AD3829A7FB295ED72F062280EE20141A244F86A38C3A8679E1EDE7CC3F3D2AB5A339773EEBB5366D5C1B8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$......._.T^..:...:...:.......:...>...:...9...:...;...:...9...:...>...:......:...?...:.M.?...:...>...:...?.:.:...;...:...;...:...;.B.:...3.`.:...:...:.......:.......:...8...:.Rich..:.........................PE..L.....$e...........!...$.B...d......pC.......`.......................................5....@A.........................^.......^.......@..h...........H...x)...P..(...Tr.......................s..........@............`.......Y.......................text....A.......B.................. ..`.rdata...,...`.......F..............@..@.data...T............t..............@....didat..0....0......................@....rsrc...h....@......................@..@.reloc..(....P......................@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3706296
                                                                                                                                                                                                                                      Entropy (8bit):6.615386448725049
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:uu9cmz2pyrS1tdv3eis/DgUEdNpynkbYFRqlMHJ78vuFZ+JZc1yr0eSn8dh+dUTB:uvmz2pAS1tdvigVdukbYFRqep
                                                                                                                                                                                                                                      MD5:EC61FA244D2671C3A9D1DFA9CE159617
                                                                                                                                                                                                                                      SHA1:3E85CF1A5AF5438D49EDC695C13145B059F5DE4F
                                                                                                                                                                                                                                      SHA-256:3658D5987586C714577B6F659B1A179CDA206081559E36F5A90BC84FBA00962C
                                                                                                                                                                                                                                      SHA-512:072472AA9E5CC04EC101F85240464E8E80883E4AD9F2C8CEA17ACAB9D408A867530A7D56AC3349C7113E3AC8845C4A98DA2C4EB7103BB7BC920F081AC7C6B625
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........_..1...1...1.].4.J.1.*....1.*.5...1.*.4...1.*.2...1.].2...1.].5...1.......1...1...1.L.4...1..4...1.L.5...1.].0...1...0.M.1...8...1...1...1......1.....1...3...1.Rich..1.................PE..L...).$e.........."....$.0$..........q.......@$...@...........................9.......8...@......................... ./......./.......6.............Hd8.p)....6..8..8.+.......................+.....x.+.@............@$..............................text.....$......0$................. ..`.rdata..jo...@$..p...4$.............@..@.data........./..~..../.............@....rsrc.........6......"6.............@..@.reloc...8....6..:...*6.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\aswhook.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):72128
                                                                                                                                                                                                                                      Entropy (8bit):6.532093648538508
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:KRvoW63e0t8dmWzGCQBx9v+xi3woukWB79xg:KRv5bGJRvOi3w94
                                                                                                                                                                                                                                      MD5:9C8145D68C988273D395EFF12EC18EE2
                                                                                                                                                                                                                                      SHA1:45A107779736E00A0D21135B86F8D588F472346F
                                                                                                                                                                                                                                      SHA-256:9B6A21A986CF7D01245431307A9E24567AEEE75E4E9EBAD842843EB1DC36A86F
                                                                                                                                                                                                                                      SHA-512:44AFC0A8F16FB47BA7C2CBF06D083B84762664C44D78C54B963243DD036393E53053035BF26AB08A8F871FEB6082C035CA17F431ADC88E7508D7F1064E370AA3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Hq..)...)...)..y[...)...)...)...V...)...V...)...V...)...)...)...V...)..Rich.)..........................PE..L...].$e...........!...$.....P...............................................@.......Z....@.....................................(...................H...x)... ..4...D...p............................................................................text............................... ..`.rdata..............................@..@.data...x...........................@....detourcH...........................@..@.detourd............................@....rsrc...............................@..B.reloc..4.... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\API-MS-Win-core-xstate-l2-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.865787421386647
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:kf5bSWAhWLW4pICSjRof0cVWQ4GWKJYmf6oEOEU+9YX01k9z3AWBjZJPP:kf5bSWAhWx2xlcomf/EOQGR9zBdb
                                                                                                                                                                                                                                      MD5:B685358B3D0F37B68A24A6862F2AB63C
                                                                                                                                                                                                                                      SHA1:B98D6706B7C922A2C93A75280E599361502697D1
                                                                                                                                                                                                                                      SHA-256:7CF73E4F69B3DFD89F3B24167F2F421B17537F3A4E707C63C675457B4FBF850B
                                                                                                                                                                                                                                      SHA-512:965580BFAB334A217625E64DC5AB8622DCD18E5377453252B0C40C8E171040411A8916145F98E1BBE7476AD140562EA52BA148BF584D3389A07C2654D122E9B4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...].R............!......................... ...............................@............@.........................`................0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.7912825681212565
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:WsxkWAhWqKW4pICSjRof0cVWQ46Wm3Kw2uF552v++X01k9z3AzsqTWX:WsyWAhWqA2xlcNKw2k5+R9zusqTWX
                                                                                                                                                                                                                                      MD5:CD3AB89FADEE9D9AB307F55390798102
                                                                                                                                                                                                                                      SHA1:7F5646953D2A90C1033CFEE8D2E6D394B05D0A5B
                                                                                                                                                                                                                                      SHA-256:915C296FABF88B9E3B43B5A570A6E8E642071678AC443C555F6E95BEE7925BC5
                                                                                                                                                                                                                                      SHA-512:5B68FBE6456897695FDBC683DD703C286531E831FA3039BA19BC376AC5F363CD0588A815156B18139B82E64AE5C9D87BEE025805658005E46D3FCE915A9F332E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....o*B...........!......................... ...............................@......<.....@.........................`...+............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.838041093068622
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:OuGh8UWAhW2W4pICSjRof0cVWQ4+WtmFpF+nasu+JX01k9z3AzsiQ+s2s:OuQWAhWU2xlcLpUad+JR9zusiQ+Rs
                                                                                                                                                                                                                                      MD5:4228B8901E130B70052DA8562DC7B5B9
                                                                                                                                                                                                                                      SHA1:5007D4DA77465C38D66689312418ACBEF9C7AACE
                                                                                                                                                                                                                                      SHA-256:67F4D89F85A61B18AC1F5D6D04F625D64BEDB252C219FF9785CD1508876BC718
                                                                                                                                                                                                                                      SHA-512:CB42B5A184FE08DF207AC391C3E87D44DBA15008EFE2CAAA0774439E8F7DF2EC35F63E981D080FDB8FE2F46E8A43FF58A332D6CD241313CE419FA2EA0AC2F40E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....$=............!......................... ...............................@......[m....@.........................`................0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.7979730317248395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:OKWAhW8W4pICSjRof0cVWQ4GWzyB9g8YIN5vCX01k9z3AiR62EIY3:OKWAhWy2xlcD9g3UJCR9zdR6F33
                                                                                                                                                                                                                                      MD5:BB66DD4C715754BFA99ABBCBEE3A4449
                                                                                                                                                                                                                                      SHA1:21A9BEF9112C1A614BF3D5F6EB2D2F0F17B58531
                                                                                                                                                                                                                                      SHA-256:55804126146C7C575ADD104EEC386F161672CB740E765EAAF7EC8707A7CD2AF6
                                                                                                                                                                                                                                      SHA-512:AA3B8EC6C34CE2D162783595FF3902CC1E8812EAD15F2E723FEB82FB0202F654D7E1138E4B3F83C7CC0204E15C41A34AD0B1D07FD3BFA609E97C01241271D136
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...34C............!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...p........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-debug-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):6.813887287689963
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:6PWAhWxW4pICSjRof0cVWQ42Wp4KjVyEBsvH3Tz7PX01k9z3Aeu6C2m+k/XIW:UWAhWX2xlc3KjV72vH3rPR9z/unVsW
                                                                                                                                                                                                                                      MD5:1C76698D36FCE20D2919E67E3F08BFBD
                                                                                                                                                                                                                                      SHA1:EB85DF5D35CAD00EE7EDA50E8A4ECEB2490F9245
                                                                                                                                                                                                                                      SHA-256:D95F01FC571294B128D0CFDE5E68472B8F6A0B3DD5F0C18B676E3A077DF80CC7
                                                                                                                                                                                                                                      SHA-512:7B0A9DE7A2FAB1B969B469F7E7EDDE93B9EDE530080F4090CA0066642CE6BBA28023BDB8AC5BD85EAE38D918549BE7066981A08263A3FE2A657A5CEC15C62487
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...{........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):6.855137976784341
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:oTYimxD3vWAhWVxWCYtvnVWQ4+WcilnvpF+nasu+JX01k9z3AzsiQCkL:oTYi8WAhWVw7SpUad+JR9zusiQx
                                                                                                                                                                                                                                      MD5:B2EAC5C213CC442820167617D568E179
                                                                                                                                                                                                                                      SHA1:9E61BAAC12E1A536BE5E553530DB8957AC606D37
                                                                                                                                                                                                                                      SHA-256:8B4A9BA2855247ADDDB4EE1E7F503DAD5674EA7BB45015BD69CC83A3332F696B
                                                                                                                                                                                                                                      SHA-512:AF7A8E6E16B86D4E2AA3141FD41A8C897957486B4D87D8ED14210590E86577E030B4B7C419ED988D22851C5FDF75236C23560FD855ADA97A76459C9C93802C83
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......L...........!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...&........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-fibers-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.788099825751135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ztWAhW0W4pICSjRof0cVWQ4GWxlRrZYIN5vCX01k9z3AiRLnq4Khl:pWAhWK2xlcMGUJCR9zdRLngv
                                                                                                                                                                                                                                      MD5:38646CD15AC25A8D71BAB09D5B077338
                                                                                                                                                                                                                                      SHA1:4C153622A3F069480A194BF98ADD276F9138E168
                                                                                                                                                                                                                                      SHA-256:CB9F01AF9BA4B50C604633073E4003652F1E99FAFF93DAACD4502D4C08177688
                                                                                                                                                                                                                                      SHA-512:43844F5E82C7BF6A485A5411CE19AAD3BB0F418852B86BB479F41170D85E04D02EAA76092B84AC7A1ABF14B285D66FA2FF891CC9C97BBC18633AF14EC44CEBB5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...H........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16352
                                                                                                                                                                                                                                      Entropy (8bit):6.722095635043758
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:7USYPvVX8rFTslWAhWrIW4pICSjRof0cVWQ4GW/SvP1MobYIN5vCX01k9z3AiRpF:GPvVXHWAhWrG2xlc02deUJCR9zdRpdD
                                                                                                                                                                                                                                      MD5:4D0399F0050B13586B8B04F62E95B16B
                                                                                                                                                                                                                                      SHA1:407CA079A3BBE2837203BEABF41516FDBA776A16
                                                                                                                                                                                                                                      SHA-256:420395AC9AB87ACCB00FA478BE0B73B583A42D406D1341D98A77F6189B556998
                                                                                                                                                                                                                                      SHA-512:8908CBF7CB7B87FC78A2BAA1EB2AEF52303E733987891361DB07098FB70D776FE936D48221A846787D67ADCFBAF30AD93B867D5578B7DD566FE8ADDC480CDA18
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M............!.........................0...............................P.......@....@.........................`................@...................%..............T............................................................................text...g........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12784
                                                                                                                                                                                                                                      Entropy (8bit):6.827220177003608
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:hWAhW/WCYtvnVWQ4iWBnTCFaqDu0K9X01k9z3ATd8gl:hWAhWmcTCFYj9R9zsd8gl
                                                                                                                                                                                                                                      MD5:918B087149A2571D9DB1EB04878C3603
                                                                                                                                                                                                                                      SHA1:AA1D2C7550DF6EDDD2E99B44AC9DE925888281AD
                                                                                                                                                                                                                                      SHA-256:B2546E21336714858D2B03D2532B6955DCD7FF46B30435F6D309D8C39D0DC957
                                                                                                                                                                                                                                      SHA-512:07C0D13E505C69985D6354C450887260345DC59468EB82B9B0534D1BD13F5F960D2D56932B204B300AC7E5F0FF7234C5E459DE06D0E466FBC3F710FB9551793D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...@.E............!......................... ...............................@............@.........................`...L............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12760
                                                                                                                                                                                                                                      Entropy (8bit):6.918975659839121
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:MnTWAhWWkWCYtvnVWQ4GWBbMwDvWrkAmSGL16X01k9z3ANoKLj0o:aWAhWW/HwLMB+6R9zqoKLj0o
                                                                                                                                                                                                                                      MD5:320629A907048B64A99EF484417DF721
                                                                                                                                                                                                                                      SHA1:0DE1886EAE33BB5F16DE27D647048A92586259D4
                                                                                                                                                                                                                                      SHA-256:B5823CE2D6E600EAF4E2B1353600DCA0351C46D014F97AC525C3EE9DAFB2BF4C
                                                                                                                                                                                                                                      SHA-512:6567CD36297CB05ED301E5F7EEC87A5F796AEB9FB63BA30CBE73087BBE9539E2DC47A11947C8461CD79EAD01052999913143D32ECF4CBDF5833A970E61D5BFC4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...X./^...........!......................... ...............................@.......}....@.........................`................0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.8303046589095375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:UWAhWMW4pICSjRof0cVWQ4GWMsLQuC1/or7o0X01k9z3An6rRi2k:UWAhWC2xlc4Li1Z0R9zM6c
                                                                                                                                                                                                                                      MD5:0E37F414237E14F395F8914AC2532581
                                                                                                                                                                                                                                      SHA1:2B06C81103D7C94075DD63A8DF33B72FFDA75D2B
                                                                                                                                                                                                                                      SHA-256:3AB7F3707A380352C5AFF32C0761C5FF86F358F3683B1DD273DA8BE18F6521A1
                                                                                                                                                                                                                                      SHA-512:3E226DD4A8C2ABA7FC81132840E8087BC2FBC11096098345051D6EB1DC724F3960789F7F958D362C6CBF7D58904BF5EC7AC84945730256A50583C41DD2135BDA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@......t.....@.........................`..._............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-heap-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.782547191454355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:AlyWAhWJW4pICSjRof0cVWQ46W3DAkuF552v++X01k9z3AzsqWioCJ:AlyWAhWP2xlcqk5+R9zusqWioCJ
                                                                                                                                                                                                                                      MD5:E36E88531F284B1135617B91F73E5EC7
                                                                                                                                                                                                                                      SHA1:DAC7D7984C7F906F66A2EADEC395207A4FD9A599
                                                                                                                                                                                                                                      SHA-256:0C25F2284AEC3AA7DCF6432BA9416E2FB289E08BBD996BCDDADAABE42E361B46
                                                                                                                                                                                                                                      SHA-512:7E2F7095BBA85A3D6AA21CD7371B73D9AEA6B07D89A82C448A65F3188D9365A0070CF8B5312A3EF0EAC1E4A2D79EB3D34DFBD7A16A7D9DA19545EA216C195C4D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......0...........!......................... ...............................@......!s....@.........................`................0...................%..............T............................................................................text...h........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.817391673996852
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:b/YsFwWAhWAW4pICSjRof0cVWQ4+Wpzy50Nr7OxX01k9z3AzsCT8tuq:7YsFwWAhWe2xlc8y50ZSxR9zusCVq
                                                                                                                                                                                                                                      MD5:F6F0270F98F5CF857D1E0667819FC9D6
                                                                                                                                                                                                                                      SHA1:959209E5E068AA2564F4F777E1C8616A9D4CB6A0
                                                                                                                                                                                                                                      SHA-256:616AC120E3B9ABB6F245A09FC17398BEF10C5E6AA617849FE68A89EFDCDDB7FE
                                                                                                                                                                                                                                      SHA-512:1EF69BCF037E2EAD4B4C3518A8E8E3C2DD3065049649A6973AAED9300FF6FEF4BC2BC25F7D0B92DC4AB5F6A576850537CE9D6E00090AF86512D080417EDA42C1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...2..............!......................... ...............................@............@.........................`...Y............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-libraryloader-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13792
                                                                                                                                                                                                                                      Entropy (8bit):6.788424378249495
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:9xvuBL3BBLIWAhWzW4pICSjRof0cVWQ4GWm5tOEU+9YX01k9z3AWkG9zzg:jvuBL3BCWAhWZ2xlcDtOQGR9zBbpzg
                                                                                                                                                                                                                                      MD5:AE1EB2E7A5DE49E2950CD2F7892D5513
                                                                                                                                                                                                                                      SHA1:AB7EA36F3C4232F0B3F6036EDECFFDD4E8603936
                                                                                                                                                                                                                                      SHA-256:23FBE7263CA595AF627FC37E774FC6FD5F66DAECB54E38D48486C9DF09E438F4
                                                                                                                                                                                                                                      SHA-512:EF919E89DBFE93EA2F45E01913C9B7D1695520F3D0073F2B578EF814E3DD6443BB506E5766D09D41E802F9C2CB4D35778C87F86FAA89BAF7DCE66DA787B85418
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....p...........!......................... ...............................@......Z.....@.........................`................0...................%..............T............................................................................text...n........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-localization-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15864
                                                                                                                                                                                                                                      Entropy (8bit):6.6984314860813585
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:nOMw3zdp3bwjGzue9/0jCRrndbNWAhW8d6C/P/R9zJn:nOMwBprwjGzue9/0jCRrndbRYmPZ9zl
                                                                                                                                                                                                                                      MD5:C542C43D910DD6AE2F4A7CFFEBCCF613
                                                                                                                                                                                                                                      SHA1:02086FD8E53FCB3AC20CD4AABD730D46458D698F
                                                                                                                                                                                                                                      SHA-256:230DA452A8068FF5BE158D84618C9D291BF9B8BC878ED5D56318558D52E4966A
                                                                                                                                                                                                                                      SHA-512:364AA5A59C10D95C6A93024A443972A06DFAA1693C942BCA517700BCDDB9372AAE1C76BDF35453A5EA256179FA61586922CAE7D22F4623135FE7168B5BF04153
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Tv.,...........!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...'........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-memory-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13272
                                                                                                                                                                                                                                      Entropy (8bit):6.822082179031021
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:hlxpWAhWWxWCYtvnVWQ4OWclDuu0t5equ/X01k9z3AFprTVKo:9pWAhWWw3ul56/R9zgZb
                                                                                                                                                                                                                                      MD5:2B3EAE5E560BE8C87A246D0E8FE3F593
                                                                                                                                                                                                                                      SHA1:8F9563BB72FBEA30D37A27C353DACEB552279603
                                                                                                                                                                                                                                      SHA-256:B858256AA6A926F89714F21790D25E90B7DEA5096BD9935454A8B4C7ABEA736C
                                                                                                                                                                                                                                      SHA-512:E33E50380D37F075B8D7FA283D5B4005CCBD7C35AF1D11DC6EA4F4529C39571F50114D2C678061DAA47F6B36BDA9C948CA724ACB9AAF9595ED7CAAEF2B0C0359
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......6...........!......................... ...............................@......WI....@.........................`...l............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-namedpipe-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):6.920374918240422
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ajWAhWbQW4pICSjRof0cVWQ4+WsCC/pF+nasu+JX01k9z3AzsiQ1wl:ajWAhWi2xlc7Z/pUad+JR9zusiQ1e
                                                                                                                                                                                                                                      MD5:4EE09CE90A33FC4F885539370D3AB11F
                                                                                                                                                                                                                                      SHA1:023FB903CB6DDD95E25F18FD72E1B57B4A5CCFF2
                                                                                                                                                                                                                                      SHA-256:4B00D5BE82D9EAE3445B559F4EB1C62EB192F5554B9EDAD50B09F98FBC65C126
                                                                                                                                                                                                                                      SHA-512:AFDD5F50FECB5ADA09A4D8217F1DB396A2501B4EA14DB90267CE51E964536A9E7C32CC55B5A8239C357F9146A7F4FA601181B7B8222670550667FAE95D55BCF4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Nc6............!......................... ...............................@.......q....@.........................`................0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13808
                                                                                                                                                                                                                                      Entropy (8bit):6.783934450733399
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:R7rWAhWuWCYtvnVWQ4iW5OIzpq21eX01k9z3AwihFaP:R7rWAhWJwtl8R9zniPaP
                                                                                                                                                                                                                                      MD5:9C46E030383D0F85A113A1F3B7477A77
                                                                                                                                                                                                                                      SHA1:7F762360A7CB9881FA9C153F42F3A39BE89DB946
                                                                                                                                                                                                                                      SHA-256:D08D50EFF27E71AF2E72655EDF22DBDEA85346CC14BE53C48988A3C039FDF17F
                                                                                                                                                                                                                                      SHA-512:6AB0490D9EB82F010DC4BDEA8E54B9B760A417A44BB88A7BC74CE7D61833E355CEF54712F3340B37FBDF07DBCD83E17295AB546D864AC06E84E0BBB7D8DD8649
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Q.B............!......................... ...............................@............@.........................p...G............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15336
                                                                                                                                                                                                                                      Entropy (8bit):6.69267746110201
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:m08uk1JzNcKSI5WAhWYwFicr78QtR9z/nw:m08JcKS0UiTQP9zI
                                                                                                                                                                                                                                      MD5:FC776A56634728A146211939D14187B5
                                                                                                                                                                                                                                      SHA1:F8372701BA9EE1A51ECF4649C74E27D1E996A45A
                                                                                                                                                                                                                                      SHA-256:CA2B5493A6699756B3BF63D9BD807B0204419EC3087D02F4BB5C7B01E8FFFD4E
                                                                                                                                                                                                                                      SHA-512:DD468A46C62E8A5A2EE64332522D5CA5F8093B13722E13CFD996B32B6EFC74CC2A8502B44CADA19EC0C30027DAB400C8567C84937F08CCD989D8A0B75B470A75
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..../.............!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...C........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13280
                                                                                                                                                                                                                                      Entropy (8bit):6.857484365166126
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:qBhgDfIeBWAhWqp2xlcQYwOQGR9zBYjOij:W/eFN2xvOQ69z6Zj
                                                                                                                                                                                                                                      MD5:51B851EB7B58CA2C3280DEF9722A9602
                                                                                                                                                                                                                                      SHA1:75AA3331EB7DA58868F700158DF56FB49E3C4507
                                                                                                                                                                                                                                      SHA-256:9F0D6EFB48C7F8C0F001EC30D45558C5D8675C06573ECA7C8125A7D5A1DB2634
                                                                                                                                                                                                                                      SHA-512:E9B0C683B58ECDBA5D5132F6808EA2DD85A3DB3B0D9690EFB54AEEE92C29B8B2B4535437D861D2FA2A8033E623AEB4EE0661DD01E17527A74D6002C9926E8783
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../H)............!......................... ...............................@......9.....@.........................`................0...................%..............T............................................................................text...:........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):6.783998159148335
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:GCWAhW4W4pICSjRof0cVWQ4+Wsksvy50Nr7OxX01k9z3AzsCTjP/079:GCWAhW22xlcQsvy50ZSxR9zusCPc79
                                                                                                                                                                                                                                      MD5:5E50911343631E123B2DE2D19AD5E2EF
                                                                                                                                                                                                                                      SHA1:48F0330E58E1A17A72BFC9B1283C8EADC96E1CCF
                                                                                                                                                                                                                                      SHA-256:B3CAF7155167F5D1D4ADA4DF4764BC78B85032BB769E5EF586FCAB27FD681CB5
                                                                                                                                                                                                                                      SHA-512:EB6E19B6B51A4422A861615D1F1D0742473E49EB4FF4A2A25C84BC485B9DB336F14E3EE83AFE8D221D91466EC7AE436B1210288EE3328A2EE0F66ADDAE3BE953
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...h..............!......................... ...............................@...........@.........................`................0...................%..............T............................................................................text...5........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):6.793090041510247
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lGtWAhWnW4pICSjRof0cVWQ4+WsIIWy50Nr7OxX01k9z3AzsCTllQ:lGtWAhWl2xlcCy50ZSxR9zusCI
                                                                                                                                                                                                                                      MD5:F04D8CD1C228B2A9321429BC9D72599E
                                                                                                                                                                                                                                      SHA1:6695FC5CBEE5C73077C59EF514353A4E2D6485F8
                                                                                                                                                                                                                                      SHA-256:498D2F02F5FE0A73CDAA1617BE6BF7B2B550ADA0537F8B1673C590EA99429C30
                                                                                                                                                                                                                                      SHA-512:AFA2BAA1A7344E795E325CF3B757371978D5E1C2288C31354095F4C30A4D308F2D405FD00B4EFA86FEF5830930A247DCED395F11CAB49E6A620DF2241ABBD069
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....O............!......................... ...............................@......E.....@.........................`................0...................%..............T............................................................................text...H........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-string-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.880943836661903
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:VDU5yyMvBWAhWgW4pICSjRof0cVWQ4GWuE9SjuC1/or7o0X01k9z3AnR7tAr2c:xyMvBWAhW+2xlc9Z1Z0R9zMRhc
                                                                                                                                                                                                                                      MD5:796E70F25FAF0353EBA92C001569C976
                                                                                                                                                                                                                                      SHA1:2B427D0AD6E6ADA06C012860A532DA24E3F1A8C0
                                                                                                                                                                                                                                      SHA-256:9E153DBF1C157A910DFC62D1F1AE6C728AE3D5F2B767C5659A6881CECD35D8F7
                                                                                                                                                                                                                                      SHA-512:E0A2B6716ADD6542DE78D409A4986A57A7D2E7D10672A57BC5A44FCE3E65E365727CC64E9FB34DECEEEEC96B544D22B0901605985F5CCE7F11341A00F898B56B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...6..............!......................... ...............................@......o.....@.........................`................0...................%..............T............................................................................text...R........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14832
                                                                                                                                                                                                                                      Entropy (8bit):6.7644485568795725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:QdAdv3V0dfpkXc0vVanWAhWRosTKAR9z8XtMgkg:QdAdv3VqpkXc0vVaD/s289z/g
                                                                                                                                                                                                                                      MD5:C748312B0F6DFA5440BFECBD094F9180
                                                                                                                                                                                                                                      SHA1:D991110DEB52177634630AB6165E195EA62AB1BD
                                                                                                                                                                                                                                      SHA-256:7966A70A6113A131C563914F8CC7ACFD8B8922D8EF1DDB2A18CAEDE076F1ECA5
                                                                                                                                                                                                                                      SHA-512:C5554EA1436D27FF336D7E25F6F68D485C65D916389213CB9C33DF2622CF08314411CE941482C03A251E214E2FAA72ABD266E2CCD444C95C65F12F78EDA5A830
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.................!......................... ...............................@...........@.........................`...V............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.890507114016678
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:v5tZ3AWAhW5W4pICSjRof0cVWQ42WJRXyEBsvH3Tz7PX01k9z3Aeu6C2m++nfFVl:htZ3AWAhW/2xlcwX72vH3rPR9z/unVVl
                                                                                                                                                                                                                                      MD5:364D65FE7F976FD00702F5BD63EEA9B3
                                                                                                                                                                                                                                      SHA1:E40359ED2E2DEB198CAEFEDC27ACF8C7715FC80E
                                                                                                                                                                                                                                      SHA-256:85FD25863A60E7C627494DCF14B169480023C0B8E4682A0E495F4F7389407149
                                                                                                                                                                                                                                      SHA-512:DFBC7B8660A7B96135CE0B35C8F2F576E536E8F8BFB53EE268611FABB4DDC4C53FE06A1A9E81FF26A8E10DAFC40EEE5D579A2BD1E19D7517BF6F089C605ECE6C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....dML...........!......................... ...............................@............@.........................`...v............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-sysinfo-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13800
                                                                                                                                                                                                                                      Entropy (8bit):6.790709695342145
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lSWKIMFEWAhWEWCYtvnVWQ42WyoIYqYUHGHtX01k9z3AenwO+:lvJWAhWf9Y8QtR9z/nwV
                                                                                                                                                                                                                                      MD5:7EBB75A1000E52570CA55C35DFC7BD6C
                                                                                                                                                                                                                                      SHA1:764DC860173990E451F6AEB6FD9B0164A86E447E
                                                                                                                                                                                                                                      SHA-256:2B151CCE07A4D9C8507A1C547FDCB6AD904F9EBEEEE71439D6151EEEE287984F
                                                                                                                                                                                                                                      SHA-512:6D9C127CB35C122CB028EB9E8E7CDB466DC7B429AE8A13EC818DF96917120F5E1F47902ECB3ECCE9DDB1379029C63DB3B6504D83DAC8B6342484124902672C09
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....LO...........!......................... ...............................@............@.........................`...E............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.883286371960575
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:l3WAhW0W4pICSjRof0cVWQ42WjgqMyoDyEBsvH3Tz7PX01k9z3Aeu6C2m+qgEA:l3WAhWK2xlcMk72vH3rPR9z/unVBA
                                                                                                                                                                                                                                      MD5:2A21692EF3A54E5F4A016A3A1767A7D9
                                                                                                                                                                                                                                      SHA1:9890261F7CC42D660371C1B9D3A96C09B1E48783
                                                                                                                                                                                                                                      SHA-256:01F6B2760031ED0D521E8D972A6E7B4AA05393934A37266C3F9374042CC97B3B
                                                                                                                                                                                                                                      SHA-512:7EE03077C29867A717245BBCC1F4C7AFC425C5E248C7C70F884E3AD0BC0267F95B94EA2F47E3554B2D189160D56BA4A6924399BC80201FDE24CBC943894E60AF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!......................... ...............................@.......\....@.........................`...E............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12768
                                                                                                                                                                                                                                      Entropy (8bit):6.803101193435519
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ynWAhWlW4pICSjRof0cVWQ4GWnfWYIN5vCX01k9z3AiRLNZcY:ynWAhWj2xlcWZUJCR9zdRLNx
                                                                                                                                                                                                                                      MD5:B179B9F02A2A42A92C8EEE8722D03745
                                                                                                                                                                                                                                      SHA1:86021FFB09E59A781E96158C8F5FD7B63EF950E2
                                                                                                                                                                                                                                      SHA-256:9C57A5FBAA0A57530B988A4AADA32E378B1CBD1FE368B90E147F12069C8AE7BC
                                                                                                                                                                                                                                      SHA-512:4FA0BA86B83D4D3EE041772CC59C17407D02EEF04385AD9C6D63547FD9E039A90D5A161B9ACEE7AF9DEFCE761FF47E288207F60B2B81A28CEBE73EE1D68F0482
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...^yk............!......................... ...............................@......~.....@.........................`...9............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13800
                                                                                                                                                                                                                                      Entropy (8bit):6.8218152371465965
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:5XwnYmyWAhW0xW4pICSjRof0cVWQ4+Wi1NXp7uF552v++X01k9z3AzsqavP:7WAhW0X2xlcB1xp7k5+R9zusqaP
                                                                                                                                                                                                                                      MD5:410FB7ADFC54094B95609747A5376472
                                                                                                                                                                                                                                      SHA1:E2E79F589A2E71009D9947BB02F05B877E208266
                                                                                                                                                                                                                                      SHA-256:77F2E7E09FE542EA78F4F6F23440014461074B993E50BF75D02B2C6571F5D696
                                                                                                                                                                                                                                      SHA-512:57FC04E4C770766EE9C2CDF7EC166792FB4164D7657FBBB6A6EC74A5073DE953860B7C1D5754B28B61A83B7BB1CC0A1417A2F13C246AA06044045687B207BDDC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....2.7...........!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...P........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16872
                                                                                                                                                                                                                                      Entropy (8bit):6.619598473262738
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:IK1Tgy1WAhWy2xlc3sHpUad+JR9zusiQ1:IKvr2Wadk9zue
                                                                                                                                                                                                                                      MD5:03C2C3D48CBA89A77A8C06158056AAA8
                                                                                                                                                                                                                                      SHA1:3CF294991250721C2100288D4DBCB0343CC04BF2
                                                                                                                                                                                                                                      SHA-256:43E0C37DA7BC6B2786F95765F14177651BEA534CA4D1D966C79FC301A55AD5DF
                                                                                                                                                                                                                                      SHA-512:BD9787EC2CF87F8C790DB18724A5CC10D1A6DE005FA8CC6A74733521BB11251BD0D026AF9468E98B616A6D8212CB41C3DA102248E105A4B312D7B068E9C407D0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...w9.............!.........................0...............................P......+.....@.........................p................@...................%..............T............................................................................text...^........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-environment-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                                      Size (bytes):13280
                                                                                                                                                                                                                                      Entropy (8bit):6.803961934914377
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:+FWAhWhnW4pICSjRof0cVWQ4GW2BCGpOEU+9YX01k9z3AWuhf:+FWAhWhl2xlczCGpOQGR9zBut
                                                                                                                                                                                                                                      MD5:490C63E6B1ABA9A525404067CE3C20B6
                                                                                                                                                                                                                                      SHA1:04997F8A146284F8369C7DB6204949658D6D7180
                                                                                                                                                                                                                                      SHA-256:C5131D1ABD188D009E72B8C6474C74A262B7B8EC504470385F7F69428E7AE0E7
                                                                                                                                                                                                                                      SHA-512:245C4E2545E7EB5462E20E12D8092CDABA24D48E6C53D02F3EEC586DE17EB9CB6C15CEA204A18DEEEA3CC8668C8AFBE9F35B0FC1E751D2F515EDD18AE149D275
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....|............!......................... ...............................@.......(....@.........................p..."............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15328
                                                                                                                                                                                                                                      Entropy (8bit):6.686565439146664
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:S3nWlC0i5CtWAhWReUW4pICSjRof0cVWQ4GWGiqXiuC1/or7o0X01k9z3AnQcn+:S3nWm5CtWAhWReq2xlcxo1Z0R9zMQO+
                                                                                                                                                                                                                                      MD5:D1F28F796BACEA3D58ECA271FD128758
                                                                                                                                                                                                                                      SHA1:934EFDE030A54A441C342AF18AB5275E5FACD0E8
                                                                                                                                                                                                                                      SHA-256:B8D3D45141AD57D917B25D2491A07F20C77B1DFD047E203E26DAD591C40B225A
                                                                                                                                                                                                                                      SHA-512:4B6ADA7F10A4A660C3B6AC0FD81A41C680BD6752EB1A70DA08510FEB10FBF2B7D5EE177A94D5093239914EEA79114097329A64067A72068A8BAEA8A9963E3901
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....q.\...........!......................... ...............................@.......X....@.........................p................0...................%..............T............................................................................text... ........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-heap-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13800
                                                                                                                                                                                                                                      Entropy (8bit):6.773855214164896
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:aveY17aFBRYWAhWYW4pICSjRof0cVWQ4+WJoqepF+nasu+JX01k9z3AzsiQ7v:avz1WAhWW2xlcFpUad+JR9zusiQr
                                                                                                                                                                                                                                      MD5:0651BCD9ACADAC1D50653BE35378A82C
                                                                                                                                                                                                                                      SHA1:5D1B2233C7ACB3915D33F7B29CC2F0CBF34EA1AD
                                                                                                                                                                                                                                      SHA-256:FCF66176B6F7AB86F98F38D5662F61FA61AD3F1E59740D8A1DF0E1072248CF6D
                                                                                                                                                                                                                                      SHA-512:1CE05989181FAA8D291BB0DF34BB4E93F2F576187CF2D0C5110988CE17E6A682D815297FCC9FD174BC1791713FB07B616ED952729923ABF8C06B8B8F6D71D82E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...g.[............!......................... ...............................@............@.........................`................0...................%..............T............................................................................text...v........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-locale-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.886277172503961
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:2yWAhWdW4pICSjRof0cVWQ42WTa3IyEBsvH3Tz7PX01k9z3Aeu6C2m+MOrL:pWAhW72xlctI72vH3rPR9z/unVcL
                                                                                                                                                                                                                                      MD5:592A65B922D4CD052BAE1957BE801A4F
                                                                                                                                                                                                                                      SHA1:8371486CE1B38E692C0ABC4A2A9E0C3E1945BB89
                                                                                                                                                                                                                                      SHA-256:D78E74087D151454365ADF6239967C8ECEBE85B1C6C6D3F59E70F0980028B1E7
                                                                                                                                                                                                                                      SHA-512:0837209E518D5DB76CEB8128DD49CF03B8F0D11526630AD20C716ADE1E02DF1B39A8440D20EE20B488C6D6180C155D00A9CBBD311FC50F4803A8B95D4A545726
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M...........!......................... ...............................@......G.....@.........................p...e............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-math-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23528
                                                                                                                                                                                                                                      Entropy (8bit):6.337582200826521
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:6QF2KmbM4Oe5grykfIgTmL6WAhWuSP2xlcLek5+R9zusqG:6tMq5grxfInMq2Mhg9zuK
                                                                                                                                                                                                                                      MD5:46AAECDB8D337980C82CB2714A985986
                                                                                                                                                                                                                                      SHA1:22104D2272B592A344DF5B575FCFF83CA0E4B161
                                                                                                                                                                                                                                      SHA-256:34457A002E90A590B516BBF58530CDDDBB618A46BB3E764E18167C44934917DC
                                                                                                                                                                                                                                      SHA-512:33C91058A693B82F1457D49BBA2E209A90B825927BE89E38523671AC16F4FEF208B98EFA980A3E11185BAA4DF6D7639D447BF30E19DC91B76F04EE61B6169BEE
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...|.LI...........!.........................@...............................`.......5....@.........................`....+...........P...............6...%..............T............................................................................text...7-.......................... ..`.data...@....@......................@....rsrc........P.......2..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20968
                                                                                                                                                                                                                                      Entropy (8bit):6.360149909169691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:A7aLPmIHJI6/CpG3t2G3t4odXLJWAhW32xlcJRk5+R9zusqYcs:8wPmIHJI6fC2m+g9zusJ
                                                                                                                                                                                                                                      MD5:7442E7059F712705D4B97699BF56DE35
                                                                                                                                                                                                                                      SHA1:F924088428EDA3B76030091CF59AD38AFB590118
                                                                                                                                                                                                                                      SHA-256:F822289EA5A9B0CCF9777A72BC8B73CE68B596FCCA811E0CFF0ADC4031056B20
                                                                                                                                                                                                                                      SHA-512:DEC6228063BBAB561AE0C02CBCBAB3D08C15F261758405D8A709707A180A09AF9C462B0B382B700177F285A1CE3BF7E71E093F9031D15F932120FBFD396AA851
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L......F...........!.....$...................@...............................`.......S....@.........................p.... ...........P...............,...%..............T............................................................................text...d".......$.................. ..`.data...@....@......................@....rsrc........P.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):67560
                                                                                                                                                                                                                                      Entropy (8bit):5.596721598604506
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:E8tFDe5c4bFE2Jy2cvxXWpD9d3334BkZnkP962MzuN:3rDe5c4bFE2Jy2cvxXWpD9d3334BkZnM
                                                                                                                                                                                                                                      MD5:3B07ABBE272E9B9E2989E2D6A400FA53
                                                                                                                                                                                                                                      SHA1:F925E5E58377DCDC13B6D80FF22C775E2334E372
                                                                                                                                                                                                                                      SHA-256:A170D9851A1427066D1FD61C32A9AE4B9545AA926BE55DA7E7D94275BE281DC8
                                                                                                                                                                                                                                      SHA-512:14762C984AA6736B1330B1F0B296622FC1CE3AC79108C0BFEE793A51131DEACD09B494E8C851C6E437A84871A864DD65389657DF8B2256F931E3C60A61FADE8B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../.1............!.................................................................\....@.........................p....................................%..............T............................................................................text............................... ..`.data...@...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13800
                                                                                                                                                                                                                                      Entropy (8bit):6.791663954423652
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:VriNwF5uSqjd7VWAhW6dW4pICSjRof0cVWQ4+W5buF552v++X01k9z3Azsqee6Sm:gNcuSUWAhW672xlcok5+R9zusqh6j
                                                                                                                                                                                                                                      MD5:0444624F30E8030D84BB169FC2410444
                                                                                                                                                                                                                                      SHA1:05C1CD844368AE2C113585B477F91507430D72A0
                                                                                                                                                                                                                                      SHA-256:0B87358DA7882FED313FACEE92BB8F4E45299C63CA557FDFBA1478B364575FC5
                                                                                                                                                                                                                                      SHA-512:648A79FD30A73582907C7CA008BE5EF78E6E72AA22478448721C4C5BAD45A45BF76570D24E061DFAE5E535666E79154F5F9F66A08746313620A17582E3998304
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....#.~...........!......................... ...............................@.......u....@.........................p...x............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17896
                                                                                                                                                                                                                                      Entropy (8bit):6.539603838553321
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:+9ojOShrKQWAhWv2xlcxopUad+JR9zusiQCp:+9yPrKKC2qNadk9zu5
                                                                                                                                                                                                                                      MD5:90340AC74D22B9A67237EA52A4DC1C75
                                                                                                                                                                                                                                      SHA1:75D44B240AFD4198B0F3B7256A4A9533AD1BA73F
                                                                                                                                                                                                                                      SHA-256:FD48DA616F2D17054BCAB961239431D99C247586F96BAC69AAC5B704EA694352
                                                                                                                                                                                                                                      SHA-512:6F52AE85B4D9AB8516D72BB1662AC9CF602092FC61EA78BD85AF05047C70A0ADC5EDB67266032F12A86601C983015276F15A457935F5B6143DC80D335351E5EC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!.........................0...............................P.......U....@.........................p................@............... ...%..............T............................................................................text...5........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-stdio-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18920
                                                                                                                                                                                                                                      Entropy (8bit):6.55763736754846
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:rx+tFVhLWAhW22xlcLaj/y50ZSxR9zusC+1:V+txj2Vm50Zi9zuk
                                                                                                                                                                                                                                      MD5:85444893A6553A4DD26150A68FD373D8
                                                                                                                                                                                                                                      SHA1:AD9B46DA45366F13A22173B06E22A45A211E99EC
                                                                                                                                                                                                                                      SHA-256:65F2A93490C845833541DE1376D5BB65E6E864A1A9232F58F86A7A84408508C9
                                                                                                                                                                                                                                      SHA-512:AD56F71D0DC6D2DC5DD46EAA00247BD209403014648FB9C8F98937FC8E36FC85C0107365D2F6BA4F6D530F340278E0205D94BAFEBC78D10201E71DBB5D4C36D6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....V2"...........!.........................0...............................P......!.....@.........................`...a............@...............$...%..............T............................................................................text............................... ..`.data...@....0......................@....rsrc........@....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19432
                                                                                                                                                                                                                                      Entropy (8bit):6.449503304191337
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:QKgSx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWAhWL2xlcNUpUad+JR9zusiQTL:9x5yguNvZ5VQgx3SbwA71IkFQ62Oxad6
                                                                                                                                                                                                                                      MD5:841E4FF9BB531B52218392DB1D7CFBE4
                                                                                                                                                                                                                                      SHA1:5607C2A987436195F1E241A0B29E8FB1F734102F
                                                                                                                                                                                                                                      SHA-256:4DA31E582DC47D46132CC73AD34D5B87DDDD2338495CEB2772F7E103A9A32EBC
                                                                                                                                                                                                                                      SHA-512:93232073D95870043994C752318F9B319DB508FFF452E4AA0B8E42E66D13623803BE4537E1798DD05177B7427175D989C8E49A379FD932297E161D461BAE268B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...3............!.........................0...............................P...........@.........................p................@...............&...%..............T............................................................................text...O........................... ..`.data...@....0......................@....rsrc........@......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15336
                                                                                                                                                                                                                                      Entropy (8bit):6.720976589213996
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:9te3ugzjVD6WAhWtW4pICSjRof0cVWQ4+W1ruF552v++X01k9z3AzsqPCI:9o3uAYWAhWL2xlcsk5+R9zusqqI
                                                                                                                                                                                                                                      MD5:0713775484E95E5BEBCBE807D53488F8
                                                                                                                                                                                                                                      SHA1:222DCAB5F38D72971FAD641201BA3FF9A2A0ECDC
                                                                                                                                                                                                                                      SHA-256:E63A096B1AE68A774B1F1AFC51B5DBEF1A5AC2D79DCCC1104112C22841E3E378
                                                                                                                                                                                                                                      SHA-512:F19D30D37718DE3EDBA15358888B13AFD9F9DFE4BDF37BDEB3204FB6CDEEC3F249E388D06A89B21DD4A0DA9D1CD70BC4F5244F287A4D907DC0A786DF7EE97097
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...,.zo...........!......................... ...............................@............@.........................`................0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13288
                                                                                                                                                                                                                                      Entropy (8bit):6.872161720143664
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:yTanfHQdu3WAhWBW4pICSjRof0cVWQ42WCYbJRyEBsvH3Tz7PX01k9z3Aeu6C2mU:y0fRWAhWn2xlcmJR72vH3rPR9z/unVO5
                                                                                                                                                                                                                                      MD5:B52238936BDF50AB985435A176281F68
                                                                                                                                                                                                                                      SHA1:7BD2BE0808C538B6F15F20A9A1228CF4A20ADBDD
                                                                                                                                                                                                                                      SHA-256:3A23171AAC49453F931D69CD55F6EC742243F5835386D9E6B18EFAD96C2BE450
                                                                                                                                                                                                                                      SHA-512:36999E6CD50E26B1620FE24BA2DC11A40B25D1D77CC7A0337C7A3F65B16383FDB224E179392A215E6DAE846E8BDA6ACB3E027445FD334E26E34278A397452F6E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....x............!......................... ...............................@............@.........................p...^............0...................%..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\avg.local_vc142.crt.manifest.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (536), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27834
                                                                                                                                                                                                                                      Entropy (8bit):5.364892574728247
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:XkO350DTcPKsdy0XM9HKV3ewhAMp3qvVygfzX45aGTK4xqkrzTSNMiaBnhbXAWxf:NWnkWvVVk5
                                                                                                                                                                                                                                      MD5:F88DF68341AE54D1780326FC83D44D48
                                                                                                                                                                                                                                      SHA1:030EC01703E2EA593F3A76921FADD3A32340BBBC
                                                                                                                                                                                                                                      SHA-256:4086148A6F16145FC2DE2F55064BE1EC94D7B9B7B8AFC6B3FE6CB4A41218587C
                                                                                                                                                                                                                                      SHA-512:656937E7D4CC4DD776A6532156C143B344A17291DAD69A07C9168F3E5BF1923D2E46C7089E411DC4719E7F9C422008425E2BF80A572C5A1EEBE8F8A808E625C9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="avg.local_vc142.crt" version="14.0.0.0" processorArchitecture="x86" publicKeyToken="129215daab62721f"></assemblyIdentity>.. <file name="api-ms-win-core-console-l1-1-0.dll" hashalg="SHA1" hash="67ceafe01927a2c09b7ddc7c082fb613806de2f4"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>f1ZGlT0qkMEDPP7o0ubTlLBdCls=</dsig:DigestValue></asmv2:hash></file>.. <file name="api-ms-win-core-console-l1-2-0.dll" hashalg="SHA1" hash="a410dcdc4408e36ff9624f5c48165d5a001a435d"><asmv2:hash xmlns:asmv2="urn

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\concrt140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):249760
                                                                                                                                                                                                                                      Entropy (8bit):6.6403062272514735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:VCzSiisTRsJvwmpbMZ7gY0Mk46bZCLcod32G7OvkgeCTuK2kz/12z/5v2uX:cOYmjbb2da/uK2kYzz
                                                                                                                                                                                                                                      MD5:39073E37118A0E0326DBBF0EF8D263C9
                                                                                                                                                                                                                                      SHA1:87DB797A0D2065F255C115D2593325E0AD260DDB
                                                                                                                                                                                                                                      SHA-256:D857D5F5CB4D6C4B7DD45E891A24DFEBE429F50EB1098653D41553FCFFFA3C51
                                                                                                                                                                                                                                      SHA-512:CEF9CEDC166BCD5D58B25B64EA21C65DC8C0274C37A7ADD1911210C8C43DFF7D03C329BA3CF5C046A959F8F720403547E15C77C1054E4ED1695545C9261D66F7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................1.........j..............i..............................................Rich...................PE..L...7.$O.........."!... .0...x..............@......................................-4....@A.............................K..@............................'.......+...<..T............................;..@...............8............................text...<........0.................. ..`.data....4...@...2...4..............@....idata...............f..............@..@.rsrc................x..............@..@.reloc...+.......,...|..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):438176
                                                                                                                                                                                                                                      Entropy (8bit):6.650917972789621
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:RvYnQwEk3eLow3WEfQ+yggQWvHzDvKhOKjDhUgiW6QR7t5s03Ooc8dHkC2esqg:9YnQwELow3WSyLQWvHzLKhOKQ03Ooc8a
                                                                                                                                                                                                                                      MD5:FF877A5DFFD764197250BD4BA28496B1
                                                                                                                                                                                                                                      SHA1:187B8E183FC3331DD4BA139333886AD1FBF333A7
                                                                                                                                                                                                                                      SHA-256:83F935454AE8E450B6F042509ECF28CCEFF95EDB2495C63A782B9D45C2EAF1C0
                                                                                                                                                                                                                                      SHA-512:B9245353F8A8BCE6F443345DAF50E135AA9D84BCCE4DC5FD9279216B99BC6A1FA409292E110132AD815F303F36006610D6907E9FC778E94977BEB2332481D03D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TQ$.5?w.5?w.5?wgG>v.5?w.M.w.5?w.5>w~5?w.O>v.5?w.O;v.5?w.O<v.5?w.O:v95?w.O?v.5?w.O.w.5?w.O=v.5?wRich.5?w................PE..L....{n~.........."!... .....~...............0............................................@A........................ W......Hc...........................'......@7...X..T............................W..@............`..@............................text............................... ..`.data...4(...0......................@....idata.......`.......4..............@..@.rsrc................L..............@..@.reloc..@7.......8...P..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_1.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22944
                                                                                                                                                                                                                                      Entropy (8bit):6.519687385842523
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:wqdWCXoIvQX2UJFJwjCX/fWcp5gWD9KLHRN7kpUad+JR9zusMiNWGj:b0CX2GUnJ7XFfAhadk9zuuWGj
                                                                                                                                                                                                                                      MD5:62F10FC981405FB2689DD1A621530305
                                                                                                                                                                                                                                      SHA1:5ABC7BE55C029D8BDBF5BF0FFC0C9E1AD21A1804
                                                                                                                                                                                                                                      SHA-256:8C784679D749B50711FB2FD69C531EC0578C26F48C6E7651C78A0156E86304E5
                                                                                                                                                                                                                                      SHA-512:2AA4A5990509BE3E0F9E80DA284167ABE67F874140355885859F085B531F732574269FB6F4AF456ED2FC50F7DF3EC7E740403AD245FF9401A030E11C33479916
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.%X/.vX/.vX/.v.].wZ/.vQW"v\/.v8U.wR/.v8U.wY/.vX/.vp/.v8U.w]/.v8U.wL/.v8U.wY/.v8UNvY/.v8U.wY/.vRichX/.v........................PE..L...s............."!... ............@........0...............................p.......!....@A.........................*..J....@..x....P...............2...'...`..x.......T...........................X...@............@...............................text............................... ..`.data...0....0......."..............@....idata.......@.......$..............@..@.rsrc........P.......*..............@..@.reloc..x....`......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_2.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):168840
                                                                                                                                                                                                                                      Entropy (8bit):6.801645965539819
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:4ZHQ2fWKF+LZAX1KJDNXd1vAIUrt6jvR9DiUNPhnPK1Q4qzEgc15wTaF:4ZPfWKozJDNNy8RPhnPKQEkTY
                                                                                                                                                                                                                                      MD5:7E523D9E2D93F6CE0248AE5F4E2F797A
                                                                                                                                                                                                                                      SHA1:55819C0D26003F6865502649803AB62A6124F4A9
                                                                                                                                                                                                                                      SHA-256:DF7563FF8E8E4A0A607898482254FFC4941573A4AA110F52ECD03BABACE4A560
                                                                                                                                                                                                                                      SHA-512:0D2C7C0C643294B48D59D83C0CCB03647E14FB13900B5A4A5C14FD3CB48CE5D7AA5A78FDB36E711F544057431271FB12A4F9D943AC7C2991A39F26AAF5C45709
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-..i...i...i......k...`.i.e.......b.......k...i...........l.......z.......h.......h.......h...Richi...........................PE..L....'S..........."!... .0...<...............@......................................(.....@A........................`8..@....Q.......`...............l...'...p..L...H]..T............................\..@............P...............................text............0.................. ..`.data... ....@.......4..............@....idata..d....P.......<..............@..@.rsrc........`.......J..............@..@.reloc..L....p.......N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_atomic_wait.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):53656
                                                                                                                                                                                                                                      Entropy (8bit):5.234598847693745
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:b4Khaxt4jww6paJHcTTcM81xd4f9XzuM:BJEBpaJHUcM81r4f9XJ
                                                                                                                                                                                                                                      MD5:A97F35F65678066C885BCAED23542199
                                                                                                                                                                                                                                      SHA1:75657AAB09F736353EC17D089B7FF5C1C188D622
                                                                                                                                                                                                                                      SHA-256:8A3AE50CE1B8734AFE400646012777451834FF81AD7B5B34EF3AA7A90D5435BF
                                                                                                                                                                                                                                      SHA-512:177E74C8EA638E4DCB48A45C94B219151CFDCEB971E04CDE95E7022CDE14CE2CB7E81A4E8FC77F99A511C24A7006912FFD5495F0682F554F05C3099F2E43326B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..Z?.d.?.d.?.d..e.;.d.6...9.d._.`.4.d._.g.>.d.?.e.^.d._.e.:.d._.a.#.d._.d.>.d._...>.d._.f.>.d.Rich?.d.................PE..L..._:o..........."!... .J..........@E.......`............................... ......d.....@A.........................S..D................................'......x.......T...............................@............................................text....H.......J.................. ..`.data........`...B...N..............@....idata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140_codecvt_ids.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19856
                                                                                                                                                                                                                                      Entropy (8bit):6.573542779735552
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:SGDjJc3ZJBgjUO8Wi3EW+e2KLHRN73CUJCR9zPhmd:SGO3Zr1BGASUJu9zZmd
                                                                                                                                                                                                                                      MD5:2AA228249CE4DAF58EF418B917344913
                                                                                                                                                                                                                                      SHA1:D8C4FC56C6CA5165A0C796D82E8DF8A50DC0E4ED
                                                                                                                                                                                                                                      SHA-256:95B07CD8215042B263F18DC31A7B4C230242A0EA4A69D844554AAFCEE59DB762
                                                                                                                                                                                                                                      SHA-512:F2967E13147521848BE271C5E1C22F9D02C0A560C17159319AE5764FA0DBC7B5EF966AE0F5324B22FDBBD5D53E3339D242140B8E7A8EC64EA81E28526552ED94
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$[..J...J...J.v.K...J.......J...K...J...K...J...N...J...I...J...O...J...J...J.......J...H...J.Rich..J.........PE..L.....Z..........."!... ............@........0...............................p............@A........................."../...p@..P....P...............&...'...`..H.......T...........................H...@............@..h............................text............................... ..`.data........0......................@....idata..x....@......................@..@.rsrc........P......................@..@.reloc..H....`.......$..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\ucrtbase.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1118680
                                                                                                                                                                                                                                      Entropy (8bit):6.792121007084479
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:Ch85O5bBi5MSggquSDJls3gvpmcvIZPoy4NKhB:W85mgquSDJlCOK7
                                                                                                                                                                                                                                      MD5:B65AA2646529E9C1DE570D28C2E37C2B
                                                                                                                                                                                                                                      SHA1:0C0516631B589A6D87AE53442A7ECB8B277127EE
                                                                                                                                                                                                                                      SHA-256:783AAD71C976972DEF8A34579123439CFEBFF071901D97BC91033A05D9C2068F
                                                                                                                                                                                                                                      SHA-512:4CC7496C2C0E18E10C0D3783892B0BA15C1241FABB2FFD168E981F60E3993FCC4CDA07F2AE9AFEC4869F7D06928FA606BE53544A109A3D78067CFEEF033BA009
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0<..t]..t]..t]..}%..G]..t]...].../..u].../..b].../..u].../...].../..*].../..._.../}.u].../..u]..Richt]..........PE..L.....4............!.....,...................@............................... ............@A.........................^......tb...........................%.........\...T............................"..@............`..p............................text...0+.......,.................. ..`.data...<....@.......0..............@....idata.......`.......@..............@..@.rsrc................V..............@..@.reloc..............\..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vccorlib140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):270728
                                                                                                                                                                                                                                      Entropy (8bit):6.557844448527883
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:iZAFf3trvrommV8bzclZhAVSvuJO+LBSPMHqvWjqiu0iS90G:vFRomgdLAouJOOcPAP9
                                                                                                                                                                                                                                      MD5:F1C8097A20B6F00941403D6A2793B064
                                                                                                                                                                                                                                      SHA1:F5375646D365FDB6856407A612FCE665C8A04D32
                                                                                                                                                                                                                                      SHA-256:F496471F764566A215DDB1617B1EFD09E196256A7FE2F7BEDEE473E4265A9966
                                                                                                                                                                                                                                      SHA-512:BC5CA45506621A9022D92DDC150413EAFA1FF7043618632CEC27347DD2F2804719CFCE6060A90D316FF6368EEE728549F05E0591681367078691FBDFE55197F7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\.{2..{2..{2......{2...3..{2...7..{2...6..{2...1..{2.Y.3..{2..{3..{2...;..{2...2..{2.....{2...0..{2.Rich.{2.........................PE..L................."!... ............ ........0............................... .......#....@A........................0....=...............................'......TX.. K..T...........................`J..@............................................text...K........................... ..`.data....o...0...l... ..............@....idata..............................@..@.rsrc...............................@..@.reloc..TX.......Z..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\vcruntime140.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):80800
                                                                                                                                                                                                                                      Entropy (8bit):6.781496286846518
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:FRk1rh/be3Z1bij+8xG+sQxzQF50I9VSHIecbWZOUXYOe0/zuvY:FRk/+Z1z8s+s+QrTmIecbWIA7//gY
                                                                                                                                                                                                                                      MD5:1E6E97D60D411A2DEE8964D3D05ADB15
                                                                                                                                                                                                                                      SHA1:0A2FE6EC6B6675C44998C282DBB1CD8787612FAF
                                                                                                                                                                                                                                      SHA-256:8598940E498271B542F2C04998626AA680F2172D0FF4F8DBD4FFEC1A196540F9
                                                                                                                                                                                                                                      SHA-512:3F7D79079C57786051A2F7FACFB1046188049E831F12B549609A8F152664678EE35AD54D1FFF4447428B6F76BEA1C7CA88FA96AAB395A560C6EC598344FCC7FA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.Dq..*"..*"..*"..+#..*".."..*"..+"4.*"}.)#..*"}..#..*"}./#..*"}.*#..*"}.."..*"}.(#..*"Rich..*"........................PE..L...7.O.........."!... .....................................................P............@A........................0........ .......0...................'...@.......$..T............................#..@............ ...............................text...D........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\dll_loader.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):40384
                                                                                                                                                                                                                                      Entropy (8bit):6.720272006415445
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:dcqGQiSaLhsX9i/qYs1THqR49RJcF4F1CVWeDYiiuAMxkEN:dSQYsXE/i1TMF4F1uWeD7Xxp
                                                                                                                                                                                                                                      MD5:892DAEFCAD7DA7F8B8B13072B0E33223
                                                                                                                                                                                                                                      SHA1:E7E385E7CAAB1E38CC6B58FBCFA3B25ABC3FCAA9
                                                                                                                                                                                                                                      SHA-256:71DBF6992917016B0A7A0A50B2C1B567F3D7784A8B60CAEB2606162F7AFF25DC
                                                                                                                                                                                                                                      SHA-512:E7F6CF4C8A3A3DF12A793F7E4A78130BE9478FD5F3417D285FBE013BED1737EC1EC4E49FACEEBDEFD120CD0217FEF3522B28D952700EDF2DE7A0CC1DE1F07FBF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!..J!..J!..J...J ..J...K+..J...K"..J...K2..J...K%..J(.iJ,..J..K-..J!..J...J5..K9..J5..K ..J5..J ..J!.mJ ..J5..K ..JRich!..J........PE..L...^.$e...........!...$.D...2.......>.......`............................................@A.........................q......`r..........@...........Ht..x)..........Pe.......................f.......d..@............`..0............................text...:C.......D.................. ..`.rdata..>....`.......H..............@..@.data...T............d..............@....rsrc...@............f..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\dnd_helper.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):880576
                                                                                                                                                                                                                                      Entropy (8bit):6.099656226948309
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:f+F6HjdwcIEN3ej62xVEh0lhSMXl0Uh501:k6hv3kM
                                                                                                                                                                                                                                      MD5:710DE7767D5E7F11F80810891D40FF16
                                                                                                                                                                                                                                      SHA1:CFC838BD3E3D554D8AB738FAA39B0CC580E40C56
                                                                                                                                                                                                                                      SHA-256:5F3F27B02064956F717B12DA7C871B70A161114CC97E169A3830490B149096CE
                                                                                                                                                                                                                                      SHA-512:6713C89F67CD0FAB5CFECB79E53DFBB5058237CF930BA174DC2F71AECBBCD9E9ED7D7702098F5A75D7C7DFCDCC0C99DF53C4E4832A5357B7E829FFCFC63F9052
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........\,..=B.=B.=B..C..=B..CF.=B..CA.=B..CC.=B.jOF.=B.E..=B.BC.=B..CG.=B.{HG.=B.{HF.=B.jOC.=B.=C.?B.BK..=B.BB.=B.B..=B.=..=B.B@.=B.Rich.=B.........PE..L.....$e...........!...$.....n.......................................................K....@A........................ ....... ..........X...........HF..x)... ...c..@...............................0...@.......................`....................text...J........................... ..`.rdata..zO.......P..................@..@.data...H....P.......8..............@....didat..............................@....rsrc...X...........................@..@.reloc...c... ...d..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\firefox_pass.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):481216
                                                                                                                                                                                                                                      Entropy (8bit):6.800879874021738
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:b9W6ioMtpDvDvir1lCBmgCph0lhSMXleu4tqjgSy:b9YvWr1lCBroh0lhSMXlxKqp
                                                                                                                                                                                                                                      MD5:18CE34413CDCF1D03AB9E7C03DFB6A38
                                                                                                                                                                                                                                      SHA1:1063D84FAA143A51438BFB4BDD05714741A1A10E
                                                                                                                                                                                                                                      SHA-256:664779B7B3532D4236C21F6C62FAB00859CD06526BA7A4DFEB0DE0F26392DBF6
                                                                                                                                                                                                                                      SHA-512:E3C4C35D71DDBA9435C5ECBE1542C7AEABF75B161626D5FB70CD74C7AC91B1B7D893811EA5DED22BD35DCC9885AC23BF326EDBE9809D22C259BF2EFA5CF7C883
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........BC..,...,...,.(.....,.(.(...,.(./...,.(.)...,.(.-...,._.(...,.N.)...,.......,._.-...,...-...,...-.=.,...)...,...%...,...,...,.......,.......,.......,.Rich..,.........................PE..L.....$e...............$.....b....................@..........................`......o.....@.........................p.......X...@...................H...x)... ...<...$.......................%.......$..@............................................text............................... ..`.rdata..............................@..@.data....5.......0..................@....rsrc...............................@..@.reloc...<... ...>..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\gaming_hook.exe.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):437688
                                                                                                                                                                                                                                      Entropy (8bit):6.945457468912238
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:RqZet+1RlLovv9SOj+P2ph0lhSMXleDMblMxtR:JmlLvOj+0h0lhSMXldMxt
                                                                                                                                                                                                                                      MD5:A4E2FE65713D3305B05DBACFB915FA8A
                                                                                                                                                                                                                                      SHA1:B72C250A12458CA588F099A36B9CC2DBC3368515
                                                                                                                                                                                                                                      SHA-256:AEEB95DCC2B3A5F250B64249EBB1E17DB5A853B8A6BF40FEFE605B14E1652748
                                                                                                                                                                                                                                      SHA-512:DF991C9330F3094A138E7E38573821FE2F06FE71EFC14036AC5826ACE1F4A6BB74F525EBB760A4DFDD4B4637CC96119DC4D972AB1424AE651F2B2724D76589F5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........"u.FC..FC..FC...=.BC...=..JC...=..LC...=..mC...=..BC..FC..JC..O;..UC...1..JC..FC..JA...6..GC..R<..;C..R<..GC..R<.GC..FC..DC..R<..GC..RichFC..................PE..L.....$e...............$............0<............@..................................A....@..........................B.......B..,...................H...p).......(..........................@...........@...............D............................text............................... ..`.rdata..:...........................@..@.data....&...`.......F..............@....rsrc................T..............@..@.reloc...(.......(...\..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\AVG\Antivirus\x86\snxhk.dll.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):311744
                                                                                                                                                                                                                                      Entropy (8bit):6.250408328200664
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:YzSIgv+AtUv/Cm1vqDFvaBkLqP+to+4Yj1TpD0awhIDkRX9Q/QApPuOiOepTp533:YWm4daCtok1TB6RXy5t0TpHY
                                                                                                                                                                                                                                      MD5:A934E9468BFC12768DB42631E932C9F2
                                                                                                                                                                                                                                      SHA1:324B20C44ADAF39C9F5BED43736223156E6E3B41
                                                                                                                                                                                                                                      SHA-256:512D1DBBFA92AA9E678D5BD23EE2D275B252ABBF4DD2D6F93A2CCC7A5BAA51D2
                                                                                                                                                                                                                                      SHA-512:0A5E6F11E49D0D1B57210EB4B59818DC3FD36BCD298A90F8D7B6B589BCEDF1B55884774EA5CB53C6A4CC02D42FCAA7556BC89F1C0AA6AFCB8FC964D75792E0E7
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......a<_F%]1.%]1.%]1..#..!]1..#5.4]1..#2.1]1..#4..]1../5.$]1../0.']1...../]1.....S]1.....<]1.,%..&]1.%]0.V]1.1"8./]1.1"1.$]1.1"..$]1.%]..']1.1"3.$]1.Rich%]1.........PE..L.....$e...........!...$.b...Z......................................................P.....@.........................@...l.......<.......h...........H...x)......H?..........................@...........@............................................text...[`.......b.................. ..`.rdata...............f..............@..@.data...............................@....rsrc...h...........................@..@.reloc..H?.......@...X..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\analyticsmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 2099641 bytes, 2 files, at 0x44 +A "\analyticsmanager.dll" +A "\analyticsmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 196 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2121641
                                                                                                                                                                                                                                      Entropy (8bit):7.999614389693623
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:TMjOVauA3/jNE7icAnfvYeB6ET/qqDfjcia:ojzNrYGnIeMET/qqDId
                                                                                                                                                                                                                                      MD5:8C6A1B32C46ED6CC385D4384918BEDA8
                                                                                                                                                                                                                                      SHA1:C37196217D13F69B00783CBC3CC5B53AB40A2D57
                                                                                                                                                                                                                                      SHA-256:2087DEEC000E114B8C631DB391E270E8F4D7BB14B8FAD1143FB0843E952F4C90
                                                                                                                                                                                                                                      SHA-512:8982BF336454596B8C61AA3955C85F99E50D5A7C67A3D0E3DC4230DA9E083A106B4D6D7B7EAD334DAAF815744CD4FF5EC6FC08C8B2F6DA04A41C75594EA455E6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF...... .....D............................. ..U....................a.......SW.^ .\analyticsmanager.dll.......a...SW._ .\analyticsmanager.manifest.(E.../..[...9 .....0..4.....?.ek.ina.X...:.L.....a.0Z.:..#.-;..s..0....2b...9_..)l.D..f...........}.o.s.........".M.....u.K..6..f..=..>v.=.[..d...'....+..c.8w.m...d...u.k...j..,.....O8......K......./.@.0....B...43g4.g.U~>...n..H.w.q$.I..T.j..V.`\@.Q. .P...UxG..3....|....c.k.....?..(k.+.m...U.. .=.....@.....-.R..$..o.....y'.U...z.,.g{um.o...v.M^......g.r.O.G.{........t..}...W>{..|G..'..t>q.......gt..=..........z..y$..ME./..._._..%{i8......w?...7.....]..].'x.b..{..n...K..C..^.^d$..v....r.Yo...q...W._.+.E...hs-7..cA...ww....V<B...]...7.......<...L|.....*....\....hy?~[.!........p$......=..7..Z....E>.{.+.r..%`...V?.7.v...%.+.Ry..........{......6.Nt..7......~..[..?...w....L......bw=i/....6.....V...-..s.7...._...k..!.j....~.Y]......J.$^.k.6.=....v.w...9.{.O|....V..........y{....S...oW.S.~.y.8v...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\analyticstelemetry.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 35375 bytes, 52 files, at 0x44 +A "\analyticstelemetry.manifest" +A "\context\analyticscontextconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):57375
                                                                                                                                                                                                                                      Entropy (8bit):7.8993776004131115
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:r7msbUQV8sFrDAXleKzI8RjyBo4ivXFx0lpp31tzPxE:r7msbUQ2fXleez49Hxy
                                                                                                                                                                                                                                      MD5:C5543A43770BCCF5AAD50078EB72FAF2
                                                                                                                                                                                                                                      SHA1:876E0256C7F1CED62E0C984F25ECA0D47B3630D7
                                                                                                                                                                                                                                      SHA-256:C764EDC24E78CB8213E78D5900FDED23D47523FC022C4B13DDDBF4AA98290846
                                                                                                                                                                                                                                      SHA-512:4CEC08E3B6573772BCC246845A40711B5858EA28C74C4FDE543C090E376672196D904BC419BD1367BFFB032195CC89FC06FD29B6008AABFE677A03EC7C9FD9F9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF..../.......D...........4.............../....U..................Z.........SW._ .\analyticstelemetry.manifest.....Z.....SW.[ .\context\analyticscontextconfig.luc.....y.....SW.[ .\context\analyticswpssetting.luc.....z.....SW.[ .\context\analyticswsswps.luc.?.........SW.[ .\context\browserinformation.luc.0....-....SW.[ .\context\browserversion.luc......2....SW.[ .\context\contexthandler.luc......3....SW.[ .\context\externalutilityfunction.luc.....,7....SW.[ .\context\featuretrackingfeature.luc......V....SW.[ .\context\hashedmachineid.luc.O...VZ....SW.[ .\context\samrecoverable.luc......]....SW.[ .\context\sequencenumber.luc.R...._....SW.[ .\context\subscriptionexpirydate.luc.@....a....SW.[ .\context\subscriptionstatus.luc.....?f....SW.[ .\context\subscriptiontype.luc.Y...Yh....SW.[ .\context\suitestatus.luc......k....SW.[ .\context\wpssubscriptionexpirydate.luc......m....SW.[ .\context\wpssubscriptionstatus.luc.....|o....SW.[ .\context\wpssubscriptiontype.luc.....hq....SW.[ .\context\

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\balloon_safe_annotation.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3166
                                                                                                                                                                                                                                      Entropy (8bit):7.890916051269147
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
                                                                                                                                                                                                                                      MD5:2048DF489A12C4C9E2341BEF42883205
                                                                                                                                                                                                                                      SHA1:281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
                                                                                                                                                                                                                                      SHA-256:DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
                                                                                                                                                                                                                                      SHA-512:815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\browserhost.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 1275038 bytes, 8 files, at 0x44 +A "\browserhost.exe" +A "\browserhost.manifest", flags 0x4, number 1, extra bytes 20 in head, 120 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1297038
                                                                                                                                                                                                                                      Entropy (8bit):7.999535797522869
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:r/ansNyn8zf9I4N+5YLOot/YmB55E0wdWqR/+nBQOS/fRakb2vYBclTels3iTQsz:OnsP1+5SbpYKcvR/+6OSXUkmYEixRD39
                                                                                                                                                                                                                                      MD5:584AB80418F1C11004F22E3FB5E24A6F
                                                                                                                                                                                                                                      SHA1:89FC4A69DB3FFF3AE159482331F7E7B0C53D50BA
                                                                                                                                                                                                                                      SHA-256:88183FC9E74DE5CB8C8BCA95DF3025789101527DF2FEC5C0DDE751620065AE21
                                                                                                                                                                                                                                      SHA-512:0724A03036C9C0695D4B78337F702EE4AFC3BCF0B7349DE41F921EBE45124F89C5B9942FF541296E2FD9C21FA072B2D2EEF6A56FB4945C4C12E5A70643DD911F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF.....t......D............................t...U..............x.....;.......SW._ .\browserhost.exe.0*....;...SW._ .\browserhost.manifest.f.....;...SW.Z .\edge.com.mcafee.webadvisor.json.e...V.;...SW.Z .\edge.com.mcafee.webadvisor_v2.json.......;...SW.Z .\webadvisor.mcafee.chrome.extension.json.L..._.;...SW.Z .\webadvisor.mcafee.firefox.extension.json.......;...SW.Z .\webadvisor_v2.mcafee.chrome.extension.json.K...N.;...SW.Z .\webadvisor_v2.mcafee.firefox.extension.json.........[...M W].M.0..D.........p.-.<..n8..np.W.p.......2u.......2....n.bLnpr2...+...u.bYD$UDU..x.W.|.~.....w.{....R.._ p...*.]... .LfN.Ffe.H]W..-%.:..d.,.....T...c....p..1!..3P$A.N.`.....~#,...@....#.G....#|.....@........G3..0.3AG.s...:R."._Y;D.4...V...z........W....../.]...M../...c...yr..W/....,.3/..h.}...r.TK..:.#..9.=.>..K.._?..q..s...I{q.f......:{[..\.......q.>.C..h`.n.Q......c..P.W.4.>..~......k..#.Yu/.........k_;.........y..Y.'.m.R6......T..{.o.~...+...z.a.q.......-z.0..k.^.J&....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\browserplugin.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 5067637 bytes, 2 files, at 0x44 +A "\browserplugin.manifest" +A "\e10ssaffplg.xpi", flags 0x4, number 1, extra bytes 20 in head, 183 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5089637
                                                                                                                                                                                                                                      Entropy (8bit):7.999222491911646
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:98304:aPLmpc3F/4L4hrRl4B5Ux1NJjSmbQtX/ngnImvh13LLfv9i1kC0k:aTmS3F4Uf5x1NdjbQtX/gnD/3LjvoKk
                                                                                                                                                                                                                                      MD5:A66217E0ACD56C1106B0FFB1B4C913A0
                                                                                                                                                                                                                                      SHA1:F06E7646CACC7F1589960ECA83557383182B076F
                                                                                                                                                                                                                                      SHA-256:8B9A70EB79B02FC03576F87AF1F253876E2EA71E0F2A58CA55C7BF8FE4F066B6
                                                                                                                                                                                                                                      SHA-512:51C78A21F2041537C34E17046A37DA56E5FCEF7C1D0F7F7E0E71D96D3E77158A4CFC559FF995E20D61D4A88E27D1D05002C556C4B3BC1D079B38CFF8C40E2FD0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF....uSM.....D...........................uSM..U............................SW._ .\browserplugin.manifest.xU[.......SW.^ .\e10ssaffplg.xpi.....Z..[..............*.D..]..qwwwwwpw.P.....Apw.ww#p43VE.....`.;7...... v..H.&.. .g...k.S..c..N&l.h|.H.~.u.....F.b...S..b..R..7...S.9..7.r..IR+@.(/.....A......".......K..zUe`.....A..M(uA..$...@.It?.....aii.......e5.....Q!%..?d.1.JY...y.a......q.}.hquMqq9.d.m....PQ.$L...KL...c..._....k.?.+.l...s..c.._......G...8...S.3../,A)&..,0...M.sEX..p.........k..:.*..>..B.V.r..f?....... b....N.~.e...P........L.q..+..h..Z........'Q..@..../.`h......?+g.....o'..?m.B...>).......rUq)\j(Xj]]cg&^go.`Z..%a.....t............cm..o._...5/..I..\...v..D...\l.....[_...|...k>)..>.4...........i.s.....$.O4"..?..F..Y.X......Fo..}.....Vd.M.?......zr.x.|.........?UB..ZW.?.^<]b][_Z..Z_\\.`e..s......7.....x.\|.Y.f_......4.GG.Jt.EF..e.6..e2.0},}.1.,-~.q.......?Q.....3..,..4D.qfc`b.z..........>..............[..V.......Eb....).ai_q.........`..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\downloadscan.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 2395565 bytes, 3 files, at 0x44 +A "\downloadscan.manifest" +A "\win32\downloadscan.dll", flags 0x4, number 1, extra bytes 20 in head, 213 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2417565
                                                                                                                                                                                                                                      Entropy (8bit):7.999764001251247
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:gEj4z+H4iAGg5rgl343njgATBL2EZG+/Z8FRrFyDn:9vJBer3J8vUr
                                                                                                                                                                                                                                      MD5:D619BD1E0A50524FE833742F9C2B62A6
                                                                                                                                                                                                                                      SHA1:3C13CEAA6F6C8303A5945249B31C605A14E863B0
                                                                                                                                                                                                                                      SHA-256:740ACD01C211B91A87C7D68D317FB838EE2BC3EBC4543D4915167A0B38D18EDA
                                                                                                                                                                                                                                      SHA-512:68D0E386FD33FC24481CB05DC6894B3C88DFD96EEA680A559030A234D291BF885A792539929096620ECAEB16748131FE8526E9CA068ECD0FABBC87F71855E8E2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF......$.....D.............................$..U..................C.........SW._ .\downloadscan.manifest...1.C.....SW.^ .\win32\downloadscan.dll..&9...1...SW._ .\x64\downloadscan.dll..k..D...[...L. ..."B.5.._.o{.Z.Z.r....).L]hW:...j...U.f"l./.P.ym..8..<;.].w........H..\.'=...a.tVcCfF".h.......~.~..v.C..u...''....f..y........0t./.....2....TW..[.K].s)u-^I.L..b.b-x.@.)..Z(..X.k..v.l...!.:..3sI.|.......a..+*C+,.....}.?..s.*...5.......L.....sw*WJ.].....jJ.(F...PB.3.R....]..1.....=.........l.S>.....6.aw.....o.._...3ok....z<.....9..v.6.8....O.6....0.l.F(......K.M.7/....6l......l..l.^.(=4.t"...".3}........ri.....(.G\lK.ze.....n.pPll.,..4..lwBP..R..}.B..Tls/...F.k.....:c..K..n...x....X..O..P......X.....O..B?b...4.ik.i?...i.Vn.|Fq.hGx5..I..t%N(E....]..r...U..IE....*y4UHy.%_o..`...m..KY..}ikw.8q..qq..u....l..1.O..t_*C....1..c..1lhPbj....`X\oj!.h.?z.7..~.s..y.....`.y..F..a..&U....>a........]..'.K..P..B..+J.S.Z..j...S.j...S....2..c5L.9..8...LY...c..4k..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\eventmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 1587095 bytes, 2 files, at 0x44 +A "\eventmanager.dll" +A "\eventmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 141 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1609095
                                                                                                                                                                                                                                      Entropy (8bit):7.999565988817059
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:x92zZmZUqiqjJMOSgakmNyoZ6nS0uhWrklBdoTi9:nyIBFMOSnkVS0uUrgd7
                                                                                                                                                                                                                                      MD5:AD1EBB7A0F1AC27E2255AB4EB989EA76
                                                                                                                                                                                                                                      SHA1:16907E09E9C0DD96655589056E384C5F56438146
                                                                                                                                                                                                                                      SHA-256:CCC065FD9CAA190E633B5548189D2FE1F91C5DDEC242A73700D1466E27777F5F
                                                                                                                                                                                                                                      SHA-512:2BD1BEA80BBF13D0C9F5E6CA33FEB0E4BED30793054061AF34AF4BBCA19AB19E54581AEABD9CA793B42D14282F97AC03DAD472679966680FCE33A20205D2083C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF.....7......D............................7...U..................0 F.......SW._ .\eventmanager.dll.....0 F...SW._ .\eventmanager.manifest....C.+..[........."sP$..n...^..^ ..Pj..T..f...4r>.*..."sW.)s-..... .c...&.d.....d@...iP?..$D;....%....3.4#..u........H.G..m..:...$$0..z.'.Q5nH....m/v`h..^..%P.[..!.....7.....E....P[.*..H4i~.....H.......@..].m.......G..P.... .._.q......9.q<...#...lM<p.0...>+...NS..@...V..i..c.{.;S..z.o....1*...5.w.TT.6,.%..v...k....w..Q...[[Je.*q.L.R..W&%..fru..{b-...}.n.(#.u....J.......,.'{n|....~.....m....jq.\]e..yKAQ~..."Y.........-K.&..6.I.t.h.....*..Sl......$........dN....k.{'.....j.Sr...}.mk*9..>x:....|......J0...eM.i.].=V.W........K...}.m.d...`.!_......!~.......;......:,..#p.u....#.X..S..B.N....4{Z.{M&.pk0Ti.v.........q.K..y..a...|.Z...{.#...T.].EX..7....C.u.@)../..f..zzzyg&P...!..(6B.F..od,..Z7..5...\..A$j+.F.+s...(*..2%X.......B..@=.@q..2.p.....<..D.....f...o......)a..;I.0.....Y-.....G.F7..F...'....m1.....3...q%.|

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\icon_complete.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3219
                                                                                                                                                                                                                                      Entropy (8bit):7.7127647052020425
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ek20QaOtG6FvySCYWm8yAxvU+LblYFv2tct:eQQaOwhS8m8yH+flLtct
                                                                                                                                                                                                                                      MD5:4A09448B224F83F4E6D36AEC9FF4DA1E
                                                                                                                                                                                                                                      SHA1:CC42250CAF610210EFF2904B1A08630A0888AB2F
                                                                                                                                                                                                                                      SHA-256:911215D1ADA8D78A33F6ED9A3740A0652BE74EFA34ED22AE569D143F9B3B5040
                                                                                                                                                                                                                                      SHA-512:390587FA96D17112CA7EC1ADFE2BA103FE39E980A35A2D4C7A3B6BCF4DE9E95B200DDCEE3C4B6C34899DE51F20F9635D41259558C77CF24279D26264DA953E2B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEF9F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFAF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEF7F71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEF8F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d.8.....IDATx..kL.W.....Z(....h5>J....T,...4U...h.I..&~...`..hc......"h.. X.....m...Q....%...........'..ta.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\icon_failed.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3390
                                                                                                                                                                                                                                      Entropy (8bit):7.74331289225542
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ek2J8fBtCIc5eJXe1TDiotN45Myx7n6v9+j0ZH:e98fB8vcJqVUtx+9+j0p
                                                                                                                                                                                                                                      MD5:AEE9C26A50511C3E4196C28662BCE665
                                                                                                                                                                                                                                      SHA1:ADF6DA6EE3EAAD88E8EF1C9C07505AEFFDE89B57
                                                                                                                                                                                                                                      SHA-256:0E2904A557F79BCE71A47BFB03E49FA9C5B54C7855017B54143EA2214501BFE6
                                                                                                                                                                                                                                      SHA-512:F90AA520FD9308C502B857C4425BF6CF6E12C401EA4B538534E58655448232CF797AA9A9BA60B0932DBAFC28EE925D22BED6740DF82BB02C5C99EF851389F783
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEFDF71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFEF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFBF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEFCF71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..*.....IDATx..klTU...v..--/5.<.J...."F.aD.HQ4..(...j.P.a...?T ..F...........5..... ..jU..Q#.V(.]g...w.g.n.$.m

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\icon_laptop.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 73, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1511
                                                                                                                                                                                                                                      Entropy (8bit):7.072392857408681
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:YQ1hepWwjx82lY2T3JbVvdgqud1oUUyJ3Vnf//XPtGiLBVa470GoqF0ynT6/at8a:YuccNn2Vw7znJ3BvPtnLW5qF0yTUa6fC
                                                                                                                                                                                                                                      MD5:4D3A0258CF71A406CB7669FBE3FBEB2E
                                                                                                                                                                                                                                      SHA1:0811273369EADF2604DB3C53426F85FE74B785E4
                                                                                                                                                                                                                                      SHA-256:C156050A5D788BAD7D8F36482072B44A23F502F23C5F9198F6EB1EB066765DEE
                                                                                                                                                                                                                                      SHA-512:837A275BC63DD19F5F8553E056C5EAF257D530A54E0EC386BB28B0A515CA58929E3464612C30D9E7034ACF7473119E03B00EBAB26B220391330FEF12BC087973
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...I............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:3EBDD818F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:3EBDD819F71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFFF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDF00F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..}....UIDATx..K.Q..sj-HT...X..t.Z.P.A$...v...._.-]DAkG....#.B....dr.(..@.*......-y.......<H.......{..^.\NA|h..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\installer.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2526888
                                                                                                                                                                                                                                      Entropy (8bit):6.436289639902748
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:eyuixa2DPxCkdACUFcDbZzZ3tv8eLEBfb8EeuZbFB:781+fDbZZBxNuZ3
                                                                                                                                                                                                                                      MD5:38F970B5919FA4F8174F559A91003924
                                                                                                                                                                                                                                      SHA1:564CEE5FA95AD4B0661E33691855A5902874EA97
                                                                                                                                                                                                                                      SHA-256:1F112268AC780C3603BA62B926A7BED84FF0931D56C884AA37A12057E2DF6900
                                                                                                                                                                                                                                      SHA-512:DD7FF9B89C5DAAAF503BC47511CADDA048A4FD638F440AAF8C15921FB12D4396982CB84C44EE18AF6FCF3FDD36419DE5123F541DB2C84856F1917042778E55BB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......>c!.z.O.z.O.z.O.!jL.w.O.!jJ..O.(wK.i.O.(wL.p.O..m..x.O.(wJ...O.!jK.e.O.sz..r.O.wJ.{.O.!jI.x.O.niN.x.O.!jN.a.O..lJ.p.O.z.O.{.O..lK.:.O.z.N..O.wF...O.w..{.O.z...{.O.wM.{.O.Richz.O.........PE..d...]h1e.........."................. ..........@..............................&.......&...`.................................................p...h................A....%.......%.D,......p.......................(...@...8...............0............................text.............................. ..`.rdata...R.......T..................@..@.data...DT... ...&..................@....pdata...A.......B...,..............@..@.didat...............n..............@..._RDATA...............p..............@..@.rsrc................r..............@..@.reloc..D,....%......`%.............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jquery-1.9.0.min.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (32132), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):93205
                                                                                                                                                                                                                                      Entropy (8bit):5.288294476087405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:fYcvR3VhH37Ha7EmakRhIHASkCDy08otU6myJXXxMZyYk0AjrzCqlKDo9YhnaTdK:fY8MaW2c+UELKUqnAdiP
                                                                                                                                                                                                                                      MD5:45E7897161CD82804BD66A16670F8D1F
                                                                                                                                                                                                                                      SHA1:8E2FCE3B5F804300D507E6D0C22A327A7FB7F086
                                                                                                                                                                                                                                      SHA-256:402D866371F707BE1B03D85B03DB3667CCE0DAEDCBAAA599F30E0E502C1E7CDF
                                                                                                                                                                                                                                      SHA-512:2737DCFBAEAAE3DA996AB2649B7BC46165AB93F9A37369FD48C1A5473F7311F4850AFE96E7AAECC057CC1D35AE2C7DC14CA0076594C02098FAD194683D83AA74
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license */(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()||st.guid++:f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==typeof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-cs-CZ.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2374), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):74892
                                                                                                                                                                                                                                      Entropy (8bit):3.8107150696128875
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:MtrgKi7KxT98/9UIBtIFbxb6EFNBRV25JWavzs87n37ebyUDfIjGl:hs91bzNx0JWGsiUDwA
                                                                                                                                                                                                                                      MD5:C9C65B331403A8109A8EA3943247D09A
                                                                                                                                                                                                                                      SHA1:18724C42E5342E7362D16FD1C8F6B5BB60DB2C25
                                                                                                                                                                                                                                      SHA-256:C8A5DDFDF5F5A01269EC5C125355C84F80C1228C2D578FB89B795719CB9076C8
                                                                                                                                                                                                                                      SHA-512:C2D53CFAF55A6B7F058C97DCB0AC2695B4B44383C268E6197222F533E4DDDBCC9600066453E5DCAA1ED21CFEBA2289842A8CF986C68D9FADBF671C2D4FE9F5CF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n...n... .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .s.o.f.t.w.a.r.e. .I.n.t.e.l.........D...k.u.j.e.m.e. .z.a. .v.y.u.~.i.t... .b.e.z.p.e...n.o.s.t.n...h.o. .s.o.f.t.w.a.r.u. .a. .s.l.u.~.e.b. .s.p.o.l.e...n.o.s.t.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .(.d...l.e. .j.e.n. .. S.o.f.t.w.a.r.e.. ).,. .k.t.e.r... .p.o.s.k.y.t.u.j.e. .j.e.j... .s.t.o.p.r.o.c.e.n.t.n... .v.l.a.s.t.n...n... .d.c.e.Y.i.n... .s.p.o.l.e...n.o.s.t. .M.c.A.f.e.e... .T.o.t.o. .j.e. .p.r...v.n... .u.j.e.d.n...n... .m.e.z.i. .v...m.i. .a. .n.a.a... .s.p.o.l.e...n.o.s.t..... .I.n.s.t.a.l.a.c... .n.e.b.o. .p.o.u.~.i.t...m. .S.o.f.t.w.a.r.u. .v.y.j.a.d.Y.u.j.e.t.e. .s.o.u.h.l.a.s. .s. .p.o.d.m...n.k.a.m.i. .u.j.e.d.n...n...,. .p.r.o.t.o. .s.i. .j.e. .p.e...l.i.v... .p.Y.e...t...t.e... .........T.a.t.o. .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .S.o.f.t.w.a.r.e. .I.n.t.e.l. .(.d...l.e. .j.e.n. .. S.m.l.o.u.v.a.. ). .u.p.r.a.v.u.j.e. .v.a.a.e. .p.r...v.a. .k. .p.o.u.~.i.t... .S.o.f.t.w.a.r.u.,. .j.e.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-da-DK.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2582), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):91776
                                                                                                                                                                                                                                      Entropy (8bit):3.453182110932442
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:nVNCGgfhrLJT5kmiYjC8DZ9p7WmTg5MSItM7Q1cTm/diaa8mwQUIqetIHi7M6X6I:nVNCGgfhpTziY2Ol7FtD0aa8mWe9+Pe
                                                                                                                                                                                                                                      MD5:3337D980215EA1E6C647FA4119A28521
                                                                                                                                                                                                                                      SHA1:FBA0B5211311999DF85B23488DAD7F7254FB2F0D
                                                                                                                                                                                                                                      SHA-256:C822463F38D0A8A04361A11CE0F43A865F5F5A9A3A8E16967A9EE6A057F83057
                                                                                                                                                                                                                                      SHA-512:032736E1059BC26A574ED0828F20236D2899564E235E849B08F07E8B64405C4D86ECBEA494286DF21BF1C6E1F8012335112E12954BA12681D8644DD8A90A03A3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n.s.a.f.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.,. .f.o.r.d.i. .d.u. .b.r.u.g.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .s.o.f.t.w.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".S.o.f.t.w.a.r.e.n.".).,. .d.e.r. .l.e.v.e.r.e.s. .a.f. .M.c.A.f.e.e.,. .s.o.m. .e.r. .e.t. .h.e.l.e.j.e.t. .d.a.t.t.e.r.s.e.l.s.k.a.b. .a.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.f.t.a.l.e. .m.e.l.l.e.m. .o.s. .. .i.n.s.t.a.l.l.a.t.i.o.n. .e.l.l.e.r. .o.p.r.e.t.t.e.l.s.e. .a.f. .a.d.g.a.n.g. .t.i.l. .v.o.r.e.s. .S.o.f.t.w.a.r.e. .b.e.t.y.d.e.r.,. .a.t. .d.u. .a.c.c.e.p.t.e.r.e.r. .d.i.s.s.e. .v.i.l.k...r.,. .s... .d.u. .b.e.d.e.s. .l...s.e. .d.e.m. .o.m.h.y.g.g.e.l.i.g.t... .........I. .d.e.n.n.e. .l.i.c.e.n.s.a.f.t.a.l.e. .f.r.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".A.f.t.a.l.e.n.".). .g.e.n.n.e.m.g...s. .d.i.n.e. .r.e.t.t.i.g.h.e.d.e.r. .t.i.l. .a.t. .b.r.u.g.e. .S.o.f.t.w.a.r.e.n.,. .b.e.g.r...n.s.n.i.n.g.e.r. .f.o.r. .d.e.n.n.e. .b.r.u.g.,. .v.o.r.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-de-DE.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (3216), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):104206
                                                                                                                                                                                                                                      Entropy (8bit):3.491690936146809
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Sw8jufxOksgk9WB2s9JIEwSKjKmDwwy0U6QVMsaXSTLgaP3FGp:FahQVM
                                                                                                                                                                                                                                      MD5:08C61EF338BE0CF2084A8118EF5279EE
                                                                                                                                                                                                                                      SHA1:FBDA8C94DE2D42F0624F45972686767F06A976D7
                                                                                                                                                                                                                                      SHA-256:12372C1DBBA6800D99AFF817ACB35CCF968254713E7E2ED8676D9F652F0AAFC4
                                                                                                                                                                                                                                      SHA-512:015553841CE77F952358EC26AB4C4E20128820B145D89F0146EE5A7C77CD24A3D23252BA52AAE8EC299FD447EFC472C6A27D83372F3DCED4A3E54B4492244887
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g.........V.i.e.l.e.n. .D.a.n.k.,. .d.a.s.s. .S.i.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .S.o.f.t.w.a.r.e. .u.n.d. .D.i.e.n.s.t.e. .(.. S.o.f.t.w.a.r.e.. ). .n.u.t.z.e.n.,. .d.i.e. .v.o.n. .M.c.A.f.e.e.,. .e.i.n.e.r. .h.u.n.d.e.r.t.p.r.o.z.e.n.t.i.g.e.n. .T.o.c.h.t.e.r.g.e.s.e.l.l.s.c.h.a.f.t. .v.o.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.,. .b.e.r.e.i.t.g.e.s.t.e.l.l.t. .w.e.r.d.e.n... .D.i.e.s. .i.s.t. .e.i.n. .r.e.c.h.t.s.k.r...f.t.i.g.e.r. .V.e.r.t.r.a.g. .z.w.i.s.c.h.e.n. .u.n.s.. m.i.t. .d.e.r. .I.n.s.t.a.l.l.a.t.i.o.n. .o.d.e.r. .d.e.m. .Z.u.g.r.i.f.f. .a.u.f. .u.n.s.e.r.e. .S.o.f.t.w.a.r.e. .s.t.i.m.m.e.n. .S.i.e. .d.i.e.s.e.n. .B.e.d.i.n.g.u.n.g.e.n. .z.u... .L.e.s.e.n. .S.i.e. .s.i.e. .d.e.s.h.a.l.b. .b.i.t.t.e. .a.u.f.m.e.r.k.s.a.m. .d.u.r.c.h... .........D.i.e.s.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g. .(.. V.e.r.t.r.a.g.. ). .u.m.f.a.s.s.t. .I.h.r.e. .R.e.c.h.t.e. .z.u.r. .N.u.t.z.u.n.g. .d.e.r. .S.o.f.t.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-el-GR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2776), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):103714
                                                                                                                                                                                                                                      Entropy (8bit):4.054391145636526
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:7NPKnckk7Va7/ZYluLyBO/mw5rMpNVjX7MYeFz8cP:lKB5rMdX4/f
                                                                                                                                                                                                                                      MD5:74C7533EE5FBED8576A4ECEC0289CA6F
                                                                                                                                                                                                                                      SHA1:E2C51284C29846E591E4C8EB931C9CAC85AE3A03
                                                                                                                                                                                                                                      SHA-256:9E45E75EF08C8CD2C84324BCEE4FCF0D58FE8FB8F62B0DE91424071D3D6E3B4F
                                                                                                                                                                                                                                      SHA-512:B339D79ED2176C7873F0E0AE4AFBE6B06EEDC81CBC537A715364C306FA1BE7B603A317737E6C16649E5EE371FE20EAD4406853EA11F5F6C4182EEBF1925C7361
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:................ ............. ............. ..................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y............... ......................... ....... ............................. ................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. ................... ).,. ....... ............... ... .M.c.A.f.e.e.,. ....... ....................... ..................... ................... ....... .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ... ............... ................. ....... ............. ................. ............... ..... ......... ....... .......... .. ....................... ... ..................... ....... ..................... ....... ....................... ....... ..................... ..... ......... ................. ...........,. ................. ....... ....................... ..... ......... ................... ....................... ........... ............... ............... ............. ............. .....................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-en-US.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2456), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):85990
                                                                                                                                                                                                                                      Entropy (8bit):3.453033473575846
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:/F7Fw4sT8hXmsqSrobeIT6f9BMaR4EYtI7F5M:aoc
                                                                                                                                                                                                                                      MD5:9B63156648366D674107FF5066A58B2A
                                                                                                                                                                                                                                      SHA1:9BB9FB43B3E5501C749364E8460C14F54B92F684
                                                                                                                                                                                                                                      SHA-256:11269B8E798B3A21B2CD50D03587948B25A26C63B2AC7B4ED1ADD7565F36E9E2
                                                                                                                                                                                                                                      SHA-512:9C7D3DBEFA0FAC4AF910EB6D6799D1C59BA880EE0B195D3648078159F3BEFCF8DCF965530CE5482DF6E17586494C44D5555CE5E710343CEA497B8B0C4BDC16A9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........T.h.a.n.k. .y.o.u. .f.o.r. .u.s.i.n.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.o.f.t.w.a.r.e. .a.n.d. .s.e.r.v.i.c.e.s. .(.. S.o.f.t.w.a.r.e.. ).,. .p.r.o.v.i.d.e.d. .b.y. .M.c.A.f.e.e.,. .a. .w.h.o.l.l.y. .o.w.n.e.d. .s.u.b.s.i.d.i.a.r.y. .o.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.h.i.s. .i.s. .a. .l.e.g.a.l. .a.g.r.e.e.m.e.n.t. .b.e.t.w.e.e.n. .u.s.. i.n.s.t.a.l.l.i.n.g. .o.r. .a.c.c.e.s.s.i.n.g. .o.u.r. .S.o.f.t.w.a.r.e. .m.e.a.n.s. .y.o.u. .a.r.e. .a.g.r.e.e.i.n.g. .t.o. .t.h.e.s.e. .t.e.r.m.s.,. .s.o. .p.l.e.a.s.e. .r.e.a.d. .t.h.e.m. .c.a.r.e.f.u.l.l.y... .........T.h.i.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .(.. A.g.r.e.e.m.e.n.t.. ). .c.o.v.e.r.s. .y.o.u.r. .r.i.g.h.t.s. .t.o. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.c.t.i.o.n.s. .o.n. .t.h.a.t. .u.s.e.,. .o.u.r. .r.i.g.h.t. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .r.e.n.e.w. .a.n.d. .c.h.a.r.g.e. .y.o.u. .f.o.r. .p.a.i.d. .v.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-ES.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):100834
                                                                                                                                                                                                                                      Entropy (8bit):3.4280024557861886
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQQ:Jg/5R9WPzzC3cix5kzYdZ+vQNQOg
                                                                                                                                                                                                                                      MD5:36491A6CFF8B60CF03726466CEEBB0E0
                                                                                                                                                                                                                                      SHA1:4E1A04A03C6C61AE843DFA86ADA074F1993A8AC2
                                                                                                                                                                                                                                      SHA-256:30D4ABCB6EE990052D079EE1B57F5B1FDBA0343637AE6C2844BC6543D22EE5B5
                                                                                                                                                                                                                                      SHA-512:7FF7FC6C1E4389F5D2D6120B12749EF68B70B07053525A5F2120E62ABBCFC8DB2A570FCD420B467E4903A5CAA70B5F1AE9E82964F4FB925847377ED6008B61C5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-es-MX.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):100834
                                                                                                                                                                                                                                      Entropy (8bit):3.428304510295199
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQ5:Jg/5R9WPzzC3cix5kzYdZ+vQNQOp
                                                                                                                                                                                                                                      MD5:2ADEB2CD2B6CAA6551DB3085B39ED686
                                                                                                                                                                                                                                      SHA1:06EF0FCE06CC195702C1A962282EB3F9BEFEEE89
                                                                                                                                                                                                                                      SHA-256:FF9395DBE41433EBA7F33689178F78C31311B9BF4569843104DE9157D0A3643F
                                                                                                                                                                                                                                      SHA-512:78187F8F4230F87BF6DF62BC341FDC843CFF8546FA44FAD94A406ADEA77C81BEA51FA2A370F5BE3ACE039F2A377EC5D7E7975576E8A77F99132B71C8EACBED02
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-fi-FI.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2621), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):90558
                                                                                                                                                                                                                                      Entropy (8bit):3.4505889656177646
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:HE2oXLv8VtIG4O4mPf5lC66AlB1Fd+NlLVlbH2ZuWUh/x:Hl4gtI24cf5c6J7l8vWUhJ
                                                                                                                                                                                                                                      MD5:A047978D7239FD164D0F0B4CDE70F429
                                                                                                                                                                                                                                      SHA1:C7D4FA0CAFD7960E4159A90AE66492A1DB9FCED9
                                                                                                                                                                                                                                      SHA-256:8FF6BCED89A9E669D247A37D4AEE43B5B3B362E70DFA3CFD3D23875350659185
                                                                                                                                                                                                                                      SHA-512:F42E7B55FCC7FB8918A45E063C5EE29326221A4B483CD788EF554E63B89E4649690E5EB7497029C2DFFBD3D5688A7D31E9399B831DB67DCED3E9DAFB2B040835
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s.........K.i.i.t.o.s.,. .e.t.t... .v.a.l.i.t.s.i.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .o.h.j.e.l.m.i.s.t.o.n. .j.a. .p.a.l.v.e.l.u.t. .(.. o.h.j.e.l.m.i.s.t.o.. ).,. .j.o.t.k.a. .t.a.r.j.o.a.a. .M.c.A.f.e.e.,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.i.n. .k.o.k.o.n.a.a.n. .o.m.i.s.t.a.m.a. .t.y.t...r.y.h.t.i..... .T...m... .o.n. .l.a.i.l.l.i.n.e.n. .s.o.p.i.m.u.s. .m.e.i.d...n. .j.a. .k...y.t.t...j...n. .v...l.i.l.l..... .A.s.e.n.t.a.m.a.l.l.a. .t.a.i. .k...y.t.t...m...l.l... .o.h.j.e.l.m.i.s.t.o.a.m.m.e. .s.i.t.o.u.d.u.t. .n...i.h.i.n. .e.h.t.o.i.h.i.n.,. .j.o.t.e.n. .o.n. .t...r.k.e.....,. .e.t.t... .l.u.e.t. .n.e. .h.u.o.l.e.l.l.i.s.e.s.t.i... .........T...m... .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s. .(.. s.o.p.i.m.u.s.. ). .p.i.t..... .s.i.s...l.l.....n. .k...y.t.t...j...n. .o.i.k.e.u.d.e.t. .o.h.j.e.l.m.i.s.t.o.n. .k...y.t.t.....n.,. .t...t... .k...y.t.t..... .k.o.s.k.e.v.a.t. .r.a.j.o.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-CA.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):100074
                                                                                                                                                                                                                                      Entropy (8bit):3.456769060516734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9NeT:YwrsE2KdYmfwqjlK2BZVqCChcw0J
                                                                                                                                                                                                                                      MD5:026361432441B00900C15D81EFB20A25
                                                                                                                                                                                                                                      SHA1:287B1A572348C9EF3C17D716EDD54907A067DEE5
                                                                                                                                                                                                                                      SHA-256:BDAB2389238BCC00D71A642842B6167110CD22C04681256FCE1F1D362F7D7523
                                                                                                                                                                                                                                      SHA-512:F5C3009B1101A62BA010921A8DAC44B4D1111B35DD7D50EB33BADF2BEFCA3AFD435C34DC2C7946A9541002D4AADF8DB9B179BD37B85CF155072B5380DA68D5A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-fr-FR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):100074
                                                                                                                                                                                                                                      Entropy (8bit):3.456927512697501
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9NeC:YwrsE2KdYmfwqjlK2BZVqCChcw0E
                                                                                                                                                                                                                                      MD5:859EAF023C1F76ECDACB1E4EBD72BC7D
                                                                                                                                                                                                                                      SHA1:C34AC9FF223F920E751D8EA68E0F6B0E4601AB25
                                                                                                                                                                                                                                      SHA-256:0B451919A76D1EDE9E6C23D08F2ADDD2FD827D280407886E15093F8315CFE857
                                                                                                                                                                                                                                      SHA-512:BB60DE2FB2010D1E945B9C2E66AC989B8932D6E22A79A6752D4A91B4058C97A2260823A3B9DEA613CEFCCF604E448AFEE6A63B8F22141A938914FF594F5FDCDD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-hr-HR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2677), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):87744
                                                                                                                                                                                                                                      Entropy (8bit):3.58798496222848
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:4D5AY14mQom+cQuoy8H5Zo3ij63ydrXxYM+gDUC5lBvt4UgmsiyePIOK:3jelDB1vg
                                                                                                                                                                                                                                      MD5:F0F33F656C531A87089BEFD7FAC76A67
                                                                                                                                                                                                                                      SHA1:8E340F2A43C79656B5F5FE9AFF516EDA7291C209
                                                                                                                                                                                                                                      SHA-256:A025649E8AE1B5D9B8EE741DF8A0C277B25C901007829DAD897B92C3443780B9
                                                                                                                                                                                                                                      SHA-512:12BC664A425F0F2D356EE933BF5D42961FB101A81F5FD7496090F5F25B412EE6AE22CD0FA834C0642ED468507B795EEE6F078756DE67D66190785955C8C73205
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.v.e.r.".).,. .k.o.j.i. .i.s.p.o.r.u...u.j.e. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .t.v.r.t.k.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s.. i.n.s.t.a.l.i.r.a.n.j.e. .i.l.i. .p.r.i.s.t.u.p. .n.a.a.e.m. .S.o.f.t.v.e.r.u. .z.n.a...i. .d.a. .s.e. .s.l.a.~.e.t.e. .s. .n.j.e.g.o.v.i.m. .u.v.j.e.t.i.m.a.,. .p.a. .v.a.s. .m.o.l.i.m.o. .d.a. .i.h. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.t.e... .........O.v.a.j. .L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".U.g.o.v.o.r.".). .o.b.u.h.v.a...a. .v.a.a.e. .p.r.a.v.o. .n.a. .k.o.r.i.a.t.e.n.j.e. .S.o.f.t.v.e.r.a.,. .o.g.r.a.n.i...e.n.j.a. .u. .n.j.e.g.o.v.o.m. .k.o.r.i.a.t.e.n.j.u.,. .n.a.a.e. .p.r.a.v.o. .n.a. .a.u.t.o.m.a.t.s.k.o. .o.b.n.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-hu-HU.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2782), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):98690
                                                                                                                                                                                                                                      Entropy (8bit):3.6859429785866773
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:3+Y5qMxXdv62/0ojFC0hQY+eUbM5wbg6u+sWOvm1SeWN3CBw4bZKMoBwAbCxpI1R:zsGDmMeo
                                                                                                                                                                                                                                      MD5:75C761130ED7CF86657209EA25D0AB63
                                                                                                                                                                                                                                      SHA1:65A7F1061516C37E96052A58384B9E53F22500F1
                                                                                                                                                                                                                                      SHA-256:960B02F8FF4F01689E61B4CE19EF3E87B4F998A0AAD5FB5919D893B81051FF35
                                                                                                                                                                                                                                      SHA-512:854ADB7925CE6307A7B5288071B47389ECA2EFA01C68978A1A17FB0B2F038A24BA194C956AF7C92ACF3DEC1C87A5C5D198D8F7EC9C6431D42AE12F49A359D31C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s.........K...s.z...n.j...k.,. .h.o.g.y. .a.z. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .t.e.l.j.e.s. .t.u.l.a.j.d.o.n... .l.e...n.y.v...l.l.a.l.a.t.a.,. .a. .M.c.A.f.e.e. ...l.t.a.l. .k...n...l.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.z.o.f.t.v.e.r.t. ...s. .s.z.o.l.g...l.t.a.t...s.o.k.a.t. .(.. S.z.o.f.t.v.e.r.. ). .h.a.s.z.n...l.j.a... .E.z. .a. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .e.g.y. .k...z...t.t...n.k. .l...t.r.e.j...t.t. .j.o.g.i. .m.e.g...l.l.a.p.o.d...s. .. .a. .S.z.o.f.t.v.e.r...n.k. .t.e.l.e.p...t...s.e. .v.a.g.y. .a. .S.z.o.f.t.v.e.r...n.k.h...z. .v.a.l... .h.o.z.z...f...r...s. .a.z.t. .j.e.l.e.n.t.i.,. .h.o.g.y. ...n. .e.g.y.e.t...r.t. .a. .s.z.e.r.z.Q.d...s.b.e.n. .f.o.g.l.a.l.t. .f.e.l.t...t.e.l.e.k.k.e.l.,. .e.z...r.t. .o.l.v.a.s.s.a. .e.l. .f.i.g.y.e.l.m.e.s.e.n. .a.z.o.k.a.t... .........A.z. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .(.. S.z.e.r.z.Q.d...s.. ). .a. .S.z.o.f.t.v.e.r. .h.a.s.z.n...l.a.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-it-IT.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2974), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):103642
                                                                                                                                                                                                                                      Entropy (8bit):3.410923213664887
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:D+piF3I9T9qL1rEINLBC7LcfZJJSMqHDYCebssNKlU8rmjVHJkItVdM1Orzj8:6/c16yjdM1OY
                                                                                                                                                                                                                                      MD5:266422362D4487E33FA55D1644FDD2C1
                                                                                                                                                                                                                                      SHA1:73B1DFC1D22B0EA9070776B481F53FFE08E4A500
                                                                                                                                                                                                                                      SHA-256:1338056263EF2CF86FF8B6926F3AC25631B85813B07BF9BD3ECBE427A25905F3
                                                                                                                                                                                                                                      SHA-512:80E617FB194CF7783DFE1BB5DAEF9CE47669D7571868650998778F4CF259D79183AB991B1DA77F49297A56EDF71399047B531F40412D0C6D442F6E01F923167F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..C.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.z.i.e. .p.e.r. .a.v.e.r. .s.c.e.l.t.o. .d.i. .u.t.i.l.i.z.z.a.r.e. .i. .s.o.f.t.w.a.r.e. .e. .i. .s.e.r.v.i.z.i. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".). .f.o.r.n.i.t.i. .d.a. .M.c.A.f.e.e.,. .c.o.n.s.o.c.i.a.t.a. .i.n.t.e.r.a.m.e.n.t.e. .c.o.n.t.r.o.l.l.a.t.a. .d.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .I.l. .p.r.e.s.e.n.t.e. .d.o.c.u.m.e.n.t.o. .c.o.s.t.i.t.u.i.s.c.e. .u.n. .c.o.n.t.r.a.t.t.o. .l.e.g.a.l.e. .t.r.a. .n.o.i. .e. .l.'.u.t.e.n.t.e... .L.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .o. .l.'.a.c.c.e.s.s.o. .a.i. .n.o.s.t.r.i. .S.o.f.t.w.a.r.e. .i.m.p.l.i.c.a. .l.'.a.c.c.e.t.t.a.z.i.o.n.e. .d.i. .q.u.e.s.t.i. .t.e.r.m.i.n.i. .d.a. .p.a.r.t.e. .d.e.l.l.'.u.t.e.n.t.e.,. .c.h.e. .p.e.r.t.a.n.t.o. ... .t.e.n.u.t.o. .a. .l.e.g.g.e.r.l.i. .c.o.n. .a.t.t.e.n.z.i.o.n.e... .........I.l. .p.r.e.s.e.n.t.e. .c.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.t.o.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-ja-JP.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (1234), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):41412
                                                                                                                                                                                                                                      Entropy (8bit):5.771690240275463
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:8bY257pwJE0xJUhghf/3Gkojyef4ktbfR/KSCDpKIb5MhOZ:8E257OJE0ighfSyKtbfxapB
                                                                                                                                                                                                                                      MD5:6C7F6872BA27531BC70831CC9ABB326C
                                                                                                                                                                                                                                      SHA1:01ABACE1DFFF6AF1A387D8067A857AE50DA87CF0
                                                                                                                                                                                                                                      SHA-256:6F18E6253EF1C7BC883BE56F135171145A86B271A76B2D8BA16AF0F6B1F6CF67
                                                                                                                                                                                                                                      SHA-512:AB64DFB2688E715058CB232888D75254FE366A2C0EA4035054E69E78E7B279FE60647D15290B50678BE1022FA89AF29847C4C98416283CA8E6370604E849A19A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .n0hQM..Q.P[.O>yg0B0.0 .M.c.A.f.e.e.L0.c.OY0.0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..0.0.0.0.0.0J0.0s0.0.0.0.0...0.0.0.0.0.0.0.0...0)R(uD0_0`0M0B0.0L0h0F0T0V0D0~0Y0.0 .,gQY.}o0J0.[.ih0S_>yh0n0..k0.}P}U0.0.0.l.vj0QY.}g0Y0.0J0.[.io0.0S_>yn0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0]0.0k0.0.0.0.0Y0.0S0h0k0.0.0.0,gQY.}n0ag.Nk0.T.aW0_0h0.0j0U0.0~0Y0n0g0.0,gQY.}.0.0O0J0...0O0`0U0D0.0 .........S0n0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}.f...0,gQY.}.0..o0.0J0.[.in0.0.0.0.0.0.0.O(u)j.0.O(u6RP..0.0.0.0.0.0.0n0.g.Q.0.0.0.0.0~0_0o0_j...0..R.vk0.f.eJ0.0s0...Y0.0S_>yn0)j)R.0J0.0s0S_>yh0J0.[.in0..k0zv.uY0.0.S..'`n0B0.0.}.Nn0.N..k0.[Y0.0J0.[.in0.T.ak0d0D0f0....W0f0D0~0Y0.0 ....j0.0,gQY.}h0h0.0k0J0.[.ik0i.(uU0.0.0.0S_>yn0.0.0.0.0.0.0k0..Y0.0.X.f..h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.j.a.p.a.n.e.s.e./.i.n.d.e.x...h.t.m....0+T.0...Rag.Nx0n0.0.0.0L0+T~0.0f0D0~0Y0.0 ..T.Vyr.gn0ag.No0,gQY.}

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-ko-KR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (1439), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):46328
                                                                                                                                                                                                                                      Entropy (8bit):5.585182635780428
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:iLBTRAz/+e7qDm/7QgTt2Bk6baOLFureI5mIxFRlKi3lr:iLnAz/+e+DmzQgZ2BdblJsSi3lr
                                                                                                                                                                                                                                      MD5:8DC1287BCDE9634470CBC729998DB5D8
                                                                                                                                                                                                                                      SHA1:3E5FFB0DD3B6750F2C53A8B57D005AA8421089C1
                                                                                                                                                                                                                                      SHA-256:C81F8A65D9B1E06754BEA0AABC2BB0882A63F5D0D9C2975DF939E239297FE0AB
                                                                                                                                                                                                                                      SHA-512:0EB10729587531E25BE1CCD26685CADBF7901170009AA6160EEF2BEE85C6D7BDD995A6DDC67CB17AE36FF3205B81DD02B656B139051FB74AD4479CE834BB6989
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .|.t. ... ..}.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.X. ...a. .... .....x. .M.c.A.f.e.e..... .....X.. .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......... ... ...D...(.t.X. .. ......... ).|. .....t. ...T... .....i..... .t..@. .....@. ...... ...t.X. ..... ..}...... .....X. .........|. .$.X.X.p... .a.8...X.. ...@. .t. ..}. .}..... ..X.X.. ...t...\.,. .}...D. ...X. .J... .}.<...0. ......... .........t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .|.t. ... ..}.(.t.X. .. .}.. ).@. ......... ..... .....,. ......... .....X. ...\. .p.t.,. .........X. . .. .....t.. .0..... ...t. ....<.\. ..}.D. .1...X.. ......... ...a.D. ...l.`. ... .... .....X. .....,. ...... .....@. ...... ...t... .....`. ... .... .....X. ...... ...\. ...X.X. ..X. .....D. ........ .t. .8...... ...X.... ........ .t. ..... ..}.D. .l.1.X.. .\. .....x. ....\. ..... ..}. .}...(...:. ...x.......8. .H..8.,. .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-nb-NO.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2743), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):84476
                                                                                                                                                                                                                                      Entropy (8bit):3.4475806099732793
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKQ/s+p6jdIuRMPNGZJq7ALa/jcuqqRp5Q9:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKT
                                                                                                                                                                                                                                      MD5:6CA4A7BDD113BA4CBEB11C1F6D55E878
                                                                                                                                                                                                                                      SHA1:D0E7870292715E80F6EF9EF097304EB34E278F04
                                                                                                                                                                                                                                      SHA-256:6938C6036427CF9573BC12E94D281F15ED80F79FF536B22765CF0DA907E5BF85
                                                                                                                                                                                                                                      SHA-512:997B039644AF43927F936E36AB52CE57F95EF05C234EFD1AEC6F379597C8A6AA126F9CF85EF48A5377B9B00FC0D258AE7AFD8DA9593FA516B945DE69BAD8F0FE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.s.e.n.s.a.v.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.k. .f.o.r. .a.t. .d.u. .b.r.u.k.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .p.r.o.g.r.a.m.v.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".p.r.o.g.r.a.m.m.e.t.).,. .l.e.v.e.r.t. .a.v. .M.c.A.f.e.e.,. .e.t. .h.e.l.e.i.d. .d.a.t.t.e.r.s.e.l.s.k.a.p. .a.v. .I.n.t.e.r. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.v.t.a.l.e. .m.e.l.l.o.m. .o.s.s. .. .i.n.s.t.a.l.l.a.s.j.o.n. .e.l.l.e.r. .b.r.u.k. .a.v. .v...r. .p.r.o.g.r.a.m.v.a.r.e. .b.e.t.y.r. .a.t. .d.u. .g.o.d.t.a.r. .d.i.s.s.e. .v.i.l.k...r.e.n.e.,. .s... .l.e.s. .d.e.m. .n...y.e... .........D.e.n.n.e. .l.i.s.e.n.s.a.v.t.a.l.e.n. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".a.v.t.a.l.e.n.".). .d.e.k.k.e.r. .d.i.n. .r.e.t.t. .t.i.l. ... .b.e.n.y.t.t.e. .p.r.o.g.r.a.m.v.a.r.e.n.,. .b.e.g.r.e.n.s.n.i.n.g.e.r. .p... .d.e.n.n.e. .b.r.u.k.e.n.,. .v...r. .r.e.t.t. .t.i.l. .a.u.t.o.m.a.t.i.s.k. .f.o.r.n.y.e.l.s.e. .o.g. .t.a. .b.e.t.a.l.t. .f.o.r. .b.e.t.a.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-nl-NL.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2801), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):100578
                                                                                                                                                                                                                                      Entropy (8bit):3.441900782202567
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:OQ/9KbnOOfNlk/R5OVUR5Oh/RKe/HEUnOZVOsf6jzytJpjIzGeQRV22n3sT58jQO:7
                                                                                                                                                                                                                                      MD5:A01868D8BDC821913012C2B8C29552F7
                                                                                                                                                                                                                                      SHA1:513CA1D31EA18BAA36D6715824FA88933B6AF4B6
                                                                                                                                                                                                                                      SHA-256:FFAF392F8A5F32E210B423C7EA49F991BEC91E18ADE18C3CA913AFD0F7DB91A2
                                                                                                                                                                                                                                      SHA-512:ED7756573905F83071F5E154155AD3EEEED7DC6170010A42A3F6EB95F50B7D2D1E6BA969181388B7EC90083F1F9F44B926C3A1734B8416AAC604B0C009F3AE99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.a.n.k. .u. .v.o.o.r. .h.e.t. .g.e.b.r.u.i.k. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.-.s.o.f.t.w.a.r.e. .e.n. .-.d.i.e.n.s.t.e.n. .(.'.S.o.f.t.w.a.r.e.'.).,. .a.a.n.g.e.b.o.d.e.n. .d.o.o.r. .M.c.A.f.e.e.,. .e.e.n. .v.o.l.l.e.d.i.g.e. .d.o.c.h.t.e.r.o.n.d.e.r.n.e.m.i.n.g. .v.a.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.i.t. .i.s. .e.e.n. .j.u.r.i.d.i.s.c.h.e. .o.v.e.r.e.e.n.k.o.m.s.t. .t.u.s.s.e.n. .o.n.s... .D.o.o.r. .o.n.z.e. .S.o.f.t.w.a.r.e. .t.e. .i.n.s.t.a.l.l.e.r.e.n. .e.n. .t.e. .o.p.e.n.e.n.,. .g.e.e.f.t. .u. .a.a.n. .d.a.t. .u. .a.k.k.o.o.r.d. .g.a.a.t. .m.e.t. .d.e.z.e. .v.o.o.r.w.a.a.r.d.e.n... .L.e.e.s. .z.e. .d.u.s. .z.o.r.g.v.u.l.d.i.g... .........D.e.z.e. .L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.'.O.v.e.r.e.e.n.k.o.m.s.t.'.). .b.e.s.c.h.r.i.j.f.t. .u.w. .r.e.c.h.t.e.n. .o.m. .d.e. .S.o.f.t.w.a.r.e. .t.e. .g.e.b.r.u.i.k.e.n.,. .d.e. .b.e.p.e.r.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-pl-PL.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2967), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):101850
                                                                                                                                                                                                                                      Entropy (8bit):3.7336966797598805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:dnEmLzXswPaPfzO8liJQIKQ42HzLMH7scwS3/80GIrKQ+QM:ayXeo
                                                                                                                                                                                                                                      MD5:868618F543D0C5ABA43DE44071794B38
                                                                                                                                                                                                                                      SHA1:D33519C9283B4B09FA1AF46B228D19783D9CF92E
                                                                                                                                                                                                                                      SHA-256:C15649C9F86F8C7D0A4E7F6B3D047671D509786191C5FD490DC1847CB0B21360
                                                                                                                                                                                                                                      SHA-512:5F7FF28FD98E0C87091BB64600C805A65F018DA307D7F4AB0C94CEC3F34E5FE26571EB73BD4BD1BC733E7AF30DCA123CC48FB4ED222EE892C92CF30200EBE5FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..U.m.o.w.a. .l.i.c.e.n.c.y.j.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.z.i...k.u.j.e.m.y. .z.a. .k.o.r.z.y.s.t.a.n.i.e. .z. .o.p.r.o.g.r.a.m.o.w.a.n.i.a. .i. .u.s.B.u.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.z.w.a.n.y.c.h. .d.a.l.e.j. .. O.p.r.o.g.r.a.m.o.w.a.n.i.e.m.. ). .o.f.e.r.o.w.a.n.y.c.h. .p.r.z.e.z. .M.c.A.f.e.e.,. .s.p...B.k... .z.a.l.e.|.n...,. .k.t...r.e.j. .w.y.B...c.z.n.y.m. .w.B.a.[.c.i.c.i.e.l.e.m. .j.e.s.t. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N.i.n.i.e.j.s.z.y. .d.o.k.u.m.e.n.t. .s.t.a.n.o.w.i. .u.m.o.w... .p.r.a.w.n... .m.i...d.z.y. .n.a.m.i. .a. .U.|.y.t.k.o.w.n.i.k.i.e.m. .. .z.a.i.n.s.t.a.l.o.w.a.n.i.e. .n.a.s.z.e.g.o. .O.p.r.o.g.r.a.m.o.w.a.n.i.a. .l.u.b. .u.z.y.s.k.a.n.i.e. .d.o. .n.i.e.g.o. .d.o.s.t...p.u. .j.e.s.t. .r...w.n.o.z.n.a.c.z.n.e. .z. .z.a.a.k.c.e.p.t.o.w.a.n.i.e.m. .n.i.n.i.e.j.s.z.y.c.h. .w.a.r.u.n.k...w.,. .w. .z.w.i...z.k.u. .z. .c.z.y.m. .p.r.o.s.i.m.y. .o. .u.w.a.|.n.e. .z.a.p.o.z.n.a.n.i.e. .s.i... .z. .t.r.e.[.c.i... .d.o.k.u.m.e.n.t.u... ...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-BR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2603), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):91306
                                                                                                                                                                                                                                      Entropy (8bit):3.465058408699289
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:f8Wc1lp2b6cXQJ6rHcTCGXPF3zzhTOJpy0WlLyd5S+tKIbTw3ZurbNlar+wHmCYY:f7HceS+3bTrb/R6mdyd
                                                                                                                                                                                                                                      MD5:8ED01AF36A96D5933FBBC78CED777F77
                                                                                                                                                                                                                                      SHA1:E6509BA295633BCF387559F2CBB95CC847457469
                                                                                                                                                                                                                                      SHA-256:C446AE91F85DD2779A13A70583825C5067F97DE81EDBD59D1C32879859BA5145
                                                                                                                                                                                                                                      SHA-512:8C0B61DF2EE05D3DFFA95B8813828FCF30C4FDA54B973C038F01BB3BAB4DC21263DEFC6A051CCD934E491DF82BA4CEAC03CC5D3240364D8B4E867ADA6EDC6EEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........A.g.r.a.d.e.c.e.m.o.s. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".).,. .f.o.r.n.e.c.i.d.o. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .i.n.t.e.g.r.a.l. .d.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. ... .u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .n...s.:. .a.o. .i.n.s.t.a.l.a.r. .o.u. .a.c.e.s.s.a.r. .n.o.s.s.o. .S.o.f.t.w.a.r.e.,. .s.i.g.n.i.f.i.c.a. .a. .s.u.a. .c.o.n.c.o.r.d...n.c.i.a. .c.o.m. .e.s.t.e.s. .t.e.r.m.o.s.,. .d.e. .f.o.r.m.a. .q.u.e. .v.o.c... .d.e.v.e. .l...-.l.o.s. .c.o.m. .a. .m...x.i.m.a. .a.t.e.n.....o... .........E.s.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.o.".). .c.o.b.r.e. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.....e.s. .a. .e.s.s.e. .u.s.o.,. .o. .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-pt-PT.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2536), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):96486
                                                                                                                                                                                                                                      Entropy (8bit):3.4740788952855137
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:GfDawY1TqufUqhbQGb0jiATGoeQmiBKTVIsFdwb:2DetG
                                                                                                                                                                                                                                      MD5:27331E6D23C62FEA0F0557F13D99D43C
                                                                                                                                                                                                                                      SHA1:8D474CBFE5B8E772AA4F5AFA6A9B59F06119A55E
                                                                                                                                                                                                                                      SHA-256:4F53C602976E47C1DAEC67E1300E22E9E6BBB7B511A9CD31B38880C8B6821C1E
                                                                                                                                                                                                                                      SHA-512:78FE5479997BC23C9F458880DEE0B660D8FC798A44860F0657B0979D0DB67D01F544E17F50B1259DEEB8C649AC81B74CA95D5A6BC7FC374918210907CC7D8C3B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........O.b.r.i.g.a.d.o. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ). .f.o.r.n.e.c.i.d.o.s. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .t.o.t.a.l.m.e.n.t.e. .d.e.t.i.d.a. .p.e.l.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .d.o.c.u.m.e.n.t.o. .c.o.n.s.i.s.t.e. .n.u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .a.m.b.a.s. .a.s. .p.a.r.t.e.s.. a.o. .i.n.s.t.a.l.a.r. .o.u. .a.o. .a.c.e.d.e.r. .a.o. .n.o.s.s.o. .S.o.f.t.w.a.r.e. .e.s.t... .a. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .p.r.e.s.e.n.t.e.s. .t.e.r.m.o.s.,. .p.o.r. .i.s.s.o.,. .l.e.i.a.-.o.s. .a.t.e.n.t.a.m.e.n.t.e... .........O. .p.r.e.s.e.n.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. C.o.n.t.r.a.t.o.. ). .i.n.c.l.u.i. .o.s. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-ru-RU.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2934), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):105274
                                                                                                                                                                                                                                      Entropy (8bit):3.9253890058091128
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:Zrlkl/OV57V/gTNKukdeCNCaM2sJCX7Zh7Ft7yvFsknxFFNZ6AJTaFkke2bnMBqF:JfRpOEZhc8LSQ0PnmE0
                                                                                                                                                                                                                                      MD5:8E8679BD238881B4E328758EE9B1CD2C
                                                                                                                                                                                                                                      SHA1:8B58CFA9E861D4F4423C7D9A39F0A4C5AFAEEEEB
                                                                                                                                                                                                                                      SHA-256:87DF68D221DED619D5B33F572270BB4A78678ED550912286058185A7D46AD3D3
                                                                                                                                                                                                                                      SHA-512:3B995444C93AF8B9FB4A566406F0E4351A45A7F8359DB773C3D54B630991C1F160B91D2BCD9F2FCA6FF3AAAA503DA2F5DB1302C5C53669B4E839F39D099E59E2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:....8.F.5.=.7.8.>.=.=.>.5. .A.>.3.;.0.H.5.=.8.5. .4.;.O. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........;.0.3.>.4.0.@.8.<. ...0.A. .7.0. .8.A.?.>.;.L.7.>.2.0.=.8.5. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .8. .A.;.C.6.1. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(."...@.>.3.@.0.<.<.=.>.5. .>.1.5.A.?.5.G.5.=.8.5.".).,. .?.@.5.4.>.A.B.0.2.;.O.5.<.K.E. .:.>.<.?.0.=.8.5.9. .M.c.A.f.e.e. .. .4.>.G.5.@.=.5.9. .:.>.<.?.0.=.8.5.9.,. .=.0.E.>.4.O.I.5.9.A.O. .2. .?.>.;.=.>.9. .A.>.1.A.B.2.5.=.=.>.A.B.8. .:.>.@.?.>.@.0.F.8.8. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ...0.=.=.K.9. .4.>.:.C.<.5.=.B. .?.@.5.4.A.B.0.2.;.O.5.B. .N.@.8.4.8.G.5.A.:.>.5. .A.>.3.;.0.H.5.=.8.5. .<.5.6.4.C. .=.0.<.8... .#.A.B.0.=.>.2.:.0. .8.;.8. .4.>.A.B.C.?. .:. .=.0.H.5.<.C. ...@.>.3.@.0.<.<.=.>.<.C. .>.1.5.A.?.5.G.5.=.8.N. .>.1.>.7.=.0.G.0.N.B. ...0.H.5. .A.>.3.;.0.A.8.5. .A. .C.A.;.>.2.8.O.<.8. .M.B.>.3.>. .A.>.3.;.0.H.5.=.8.O.,. .?.>.M.B.>.<.C. .2.=.8.<.0.B.5.;.L.=.>. .>.7.=.0.:.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-sk-SK.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2701), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):89572
                                                                                                                                                                                                                                      Entropy (8bit):3.7335008776841807
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:plH9miYwq9hpeKK283X97rpcvXctx1qDQDupSMeylm5Wq0FGQueLS9FpSzvFgxSI:pPfqU7AcD1/DmDqOrS9FpkXvaGOtdr
                                                                                                                                                                                                                                      MD5:57DDAB65D1D5F575977AFCAF92F9C9C1
                                                                                                                                                                                                                                      SHA1:41FFD8C6FF2D41912A945BD307EF69CBEC60B1B5
                                                                                                                                                                                                                                      SHA-256:AEE55641C00773BA23B26AEF0720578EFCBB7F7B2B22E328E9422083F824B1EE
                                                                                                                                                                                                                                      SHA-512:1CD3CD42AA44C96DDCEB055153A6B32758E94B0DA77AC6FAC1DA12ECA4310279755FE6F7FD0F7F3E60E71C20B0E9740F218D1E5A5A932217FAF15443EAAB6D49
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........a.k.u.j.e.m.e. .v...m. .z.a. .p.o.u.~...v.a.n.i.e. .s.o.f.t.v...r.u. .a. .s.l.u.~.i.e.b. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v...r.. ).,. .p.o.s.k.y.t.o.v.a.n...c.h. .s.p.o.l.o...n.o.s.e.o.u. .M.c.A.f.e.e.,. .k.t.o.r... .j.e. .d.c...r.s.k.o.u. .s.p.o.l.o...n.o.s.e.o.u. ...p.l.n.e. .v.l.a.s.t.n.e.n.o.u. .s.p.o.l.o...n.o.s.e.o.u. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.o.t.o. .j.e. .p.r...v.n.a. .z.m.l.u.v.a. .m.e.d.z.i. .n.a.m.i. .. .i.n.a.t.a.l...c.i.o.u. .a.l.e.b.o. .p.r...s.t.u.p.o.v.a.n...m. .k. .n...a.m.u. .S.o.f.t.v...r.u. .s...h.l.a.s...t.e. .s. .t...m.i.t.o. .p.o.d.m.i.e.n.k.a.m.i.,. .t.a.k.~.e. .s.i. .i.c.h.,. .p.r.o.s...m.,. .p.o.z.o.r.n.e. .p.r.e.....t.a.j.t.e... .........T...t.o. .L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(...a.l.e.j. .l.e.n. .. Z.m.l.u.v.a.. ). .s.a. .v.z.e.a.h.u.j.e. .n.a. .v.a.a.e. .p.r...v.a. .n.a. .p.o.u.~...v.a.n.i.e. .S.o.f.t.v...r.u.,. .o.b.m.e.d.z.e.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-sr-Latn-CS.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2634), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):88356
                                                                                                                                                                                                                                      Entropy (8bit):3.5780462545512095
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:1PXzqxuAlAEnb93roW/JxeTYZ9/sn7/87/FXoQEHVX/Z0S/jj:dWVkTmR12
                                                                                                                                                                                                                                      MD5:449B9426C6C6CA645B6BCDB1A69122CA
                                                                                                                                                                                                                                      SHA1:3CF9A6BCD1580F3F9875BF87730DA14FBA64DAD7
                                                                                                                                                                                                                                      SHA-256:034F01176DFF06358C7BF32CBA0B60A671831EC3C39CE4B3C75A2051C6843DA6
                                                                                                                                                                                                                                      SHA-512:4909B45B95161960665821C98E8BA99C590F8DA69E19D5FB4BD897A53565DCB7A9979F28B62C115D8FF8BC3A40E5A4DEA947C92CBE55ECDF7B148123BECB4F52
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .v.a.m. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v.e.r.. ).,. .k.o.j.i. .o.b.e.z.b.e...u.j.e. .k.o.m.p.a.n.i.j.a. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s. .. .i.n.s.t.a.l.i.r.a.n.j.e. .n.a.a.e.g. .S.o.f.t.v.e.r.a. .i.l.i. .p.r.i.s.t.u.p.a.n.j.e. .n.j.e.m.u. .z.n.a...i. .d.a. .p.r.i.h.v.a.t.a.t.e. .o.v.e. .u.s.l.o.v.e.,. .p.a. .i.h. .s.t.o.g.a. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.j.t.e... .........O.v.a.j. .U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. U.g.o.v.o.r.. ). .p.o.k.r.i.v.a. .v.a.a.a. .p.r.a.v.a. .d.a. .k.o.r.i.s.t.i.t.e. .S.o.f.t.v.e.r.,. .o.g.r.a.n.i...e.n.j.a. .t.o.g. .k.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-sv-SE.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2632), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):89704
                                                                                                                                                                                                                                      Entropy (8bit):3.503679482731326
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:dcFeHhjwanoMWVOjxKI+psB/YgpnuIbVGm8:WFCwKWsQgpM
                                                                                                                                                                                                                                      MD5:0BF8549EE388824ECE877A8F57284741
                                                                                                                                                                                                                                      SHA1:5DC7E108E0C92840ED5233DF96648FB79FD0D07E
                                                                                                                                                                                                                                      SHA-256:C171B6CF831FF87A9DA8085AAED1345B466CDCE40F1272338DB4578FCE516D8C
                                                                                                                                                                                                                                      SHA-512:02F28793B7DD26F647551F8C946325094E2372076761986C0C952EC1DE91AACD96FFD39DE550972838BA24DB533AF55D86B2271F84844424978CCD7FD2EA11E1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.c.k. .f...r. .a.t.t. .d.u. .a.n.v...n.d.e.r. .p.r.o.g.r.a.m.v.a.r.a.n. .o.c.h. .t.j...n.s.t.e.r.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. P.r.o.g.r.a.m.v.a.r.a.n.. ). .f.r...n. .M.c.A.f.e.e.,. .e.t.t. .h.e.l...g.t. .d.o.t.t.e.r.b.o.l.a.g. .t.i.l.l. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N...r. .d.u. .i.n.s.t.a.l.l.e.r.a.r. .e.l.l.e.r. .a.n.v...n.d.e.r. .P.r.o.g.r.a.m.v.a.r.a.n. .g.o.d.k...n.n.e.r. .d.u. .a.u.t.o.m.a.t.i.s.k.t. .v.i.l.l.k.o.r.e.n.,. .s... .l...s. .n.o.g.a. .i.g.e.n.o.m. .d.e.m. .f...r.s.t... .D.e.t.t.a. ...r. .e.t.t. .b.i.n.d.a.n.d.e. .j.u.r.i.d.i.s.k.t. .a.v.t.a.l. .o.s.s. .e.m.e.l.l.a.n... .........D.e.t.t.a. .L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. A.v.t.a.l.e.t.. ). .r.e.g.l.e.r.a.r. .d.i.n.a. .r...t.t.i.g.h.e.t.e.r. .i. .s.a.m.b.a.n.d. .m.e.d. .a.n.v...n.d.n.i.n.g. .a.v. .P.r.o.g.r.a.m.v.a.r.a.n.,. .e.v.e.n.t.u.e.l.l.a. .b.e.g.r...n.s.n.i.n.g.a.r. .i. .a.n.v...n.d.n.i.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-tr-TR.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (2527), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):89572
                                                                                                                                                                                                                                      Entropy (8bit):3.762382319609866
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:U4WLetFwU8STnnWH0I9fkl7+JaRtbJHGdnC2vJfPI9n9AkllkhZBYziG/xJd8oSc:UjLetFwbSTnnWH0IdkN+JaRt0dnC2xIp
                                                                                                                                                                                                                                      MD5:1B4DD315A275F8BFED163420DA8FBEE4
                                                                                                                                                                                                                                      SHA1:A6CDDB33749AE857176B15008F1E50AED603045B
                                                                                                                                                                                                                                      SHA-256:61C8CEA6AB8E5461CC240EEF016BDEB16E62BC6B7744DA9E80B51B1123BD6237
                                                                                                                                                                                                                                      SHA-512:30632B6DC06B57F0092CEBFCC7687C7E005B85A1E55804CC235ADEB0D057C80C39675F89DD41F092071213FC32CAA5132F82F92AD6F3EA33FEE7425963589B99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.. 1.n. .y...z.d.e. .y...z. .i._.t.i.r.a.k.i. .o.l.a.n. .M.c.A.f.e.e. .t.a.r.a.f.1.n.d.a.n. .s.a...l.a.n.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .y.a.z.1.l.1.m.1. .v.e. .h.i.z.m.e.t.l.e.r.i.n.i. .(.. Y.a.z.1.l.1.m.. ). .k.u.l.l.a.n.d.1...1.n.1.z. .i...i.n. .t.e._.e.k.k...r. .e.d.e.r.i.z... .Y.a.z.1.l.1.m.1.m.1.z.1.n. .k.u.r.m.a.n.1.z. .v.e.y.a. .Y.a.z.1.l.1.m.1.m.1.z.a. .e.r.i._.i.m. .s.a...l.a.m.a.n.1.z. .a.r.a.m.1.z.d.a.k.i. .b.u. .y.a.s.a.l. .s...z.l.e._.m.e.n.i.n. .i.l.g.i.l.i. .h...k...m.l.e.r.i.n.i. .k.a.b.u.l. .e.t.t.i...i.n.i.z. .a.n.l.a.m.1.n.a. .g.e.l.e.c.e...i.n.d.e.n.,. .l...t.f.e.n. .b.u.n.l.a.r.1. .d.i.k.k.a.t.l.i.c.e. .o.k.u.y.u.n... .........0._.b.u. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i. .(.. S...z.l.e._.m.e.. ). .Y.a.z.1.l.1.m.1.n. .k.u.l.l.a.n.1.l.m.a.s.1.n.a. .i.l.i._.k.i.n. .h.a.k.l.a.r.1.n.1.z.1.,. .s...z. .k.o.n.u.s.u. .k.u.l.l.a.n.1.m.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-CN.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (873), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27048
                                                                                                                                                                                                                                      Entropy (8bit):6.793318949139549
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:dGlhiqpYn3S6kZ5pZsM1SDo9P0VSpjzjW+EpgLDR5CCaGdYO7:dWDuIVZsM19DjzjW+EpgLN5qvO7
                                                                                                                                                                                                                                      MD5:359E8741BF5310BFBFC926B2739899AD
                                                                                                                                                                                                                                      SHA1:E3ECADA8CC71A3B8CCC6AD203D40EECFDEFA712E
                                                                                                                                                                                                                                      SHA-256:A24E29E3AAB9D673AB3B3584189440579CBA3E4659755FBCE8DEEB168A1F2721
                                                                                                                                                                                                                                      SHA-512:C7672DD79E7960924F11A16ED363FA571ED793F57DF3DCEEBB7115C8FFA5CEA74DC78DA5F1CE49FCBAC72EE54888A0D8B6928FB521D8A1212C2E5EA862B15312
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS...........a"..`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. ..vhQD.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. .o..N.T.g.R... o..N. ...0 ../f.`.N.b.NKN...v.l._OS.....[..b....b.N.v. o..N. ..sSh.:y.`.T.a..Nag>k...Vdk...N.~.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS..... OS... ...m.v.`.O(u. o..N. .vCg)R.0.O(uP.6R.0.b.N.R.~..v^1\. o..N. .v.N9.Hr,g.b.R...T.`6e9..vCg)R...N.S.`.T.a....N...Q.b.NKN...S...N.u.v.NUO.N...0 .,gOS...S+T.b.N.v...y.X.fI{D..Rag>k.v...c .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.s.i.m.p.l.i.f.i.e.d./.i.n.d.e.x...h.t.m.).....Nag>k._.....v^qQ.T.g.b..(u.N.`.v,g.l._OS...0 ..V.[/.0W:Syr.[.vag>kMO.NOS...v.g.T.Nag.0 ..........Y.g.`*g.n .1.8. ..\...l.g.`.v6r.k.b.v.b.N...N.N._{.HQ.c.S,gOS..v^.Nh..`.{.t. o..N. ...v.T.a...`.N._.O(u. o..N. .b.T.b.N.c.O.`.v*N.N.Oo`.0 .........1......c.S,gOS...T.O9e .. .US.Q. .c.S. .c...b.[.. o..N. ..sSh.:y.`.eag.N.T.a.S,g

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\eula-zh-TW.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (904), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27300
                                                                                                                                                                                                                                      Entropy (8bit):6.852766523087007
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:RLcNdFNy9pQbexWBTeP5s8FmxoFfEgQSPsxFHMOKQZgTmLL/ytmq/d:Rcf6w3BKx/hagQSPsxtKjTmk
                                                                                                                                                                                                                                      MD5:EC47749751D4472B0CE985A60609B1D6
                                                                                                                                                                                                                                      SHA1:9F391EC407FA4F1FD4984E7B2235C8639F81E8E9
                                                                                                                                                                                                                                      SHA-256:1A821698AF829C6B15A5CD0130E84141D9CBB10ED21D692390DA3491F9AC3B53
                                                                                                                                                                                                                                      SHA-512:70A0F745D2275B101FE234265BFA706234F72AE31EEF2CA28027E8C38CD64273DD93D1694B07CAA71DF1443A1F710F4F1259A7BC231DF6E749EBA717C354821D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}.........a...`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .hs.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......g.R...0...0...0 .../f.`...b.PKN...v.l._.T.} .. ..[..bX[.S.b.P.v.0...0..sSh.:y.`.T.a...N.h>k...Vdk..N0}.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}...0.T.}.0...m..`.O(u.0...0.v.k)R.0.O(uP.6R.0.b.P..R.~..&N1\.0...0.v.N..Hr,g.b.R...T.`6e...v.k)R...N.S.`.T.a..N..N...zl.b.PKN...S.."u.u.v.NUO-rp..0 ..b.P.].S.b.b.P.v...y.kr..fI{D..R.h>k.v#.P} .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.t.r.a.d.i.t.i.o.n.a.l./.i.n.d.e.x...h.t.m.)......N.h>k._.....&NqQ.T.i.bi.(u.e.`.v,g.l._.T.}.0 ..W.[/.0W@Syr.[.v.h>kMO.e.T.}.v.g._.N.h.0 ..........Y.g.`*g.n .1.8. .rk...l.g.`.v6r.k.b.vw..N...N.P._..HQ.c.S,g.T.}&N.Nh..`.{.t.0...0...v.T.a...`.N..AQ1..O(u.0...0.b.T.b.P.c.O.`.v.P.N....0 .........1......c.S,g.T.}.T.O9e .. ..c.N.0.c.S.0.c...b.[..0...0..sSh.:y.`!q.h

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2553
                                                                                                                                                                                                                                      Entropy (8bit):5.574169144997834
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3HNBDTz+QdnA/jlE7Nijs371IguQgUlKKGgDlpfkPlC0RbglexOX0wJUGl3nuEIb:3th+y0+7Nks3pIg3lKelpfUlC0lglOOY
                                                                                                                                                                                                                                      MD5:94D48A00A5CD08BCBF7C00FE867AC6C8
                                                                                                                                                                                                                                      SHA1:0E716AB1E0CE58E4A41A2E76609E2CFA5A286903
                                                                                                                                                                                                                                      SHA-256:DCFCCD54723678E4A046D91CFAB4E47A9153F867BF71C02418329E675378C23F
                                                                                                                                                                                                                                      SHA-512:72D934B757AEB52F78BAFBBE40AE651ED767654E19F79979291800956EAB6B63DAB989B015D20BB1C44343A57911B9E6F072FA3361949FAEBA3E1D0AD44617CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. smlouva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "P.e.etl(a) jsem si licen.n. smlouvu a souhlas.m s n..",.. //{0} - Company name.. THANK_YOU: "D.kujeme, .e jste si vybrali aplikaci {0}.",.. INSTALL: "Nainstalovat",.. CANCEL: "Zru.it",.. RETRY: "Zkusit znovu",.. //{0} - Product name.. PROGRESS_TITLE: "Aplikace {0} poskytuje rady ohledn. va.. bezpe.nosti kdekoli na internetu.",.. PROGRESS_SUBTITLE: "Prob.h. instalace...",.. COMPLETE_TITLE: "V.born.! Aplikace byla nainstalov.na a bude v.m poskytovat rady ohledn. bezpe.nosti na internetu.",.. COMPLETE_SUBTITLE: "V.e je p.ipraveno.",.. COMPLETE_LAUNCH: "Otev..t prohl..e.",.. ERROR_OS_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e opera.n. syst.m nespl.uje minim.ln. po.adavky na syst.m. Aktualizujte ho a zkuste to znovu.",.. ERROR_BROWSER_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e prohl..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2347
                                                                                                                                                                                                                                      Entropy (8bit):5.333935106455295
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:37b55gOog4oPO9iEY+0f0t9IcvuZ1Mv9gfdmBnoaljshJdoJ+vOZZOsOhRss1ozx:37jG4f0vI6y1K9gf4lszQ/sfKzMVsLB
                                                                                                                                                                                                                                      MD5:31CD59D443F62894AA7845B16B52D230
                                                                                                                                                                                                                                      SHA1:445862B005673F3D8579E735B9E2BADF12B8A9C1
                                                                                                                                                                                                                                      SHA-256:A136CF17026B7D5C3F7B686095697697AD937F11B7DAD300793BD6A04FAE8484
                                                                                                                                                                                                                                      SHA-512:6D8E4428868C025CC5ECD489DB9AA670B83D6F039A76AE989DE6C96A94ED54BE6C9BD588748094D4327FD66E2777D53BB0A6ED7EF4164D34753D3923FD1C1CDF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licensaftale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har l.st og er indforst.et med licensaftalen",.. //{0} - Company name.. THANK_YOU: "Tak, fordi du valgte {0}",.. INSTALL: "Installer",.. CANCEL: "Annuller",.. RETRY: "Pr.v igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhedsr.dgiver, uanset hvor du f.rdes p. nettet.",.. PROGRESS_SUBTITLE: "Installerer ...",.. COMPLETE_TITLE: "Fint. Vi har installeret din personlige onliner.dgiver.",.. COMPLETE_SUBTITLE: "Klar til start",.. COMPLETE_LAUNCH: ".bn browseren",.. ERROR_OS_REQUIREMENTS: "Installationen kan ikke forts.tte, da operativsystemet ikke lever op til minimumssystemkravene. Opdater, og pr.v igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen kan ikke forts.tte, da browseren ikke lever op til minimumssystemkravene. Opdater browseren, og pr.v igen.",.. ERROR_VERSION: "Der er allerede installeret e

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2600
                                                                                                                                                                                                                                      Entropy (8bit):5.247421187490919
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3BYBnLb7UozPrEqx8LL+79IAbBblfBWE6ToivxPEbgHIhygeCovzxkI+o5EREm2p:3BwbkLv+5Ik5lfgq8xAgj/Jvzyi2m5
                                                                                                                                                                                                                                      MD5:CB1508DCE3D340F7510181A0D8C8795C
                                                                                                                                                                                                                                      SHA1:E07A00782D22DE00EBDB8922E39F8AE94B2620FF
                                                                                                                                                                                                                                      SHA-256:768CE90BC1ABF7C4B4DE06AF052EAA469B96A2A15A96BC2C93517A233C24B8B8
                                                                                                                                                                                                                                      SHA-512:1BF169C5492BD29D5D39B42890AD0A657CEC69ECE0D8EA37265912402548F0E0A5A0A51BDB2B8DC39F825B4E4BAA4B4DBDA42EA4A341E01B2605578D04BAB30A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lizenzvertrag",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ich habe den Lizenzvertrag gelesen und stimme ihm zu",.. //{0} - Company name.. THANK_YOU: "Vielen Dank f.r Ihren Download von {0}",.. INSTALL: "Installieren",.. CANCEL: "Abbrechen",.. RETRY: "Erneut versuchen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ist Ihr pers.nlicher Sicherheitsberater f.r das Internet.",.. PROGRESS_SUBTITLE: "Installation l.uft...",.. COMPLETE_TITLE: "Sehr gut. Ihr pers.nlicher Online-Berater wurde installiert.",.. COMPLETE_SUBTITLE: "Fertig",.. COMPLETE_LAUNCH: "Browser .ffnen",.. ERROR_OS_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Betriebssystem nicht den Mindestsystemanforderungen entspricht. Aktualisieren Sie es, und versuchen Sie es erneut.",.. ERROR_BROWSER_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Browser nicht den Mindestsystemanforderungen entspr

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3909
                                                                                                                                                                                                                                      Entropy (8bit):4.959626330234211
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:3x8Ii5SdfTMcIa1KgRfSVl7C8mrs/0wzEjMBGrmRUgV:3V3dfTMcv1Kg5Wluc0wzMy2mRUgV
                                                                                                                                                                                                                                      MD5:35188F8291A1F6C53385FEB578A4DCE8
                                                                                                                                                                                                                                      SHA1:1C3617998E95B54DA45D2A568B2CA898041E7BE1
                                                                                                                                                                                                                                      SHA-256:E48BFD5A8A23739E0442BE5B85232450736349D01E201317DCC35C6D9836997E
                                                                                                                                                                                                                                      SHA-512:028FEA1DBEC413C387484D81B8362B6241882A0026DE85554A20D308730CB82C9996776E6432C1D68D4E36EA6CAA7BC99A0AFB5637EB0475370E7578659F18E9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "........ ...... ......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "....... ... .......... .. ........ ...... ......",.. //{0} - Company name.. THANK_YOU: "............ ... ......... .. {0}",.. INSTALL: "...........",.. CANCEL: ".......",.. RETRY: ".........",.. //{0} - Product name.. PROGRESS_TITLE: ".. {0} ..... . .......... ... ......... ......... ... ........... ......... ............ ... Internet.",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "......! ............. ... ......... ... ........ ... Internet.",.. COMPLETE_SUBTITLE: "..... .......",.. COMPLETE_LAUNCH: "....... ............ ..........",.. ERROR

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2294
                                                                                                                                                                                                                                      Entropy (8bit):5.267826119993783
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3TmE5KPHEAvhhIDX6uSBf15aN+conkQt5SfEZhozWZIMJJZh4mLh6s:33pAphIzqfE+c63ZhozqxJZh5P
                                                                                                                                                                                                                                      MD5:826DA40012B9ED67DEC5628564F13E37
                                                                                                                                                                                                                                      SHA1:7394CF9C5690D48F9B98F7EC2B787AAEAB4343F6
                                                                                                                                                                                                                                      SHA-256:99F7D7328C393F9B9EDE0920965F3450D28EAB68FC84A5E9C85D96BE066D54FE
                                                                                                                                                                                                                                      SHA-512:14A2F8C1ED483780B9CE2DD42728EE540AF3C3E6DD3CFAC9D270E4EB40E1DE5833FE0CF5418D39444A490320D8B04BB0EE72C6F4C764B6BA69021C340829EBEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "License Agreement",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "I have read and agree to the License Agreement",.. //{0} - Company name.. THANK_YOU: "Thank you for choosing {0}",.. INSTALL: "Install",.. CANCEL: "Cancel",.. RETRY: "Try Again",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is your personal safety advisor wherever you go online.",.. PROGRESS_SUBTITLE: "Installing...",.. COMPLETE_TITLE: "Great! We've installed your personal online advisor.",.. COMPLETE_SUBTITLE: "Ready to go",.. COMPLETE_LAUNCH: "Open my browser",.. ERROR_OS_REQUIREMENTS: "Your installation cannot continue because your operating system does not meet the minimum system requirements. Please update it and try again.",.. ERROR_BROWSER_REQUIREMENTS: "Your installation cannot continue because your browser does not meet our minimum system requirements. Please update your browser and try again.",.. ERROR_VERSION: "You already hav

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2408
                                                                                                                                                                                                                                      Entropy (8bit):5.23107103371674
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3Cx17WnI7bV3mE7NISJvjOfQ2e5loiPLtjCE6zs/vmzuIoJoPl3/fA:3CxB1F337NISUfa5loiRv6AnmzuLJoPm
                                                                                                                                                                                                                                      MD5:38170910D2B12FC46D35AAC5B865B4C8
                                                                                                                                                                                                                                      SHA1:B428448B240FC63E756E4A5AF50B70F603027C5F
                                                                                                                                                                                                                                      SHA-256:13D67914092413B6101892F3749A2026FB02812226C7E26230B642EDC14F51DE
                                                                                                                                                                                                                                      SHA-512:BD1511DC9161290E17B3625FC75307E2A37CF7037B04ACF9E23B369FE17A0D6EDECD296D60B6F630DA6BE23ADAEC5379884AA7E57A5B7FE35B33E0FCEBCE6D4B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por haber elegido {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n online.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: ".Genial! Hemos instalado su asesor online personal.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice el navegador y

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2426
                                                                                                                                                                                                                                      Entropy (8bit):5.244880336393164
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3Cx17JnI7bVAEc+JJNISJvjOfQ2e5loiPLtjCE6aH/vmzuIoJoPl33glUT:3CxBOFNc2JNISUfa5loiRv6aHnmzuLJW
                                                                                                                                                                                                                                      MD5:565FA3F4435A6879B7192319001F21C7
                                                                                                                                                                                                                                      SHA1:1B79C7DFB1A35D9575C548D3350A7522DAEB4EC6
                                                                                                                                                                                                                                      SHA-256:DE331BFE0312F4A0B5DB40AAB8FADC385CE051D43ED60A470CF9B35954C88308
                                                                                                                                                                                                                                      SHA-512:5C380CEA1FA5B70588DF5D08E87B4C4B95D524B08E71B31EC7BB2829ABB148FE7680BA698663EF8FFE10E1E5B7967F44EE7D2749C8C1612CC1B3F4CF69CC5069
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por elegir {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n en l.nea.",.. PROGRESS_SUBTITLE: "Instalando.",.. COMPLETE_TITLE: ".Excelente! Hemos instalado su asesor de seguridad personal en l.nea.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2464
                                                                                                                                                                                                                                      Entropy (8bit):5.32809919710467
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:346H/PfLPVPEajg9IYxDT8i2LKxp8iElfSAnTi7D3/btDM57L6Tsq3sGozCAJIvb:3txsGUIYxHvxZIfLnT03DC5vlqc1zC6E
                                                                                                                                                                                                                                      MD5:FC172CAEBECD16B5ACA6A31132898868
                                                                                                                                                                                                                                      SHA1:6959FDE12BDB2B64DDE80572548E0A2C181BB201
                                                                                                                                                                                                                                      SHA-256:F9874A51A7DDAACACEC7A53221D9FE1495C67C11B9B60C731C782597A2040285
                                                                                                                                                                                                                                      SHA-512:2947B934B0F75A08750077981742569F04EEB5DB691F42941AD5A517E1EB27C414C319FF62A2FF05B9FEAB93A2963C77B85D0D04533E6156ED41A2281F9DC8BF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "K.ytt.oikeussopimus",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Olen lukenut k.ytt.oikeussopimuksen ja hyv.ksyn sen.",.. //{0} - Company name.. THANK_YOU: "Kiitos, ett. valintasi on {0}",.. INSTALL: "Asenna",.. CANCEL: "Peruuta",.. RETRY: "Yrit. uudelleen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} on henkil.kohtainen turvallisuusavustajasi, kun k.yt.t verkkoa.",.. PROGRESS_SUBTITLE: "Asennetaan.",.. COMPLETE_TITLE: "Hienoa! Henkil.kohtainen verkkoavustajasi on asennettu.",.. COMPLETE_SUBTITLE: "Valmis k.ytett.v.ksi",.. COMPLETE_LAUNCH: "K.ynnist. selain",.. ERROR_OS_REQUIREMENTS: "Asennusta ei voi jatkaa, koska k.ytt.j.rjestelm.si ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. k.ytt.j.rjestelm. ja yrit. uudelleen.",.. ERROR_BROWSER_REQUIREMENTS: "Asennusta ei voi jatkaa, koska selaimesi ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. selain ja yr

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2783
                                                                                                                                                                                                                                      Entropy (8bit):5.254933022383819
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3XYTQm7+XFcEqEmfX8IEKOIgkPgPjynfHzz8zq5n3k+HGjKm9bQErQz4YxkLzEt+:3XFVZxmfX8IX/gwfHz4zotKtrgxwzUhe
                                                                                                                                                                                                                                      MD5:64816D7F2A328E11F770E32F7A50484E
                                                                                                                                                                                                                                      SHA1:383930CB275A9AF6DB080DA6B09842B76FF440F4
                                                                                                                                                                                                                                      SHA-256:DBCD2341621B62D12ACF04701BFC42F1D4EB646439F9D7D242605CC036AF51FC
                                                                                                                                                                                                                                      SHA-512:2BB37692C8381066FA2F0CEE734CD58207DE8FEE0E0EB68947A286EAE74D403D516981A057F1068E83606EC1BDEB671AB7A3639FC8238D1A7B14E918899413EF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrat de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et approuv. le contrat de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installation",.. CANCEL: "Annuler",.. RETRY: "R.essayez",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. lorsque vous naviguez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien! Nous avons install. votre conseiller personnel en mati.re de s.curit. en ligne.",.. COMPLETE_SUBTITLE: "Pr.t au lancement",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Il est impossible de poursuivre l'installation, car votre syst.me d'exploitation ne satisfait pas . la configuration minimale requise. Veuillez le mettre . jour et essayer de nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Il est impossible de poursuivre l'installatio

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2672
                                                                                                                                                                                                                                      Entropy (8bit):5.272326001804358
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3skZTOo+8CFRhEq5wkQ8I5yb7npX3uyb6FpYE3Kfjvz75B8g5DVdNABqbkyETa4h:3skOdRqM/Q8I5W7duW64sKfjvz1mmzXg
                                                                                                                                                                                                                                      MD5:D88A9443942F187F9A59D334F5B1A765
                                                                                                                                                                                                                                      SHA1:647DE934D2426375D3E311E5FADDD97C4D093FD1
                                                                                                                                                                                                                                      SHA-256:975A1B714BC14BED3636A6756C581898DEC03AF3B0A6D996D777B03B1BEEF88F
                                                                                                                                                                                                                                      SHA-512:8E198C8EDFA388CA54970FEBB395F8CCAA83BF10EEA49B3D21027F36B7E96EF0F8452255F090C06DD8209E1648BC0502B2A44740971CA83E12651EEC42DF6343
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Accord de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et j'accepte l'accord de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installer",.. CANCEL: "Annuler",.. RETRY: "R.essayer",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. o. que vous vous trouviez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien. Nous avons install. votre conseiller en ligne personnel.",.. COMPLETE_SUBTITLE: "Pr.t",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre syst.me d'exploitation ne correspond pas . la configuration syst.me minimale requise. Mettez-le . jour et essayez . nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre navigateur ne correspond pas .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2472
                                                                                                                                                                                                                                      Entropy (8bit):5.35142214273438
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:353pQsd9EjihC7lRIZYwfChm7gg7oG9RMGbm6O6IgXvzU6MIIJC52jd+yVfr:3bdYjQgrIBfvMg7JruJgfzU6MIGC52xP
                                                                                                                                                                                                                                      MD5:F5A4C7E4887A85968564F17531A199F6
                                                                                                                                                                                                                                      SHA1:14AFA8A3089E9FDF56104ECD055CAA301DCCE892
                                                                                                                                                                                                                                      SHA-256:CA1DA36A8E26CC5C4283E1B0FCFC4DE98A79A5FE9C847F52E74C70FC2982BEC6
                                                                                                                                                                                                                                      SHA-512:B921A83071EBEBBD71234B3015AD01708CF8B6530721707CDDB8AB8572EFC3FD6E7DCA46A653F0AE63B076DEB305450FCAD1477F54D1C0FFC21896121FD7978B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licencni ugovor",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i prihva.am Licencni ugovor",.. //{0} - Company name.. THANK_YOU: "Zahvaljujemo .to ste odabrali tvrtku {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Odustani",.. RETRY: "Poku.ajte ponovno",.. //{0} - Product name.. PROGRESS_TITLE: "{0} va. je osobni savjetnik o sigurnosti neovisno o tome gdje se nalazite na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Sjajno! Instalirali smo va.eg osobnog savjetnika na mre.i.",.. COMPLETE_SUBTITLE: "Spremno za rad",.. COMPLETE_LAUNCH: "Otvori moj preglednik",.. ERROR_OS_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. operacijski sustav ne ispunjava minimalne preduvjete sustava. A.urirajte ga i poku.ajte ponovno.",.. ERROR_BROWSER_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. preglednik ne ispunjava minimalne preduvjete sustava. A.urirajte p

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2712
                                                                                                                                                                                                                                      Entropy (8bit):5.522969234769431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3tLzMpIEAIQIsOGfHgoZciWDBMK+Q4L8NPpTWzn9jIaLe7eZm:3dy1AIQIafrCiMBMK48NPpazndBe7eZm
                                                                                                                                                                                                                                      MD5:EAF7ABF3740F41E8D05C8F0788D794F2
                                                                                                                                                                                                                                      SHA1:5C7B54D31137ADB73E49F7C8976A4B20A65AF544
                                                                                                                                                                                                                                      SHA-256:D744D6F90475CF2C7CC66B8B9DBC5049DB3E4720086EB672A812F3F40BA6395D
                                                                                                                                                                                                                                      SHA-512:0EF015D69A409BA85E7F0C69C3615C73DBFEE4A4185EBD88D369890CD826E7F5472DFCFB5F7C90318C092D0B3FF5B14022B0052B1C4A0EFAB63E04636989DF8E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licencmeg.llapod.s",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Elolvastam .s elfogadom a Licencmeg.llapod.st",.. //{0} - Company name.. THANK_YOU: "K.sz.nj.k, hogy a(z) {0} mellett d.nt.tt",.. INSTALL: "Telep.t.s",.. CANCEL: "M.gse",.. RETRY: "Pr.b.lkozzon .jra",.. //{0} - Product name.. PROGRESS_TITLE: "{0} az .n szem.lyi tan.csad.ja, aki mindenhova .nnel tart az interneten.",.. PROGRESS_SUBTITLE: "Telep.t.s...",.. COMPLETE_TITLE: "Rendben. Szem.lyi tan.csad.j.nak telep.t.se sikeresen befejez.d.tt.",.. COMPLETE_SUBTITLE: "Haszn.latra k.sz",.. COMPLETE_LAUNCH: "B.ng.sz. megnyit.sa",.. ERROR_OS_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel az oper.ci.s rendszer nem felel meg a minim.lis rendszerk.vetelm.nyeknek. Hajtsa v.gre a friss.t.st, majd pr.b.lkozzon .jra.",.. ERROR_BROWSER_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel a b.ng.sz. n

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2394
                                                                                                                                                                                                                                      Entropy (8bit):5.2754976493804335
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3UWhiWDdQoGoIt/EqRw0+KIbpxLWpuKf/XG+E6lGN5/5wZplY8547w6ZzE+IR1uZ:3dqrt820KInL9KfO+Evf5y0jZzNG1u0w
                                                                                                                                                                                                                                      MD5:B55990CF0154A46C757DBB34AAD702E6
                                                                                                                                                                                                                                      SHA1:EDF6DF5FE52A8FDFBE9DB8A5CC71E258E3DE85D3
                                                                                                                                                                                                                                      SHA-256:0C12592901FE41369B4E112E6E8E758EA477F111C0C32557C7E0036275C1E2EA
                                                                                                                                                                                                                                      SHA-512:7B97219B654E9D6E81F9477317A043420BCCA2E3B5424D408783ED9013AE8FF8B0A7A6773C9E794AE75086492234AA460993684D573538F9B91B8A253E8706B1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contratto di licenza",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ho letto e accetto il contratto di licenza",.. //{0} - Company name.. THANK_YOU: "Grazie per aver scelto {0}",.. INSTALL: "Installa",.. CANCEL: "Annulla",.. RETRY: "Riprova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . il tuo consulente sulla sicurezza personale quando sei online.",.. PROGRESS_SUBTITLE: "Installazione in corso...",.. COMPLETE_TITLE: "Perfetto! Abbiamo installato il tuo consulente sulla sicurezza online personale.",.. COMPLETE_SUBTITLE: "Pronto all'uso",.. COMPLETE_LAUNCH: "Apri browser",.. ERROR_OS_REQUIREMENTS: "L'installazione non pu. proseguire poich. il sistema operativo non soddisfa i requisiti minimi di sistema. Aggiornalo e riprova.",.. ERROR_BROWSER_REQUIREMENTS: "L'installazione non pu. proseguire poich. il browser non soddisfa i requisiti minimi di sistema. Aggiorna il browser e riprova.",.. ERROR_VE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3042
                                                                                                                                                                                                                                      Entropy (8bit):5.662814560469893
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3wGDxx6nDARECJhlFV0Inu4+nc4sf79U6MwMiWBmxjGlmDr2hvuskl2KzYzKIKv4:3wwT6c62zFV0InOnKf726pEm2mqvSZz4
                                                                                                                                                                                                                                      MD5:12CB76F3C6DA72199F124488CEB0C739
                                                                                                                                                                                                                                      SHA1:BCDC554FE579D2CE9B887D28F8CBD70D12AF1110
                                                                                                                                                                                                                                      SHA-256:DBF88A45B56D90B823AE70F42AB6C523B12AC98A85FDD7097FE7D45D1DC2F37A
                                                                                                                                                                                                                                      SHA-512:AD0067E9040F0E8D7DB7DCD77901F29866E49B07243F42961C96FCF173D7725663445F8E0C6DF298D4F2C8C0ACE00A0E56F8443D5B162C92CB222A7A5C1A7D00
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "......................",.. //{0} - Company name.. THANK_YOU: "{0} ...................",.. INSTALL: "......",.. CANCEL: ".....",.. RETRY: "...",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................................",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "....... ........... ...................",.. COMPLETE_SUBTITLE: "........",.. COMPLETE_LAUNCH: "........",.. ERROR_OS_REQUIREMENTS: "....................... ....................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2602
                                                                                                                                                                                                                                      Entropy (8bit):5.836230399985154
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3SvoaWNG4EaECInqhq5fqYb26FugHU98U5MmilHU5n9HU5MKzpNKI6iUIX2z0O7s:3S84Fa9Inqhq5fLjFF0WU5Mmi5U5nRUr
                                                                                                                                                                                                                                      MD5:D23965E41B4539E4CC497222F6684919
                                                                                                                                                                                                                                      SHA1:3E44F89D44431C401194CE7177B318C75178AC2A
                                                                                                                                                                                                                                      SHA-256:DC67EFA7C9947B1D3E0420834F18C897AE03167CEB0C66C4EAF00DAC9372F0D1
                                                                                                                                                                                                                                      SHA-512:B37045ABF2E217F6B3F280A887C01FCDF5C87D41DF73FAAFF9B8C48C93A257EF6D291199C4E4E4C7F0D44CFE04B83D47F9432A651EA98C546F1A6F47AA61C23E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "... ..",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "... ... .. .. ......",.. //{0} - Company name.. THANK_YOU: "{0} ... ... ... ......",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: ".. ..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}. .. .... .. .. .. ... .......",.. PROGRESS_SUBTITLE: ".. ....",.. COMPLETE_TITLE: "....! .. ... .... .......",.. COMPLETE_SUBTITLE: "... ... .....",.. COMPLETE_LAUNCH: ". .... ..",.. ERROR_OS_REQUIREMENTS: "..... .. ... ... .... .... ... ... . ..... ..... ...... .. .......",.. ERROR_BROWSER_REQUIREMENTS: "..... .. ... ... .... ...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2387
                                                                                                                                                                                                                                      Entropy (8bit):5.326526728309049
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3795VOotrOcpVDEY4IRw0/9IcBVFDqFafj8Kae0QJhGd/i+GFPxWj0ssjzr9cIUq:37R7pVgzCw0VIaVFuFaf3l5QAfjzrKZq
                                                                                                                                                                                                                                      MD5:FE4AD063455C03EE27B5F750D61E95B9
                                                                                                                                                                                                                                      SHA1:7DEACAC98FD52F7502861449F357665F54579C5F
                                                                                                                                                                                                                                      SHA-256:FB963C4BB34D1A5EB6B9C7815653467905AC018B37A3D7A0A9C025340A1715E7
                                                                                                                                                                                                                                      SHA-512:F97A4ACD8AF732661E6E978A6E7FC8D6D8DBFFD09AF92F9C72198140CA62B32374BD8ECE49FDBBD10D32BB66366BD8A60226D5FC1E7883528B136C2A7B14136F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lisensavtale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har lest og godtar lisensavtalen",.. //{0} - Company name.. THANK_YOU: "Takk for at du har valgt {0}",.. INSTALL: "Installer",.. CANCEL: "Avbryt",.. RETRY: "Pr.v p. nytt",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhetsr.dgiver n.r du er p. Internett.",.. PROGRESS_SUBTITLE: "Installerer..",.. COMPLETE_TITLE: "Flott! Vi har installert din personlige Internett-r.dgiver.",.. COMPLETE_SUBTITLE: "Klar til . sette i gang",.. COMPLETE_LAUNCH: ".pne nettleseren min",.. ERROR_OS_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi operativsystemet ikke oppfyller minimum systemkrav. Oppdater det og pr.v p. nytt.",.. ERROR_BROWSER_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi nettleseren ikke oppfyller minimum systemkrav. Oppdater nettleseren og pr.v p. nytt.",.. ERROR_VERSION: "Det ser ut til at d

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2494
                                                                                                                                                                                                                                      Entropy (8bit):5.226284665023455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3HZ/GOx7kopP4IeGyEY/n40AcTI3k7JWxXDk7JdIXrf24+0nB7v7lRbY2ID6XVUt:3Hb+nAqjAkI3WcxXDWPIXrfwkBD9i6Xe
                                                                                                                                                                                                                                      MD5:BF5949895F41B4F6D08E49698DC4E9D3
                                                                                                                                                                                                                                      SHA1:066B405A8A2868483F97113B0B60B1AC676E842F
                                                                                                                                                                                                                                      SHA-256:8C555EB343D4C728ACE8BCBEB5A352C07B3E00C83147D169EF6B9DFD9CD23040
                                                                                                                                                                                                                                      SHA-512:61C40CD80955E7CA5D103276F62B6ECBAC7C60A5078B7877D7D1033F12D55131AA9A257A829CAED139FECD01E2B01CB86075C5206790AC2C58CACD22F99E2864
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licentieovereenkomst",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ik heb de Licentieovereenkomst gelezen en ga ermee akkoord",.. //{0} - Company name.. THANK_YOU: "Hartelijk dank dat u hebt gekozen voor {0}",.. INSTALL: "Installeren",.. CANCEL: "Annuleren",.. RETRY: "Opnieuw proberen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is uw persoonlijke veiligheidsadviseur waar u ook online gaat.",.. PROGRESS_SUBTITLE: "Installeren...",.. COMPLETE_TITLE: "Fantastisch! We hebben uw persoonlijke online adviseur ge.nstalleerd.",.. COMPLETE_SUBTITLE: "U bent klaar om te beginnen",.. COMPLETE_LAUNCH: "Open mijn browser",.. ERROR_OS_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw besturingssysteem niet voldoet aan de minimale systeemvereisten. Werk het bij en probeer het opnieuw.",.. ERROR_BROWSER_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw browser niet voldoet aan onze mi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2589
                                                                                                                                                                                                                                      Entropy (8bit):5.548786014317691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:31Mp2pQa6EiVoNIGz2wizAsferOrW6IjW1FRHZZ8z0h0hXigYDzgzI77cclvNd:3r+0iVQI5wJsf8GW6IjqfHZchygYDzg8
                                                                                                                                                                                                                                      MD5:6A16DAB3523E7AF305B26FBA217E860E
                                                                                                                                                                                                                                      SHA1:29517855BEB19D32519143173BB22D135F6B98FB
                                                                                                                                                                                                                                      SHA-256:30F0DBE88BE90649F4FAE6DCB106F4DE959C820F2DB1C5BE21AC35EABDA75175
                                                                                                                                                                                                                                      SHA-512:2199F9FC519A9F8DC6D721A2F40611750AF8360C9AD28C407234A07E208674F37F676D4741F2C1836D5CBEF7AD3D5BE11031B3BDE37B03DC0D0F6055DB8DD3E7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Umowa licencyjna",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Potwierdzam znajomo.. warunk.w umowy licencyjnej i akceptuj. je.",.. //{0} - Company name.. THANK_YOU: "Dzi.kujemy za wybranie firmy {0}",.. INSTALL: "Zainstaluj",.. CANCEL: "Anuluj",.. RETRY: "Spr.buj ponownie",.. //{0} - Product name.. PROGRESS_TITLE: "Program {0} to Tw.j osobisty doradca bezpiecze.stwa online.",.. PROGRESS_SUBTITLE: "Instalowanie...",.. COMPLETE_TITLE: ".wietnie. Tw.j osobisty doradca bezpiecze.stwa online zosta. zainstalowany.",.. COMPLETE_SUBTITLE: "Gotowe",.. COMPLETE_LAUNCH: "Otw.rz przegl.dark.",.. ERROR_OS_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. system operacyjny nie spe.nia minimalnych wymaga. systemowych. Zaktualizuj system i spr.buj ponownie.",.. ERROR_BROWSER_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. przegl.darka nie spe.nia minimalnych wymaga. systemow

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2414
                                                                                                                                                                                                                                      Entropy (8bit):5.2988087990745925
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:30pLnIOYwREtajaI1BKraNfZwe6GcIe+LLCEHxg5aozFVI1rJqPDJ:3VI68jaIjNf9F3Hwbz3aJqP1
                                                                                                                                                                                                                                      MD5:849C3799B0C8971570831E4F711B3346
                                                                                                                                                                                                                                      SHA1:CDBF413BCE5DAACBFE84E373A1540DC5B011A106
                                                                                                                                                                                                                                      SHA-256:87D05712716ECD8E6105FFE67D6F3CBAE37F587C20F5969BDC4CB272659A06A7
                                                                                                                                                                                                                                      SHA-512:29D895F2F8246E6EB6C843ABABF524182E880724E192CA10C24548ECB26429076D21F3C816C22480265F7792E9595C03E554AEE6F075AAF7E12AEA6DF73243F8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar novamente",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . o seu assessor de seguran.a personalizado onde quer que voc. navegue.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: "Excelente! O seu assessor online personalizado foi instalado.",.. COMPLETE_SUBTITLE: "Pronto para come.ar",.. COMPLETE_LAUNCH: "Abrir meu navegador",.. ERROR_OS_REQUIREMENTS: "A instala..o n.o pode continuar. Seu sistema operacional n.o atende aos requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "A instala..o n.o pode continuar. Seu navegador n.o atende aos requisitos m.nimos do sistema. Atualize o navegador e tente novamente.",.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2407
                                                                                                                                                                                                                                      Entropy (8bit):5.2886589358625
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:30pgnIuAGE6y4IvQdKVvNfwSe6GfIhq+L1w9V5eEHp4aUzFy5JI1rJqPlE08g:3uhX6y4IvQdUlfKF3PHHp4DziaJqPlE0
                                                                                                                                                                                                                                      MD5:398278D642159E254CC2E2E93E1179A9
                                                                                                                                                                                                                                      SHA1:CA3D1F07A7BEA2F5543C06850D4D2BA8933DCF96
                                                                                                                                                                                                                                      SHA-256:F002B5EB3EF95D1885943AE117C0126B7C0A1AE8717FBC6CEC6E71738A6B11FB
                                                                                                                                                                                                                                      SHA-512:D51964FC93B16B112094E3C796096B821B5D5392D7E26BFD2527279290D1D84472AA32BB34533D14C5E89570BA257DFB82DB78C0170552A24C0222FB54D818B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher a {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar Novamente",.. //{0} - Product name.. PROGRESS_TITLE: "O {0} . o seu assistente de seguran.a pessoal quando navega online.",.. PROGRESS_SUBTITLE: "A instalar...",.. COMPLETE_TITLE: ".timo! Instal.mos o seu assistente pessoal online.",.. COMPLETE_SUBTITLE: "Pronto a utilizar",.. COMPLETE_LAUNCH: "Abrir o meu browser",.. ERROR_OS_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu sistema operativo n.o cumpre os requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu browser n.o cumpre os nossos requisitos m.nimos do sistema. Atualize o seu browser e ten

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3518
                                                                                                                                                                                                                                      Entropy (8bit):4.982461398239248
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:3UVaCuKa+4I4QashQrsyfb6yJBvr8/zsPoSBRr:3UVMKaN91jb6yg/z2oSBRr
                                                                                                                                                                                                                                      MD5:0D30587749530D65A88D73D59CCD1E5A
                                                                                                                                                                                                                                      SHA1:9EE32D2B5EF0CEFE8D4FDB3EC212D8543BC3BE37
                                                                                                                                                                                                                                      SHA-256:4D49FCE39B3D237AD4C06CDDEEB3A18E1E24AEAD20F1B29E130D2C6A0F9E6664
                                                                                                                                                                                                                                      SHA-512:FD37F80A531EC3F24FD904EE1C95AFC2E6BC07D3FBC10C450AF5E768FCC61C2ED7EE9B6D13F8953A33BE2C88E841EB2389C7E8E741A198E4BC46F4E605B8CC86
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "............ ..........",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: ".... ......... . ....... ....... ............. ..........",.. //{0} - Company name.. THANK_YOU: ".......... ... .. ..... {0}",.. INSTALL: "..........",.. CANCEL: "......",.. RETRY: "......... .......",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . ... ...... ........ .. ........ ............ . ..........",.. PROGRESS_SUBTITLE: "............",.. COMPLETE_TITLE: ".......! ...... ........ .. ........ ............ ...........",.. COMPLETE_SUBTITLE: "... ......",.. COMPLETE_LAUNCH: "....... .......",.. ERROR_OS_REQUIREMENTS: "......... .......... ..........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2503
                                                                                                                                                                                                                                      Entropy (8bit):5.602740783934961
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3KUCaDVRZIB0HHEFYdVXIBJSoAcJSjAKf+EPnAn9kwk8Aw7JmERmPezlU8IPJicX:3K94Bu0HkFoXImoArjAKf+EPnAnewk8c
                                                                                                                                                                                                                                      MD5:C54E3998BC66508564C96E1293B8DF95
                                                                                                                                                                                                                                      SHA1:99EEF5395A784B94F8AF841165A5AC88AFC0F7B5
                                                                                                                                                                                                                                      SHA-256:3AD5819098C6B95BBA65144A4FFDE14FF3DB1BEE95934B7F56C51EDCEF1E0E81
                                                                                                                                                                                                                                      SHA-512:5888B2C5E34D39A9C876DB7F7C53B0059A5A9D9CD15F8F678601049940BFA0467B490A926812AC92EE28EA74425070D2A5A45A9C4472316FA334202FB3B7EC85
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. zmluva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pre..tal(-a) som si licen.n. zmluvu a s.hlas.m s .ou",.. //{0} - Company name.. THANK_YOU: ".akujeme, .e ste si zvolili {0}",.. INSTALL: "In.talova.",.. CANCEL: "Zru.i.",.. RETRY: "Sk.si. znova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je v.. osobn. bezpe.nostn. poradca pri va.ich potulk.ch internetom.",.. PROGRESS_SUBTITLE: "In.taluje sa...",.. COMPLETE_TITLE: "Skvel.! Osobn. poradca online je nain.talovan..",.. COMPLETE_SUBTITLE: "Hotovo",.. COMPLETE_LAUNCH: "Otvori. prehliada.",.. ERROR_OS_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e opera.n. syst.m nesp..a minim.lne syst.mov. po.iadavky. Aktualizujte ho a sk.ste to znova.",.. ERROR_BROWSER_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e prehliada. nesp..a minim.lne syst.mov. po.iadavky. Aktuali

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2366
                                                                                                                                                                                                                                      Entropy (8bit):5.3706965599670475
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3iWxpQUZMEji4CqYBIInphvGEfD/cTdRCcegQ6DRjRSGnzUwMIIJLQ5omWpB5gj:3ikbTjBrGIAH7fD/cpUdiRcGnzUwMIAe
                                                                                                                                                                                                                                      MD5:9A4E59CB63A401DD5E47D83064EC040C
                                                                                                                                                                                                                                      SHA1:5668CFE91E01BE9871C15E878D6F09338FFAADC5
                                                                                                                                                                                                                                      SHA-256:C0CCAA5684770250AB97DACFE88BF4C5FCBAFDCCBB8444208B3C659B10C09A51
                                                                                                                                                                                                                                      SHA-512:D49CF85D1CEB390C6BF955FD81371EBC95A642F2119A25F6A70B8B543BEBE01C30E3A46823926617041AD34C8191385B5583BC9AAB2D64BCB5915F2166B40768
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Ugovor o licenciranju",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i saglasan/na sam sa ugovorom o licenciranju",.. //{0} - Company name.. THANK_YOU: "Hvala vam .to ste odabrali {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Otka.i",.. RETRY: "Poku.ajte ponovo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je va. li.ni savetnik kada god ste na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Odli.no! Instalirali smo va. li.ni savetnik na mre.i.",.. COMPLETE_SUBTITLE: "Spremno je",.. COMPLETE_LAUNCH: "Otvori pregleda.",.. ERROR_OS_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to sistem ne ispunjava minimalne zahteve. A.urirajte i poku.ajte ponovo.",.. ERROR_BROWSER_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to pregleda. ne ispunjava minimalne zahteve sistema. A.urirajte pregleda. i poku.ajte ponovo.",.. ERROR_VERSION: "Ve. imat

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2265
                                                                                                                                                                                                                                      Entropy (8bit):5.377389451873531
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3Ud6ODtNYPmAEYSwxFjIcvFLcFafDyMC/4ekY3+rh7sK0MCoO0oz/wrIfGEzjZU1:30DNcnIiFgFaf+imYJOvz4rCR2h
                                                                                                                                                                                                                                      MD5:3D0EF828C3BD895D981998C4E58C7B95
                                                                                                                                                                                                                                      SHA1:AF4217D3F6A58EF0E813860AF905DF4F7A4DE35D
                                                                                                                                                                                                                                      SHA-256:266FB97C87C109B9FB7FF8099DBA0BBE00C52F7E4106D0138E6922FED4F01EDF
                                                                                                                                                                                                                                      SHA-512:9B847A3F5385601767090338CC50F8960FABA50DDAF66A71ACE6C3E9B057FDA6C5C8C55323198BA91421C902D6BD7BD496A231B4556A9533B1FD00A5697D2329
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licensavtal",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jag har l.st och godk.nner licensavtalet",.. //{0} - Company name.. THANK_YOU: "Tack f.r att du valde {0}",.. INSTALL: "Installera",.. CANCEL: "Avbryt",.. RETRY: "F.rs.k igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} .r din personliga s.kerhetsr.dgivare online.",.. PROGRESS_SUBTITLE: "Installerar...",.. COMPLETE_TITLE: "Perfekt. Vi har installerat din personliga r.dgivare online.",.. COMPLETE_SUBTITLE: "Klar att anv.nda",.. COMPLETE_LAUNCH: ".ppna min webbl.sare",.. ERROR_OS_REQUIREMENTS: "Installationen avbr.ts eftersom ditt operativsystem inte uppfyller systemkraven. Uppdatera och f.rs.k igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen avbr.ts eftersom din webbl.sare inte uppfyller systemkraven. Uppdatera webbl.saren och f.rs.k igen.",.. ERROR_VERSION: "En nyare version av programvaran .r redan installerad p.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2564
                                                                                                                                                                                                                                      Entropy (8bit):5.498731406448142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3DdmZCox80uGgE+dh70Ij+AUJBI+AxuzfvF57ybqEmpwAY3LgMseo44oU+Wz7kjV:3kwoK0v+dhYIjMs5uzf7g5ue5Lgz6CXi
                                                                                                                                                                                                                                      MD5:026E4B5E29E4BBB3159ABEAF2B8E4F45
                                                                                                                                                                                                                                      SHA1:7FB235431596C61420DFAE2415BD87DA22A096C9
                                                                                                                                                                                                                                      SHA-256:47FB7C0C921E2948CA58775F9FA12177A33B9C8CBF4531369CABFBA73382983D
                                                                                                                                                                                                                                      SHA-512:E55D2815279E0CB933525FAC56261CC8F07089D3FD49A797EDF4A51F2A31BBB29CAAFFB7D9B1DF95CAC2E7A3F255B75F4D98D314DE9F755422203442B008337F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lisans S.zle.mesi",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Lisans S.zle.mesi'ni okudum ve kabul ediyorum",.. //{0} - Company name.. THANK_YOU: "{0}'yi se.ti.iniz i.in te.ekk.rler",.. INSTALL: "Y.kle",.. CANCEL: ".ptal",.. RETRY: "Yeniden Dene",.. //{0} - Product name.. PROGRESS_TITLE: "{0} Internet'te her an yan.n.zda olan ki.isel g.venlik dan..man.n.zd.r.",.. PROGRESS_SUBTITLE: "Y.kleniyor...",.. COMPLETE_TITLE: "Harika! Ki.isel .evrimi.i dan..man.n.z. y.kledik.",.. COMPLETE_SUBTITLE: "Kullan.ma haz.r",.. COMPLETE_LAUNCH: "Taray.c.m. a.",.. ERROR_OS_REQUIREMENTS: "..letim sisteminiz minimum sistem gereksinimlerini kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen g.ncelleyin ve tekrar deneyin.",.. ERROR_BROWSER_REQUIREMENTS: "Taray.c.n.z minimum sistem gereksinimlerimizi kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen t

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2044
                                                                                                                                                                                                                                      Entropy (8bit):6.285030103087084
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3oeWvFbBQLSECfPnIuDfC9lI2S1lZmYDbVzzIKg+bl736:3obrYzCnnIuDfC9lIZmuRzzY+Y
                                                                                                                                                                                                                                      MD5:0B59E12E50A67AD6F2DDD0E3F66AFECA
                                                                                                                                                                                                                                      SHA1:D8FEBC294B43FB2D8E64342BD4237B77D7CCD2C6
                                                                                                                                                                                                                                      SHA-256:ADEF8EB008A44767EFFAC76D89EB8E25F2A5FDBE89D015489377AE4170BFD893
                                                                                                                                                                                                                                      SHA-512:A9C34AE2CBD7B6AD7FE5EFCAFBF9BB7D94D524C402635DFE4D2FA94D0591371927B7F6A719C75C56D90202FD5992CE8D7932B0AFD0E575A235EF0D6A09A74EE3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "...........",.. //{0} - Company name.. THANK_YOU: ".....{0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}.................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: "...! ............",.. COMPLETE_SUBTITLE: "....",.. COMPLETE_LAUNCH: ".......",.. ERROR_OS_REQUIREMENTS: "....................... .........",.. ERROR_BROWSER_REQUIREMENTS: "...................... ..........",.. ERROR_VERSION: "...................",.. ERROR_FAIL: ".......... ....",.. ERROR_DU

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-install-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2196
                                                                                                                                                                                                                                      Entropy (8bit):6.289430294079431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3/svnWuIBR1EwNsIb5w6fIPlBZWe2jeemIuzlJIeqwYkZ0:3/Cw4wmIZfIPlBcaeJuzXjqwYt
                                                                                                                                                                                                                                      MD5:C900225095802764F8679D8A02F02AB5
                                                                                                                                                                                                                                      SHA1:4D9C399F5EB401D47C09690F9249FDFD51F61411
                                                                                                                                                                                                                                      SHA-256:08ED61685723AF77BED3313C0AB99630DAE45433A56299A616C964FE6962CF7E
                                                                                                                                                                                                                                      SHA-512:44D0B72C7E0CCC89F482CDC5899D08F5243C0A701189A149C660F5013CC3B028835819350CA40784DD07D0DA62D53343D2B5868A4D91048F12051561A627A619
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "............",.. //{0} - Company name.. THANK_YOU: "..... {0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "....",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: ".... ..............",.. COMPLETE_SUBTITLE: ".......",.. COMPLETE_LAUNCH: ".....",.. ERROR_OS_REQUIREMENTS: "......................... ...........",.. ERROR_BROWSER_REQUIREMENTS: "........................ ................",.. ERROR_VERSION: ".................",.. ERROR_FAIL: ".

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):716
                                                                                                                                                                                                                                      Entropy (8bit):5.607011971536562
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfx6v9LuO4biqra6fMocbkLwT5zxjAHo8+9wuRTouifdRnMA2ndBN:7e9SlNLiaf4v9KO4zG6fMocWIOHo8+9z
                                                                                                                                                                                                                                      MD5:DB5296C11A4E1E23249BFBA40CE350D8
                                                                                                                                                                                                                                      SHA1:85C35D7E41A25D99378F2814874547D87010913F
                                                                                                                                                                                                                                      SHA-256:957F3FFE17A9069F4750CD36096BD997349B53A1952A67D5C1F9FD6B5851EEF2
                                                                                                                                                                                                                                      SHA-512:2D143620D9B37B28EE8F16FEBA6F422C3B4765D7D22976C941609BA283AD6636B4306C7D0E32ADF7595B7B01E0CE86F29FDF452EA6739483ACE1EF206809D77F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81042082CF7CB241A3443F862EE0EECFC8376F5C371C52B28F8DEA321E42D8840BC343D8FABC64A697B28E43C4C1C1BFA5EC01A85A0790B68226181A356241BD++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):728
                                                                                                                                                                                                                                      Entropy (8bit):5.532507354590994
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bikzbkLwT5zxjAHo8wN9wuRTo36ClngbD3CXh:7e9SlNLiafLYFv9KO4dWIOHo8wN9ZROf
                                                                                                                                                                                                                                      MD5:7B935965B36524190BD312B61B43A078
                                                                                                                                                                                                                                      SHA1:52C05B0B95461D1B80543AA032422F91BA6BC72B
                                                                                                                                                                                                                                      SHA-256:3C137CDC865081F47A2F8062CE7B9A3F951F992F236B974582589CD8014A8AAF
                                                                                                                                                                                                                                      SHA-512:2EB7186ACFC3570FA08F39225B4198616547627CFFDAB9D47A58A25FF9FEFD8EC68AEE886622983E404E87C918024888DC39FF1C94B0BA7499ADFF08864C356D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3E820E543090689D74FF63DE8AEDAAE21AE9AB8C7D697AED71A8150A8BAE9004FC3F4C908202E74DEBAF28611421437720982EFDCC7CB2A2BA103910200151AA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):695
                                                                                                                                                                                                                                      Entropy (8bit):5.523104478615486
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+p3ibkLwT5zxjAHo8+N9wuRTo4SruEFqcgZwh:7e9SlNLiafLYFv9KO4pSWIOHo8+N9ZR4
                                                                                                                                                                                                                                      MD5:40ACF45F141BA18E03507C2082902777
                                                                                                                                                                                                                                      SHA1:DAB8213D3E5FFF5838D1CB873E65784B635DE966
                                                                                                                                                                                                                                      SHA-256:CD252FEECF3EE19E9C849783C416E9B782BFD3D681C658FB1464DABFCB839019
                                                                                                                                                                                                                                      SHA-512:189881E6F381CA9F6392C7B9DBD302C119158997C1B6D9E23E9D2EB375FA54FD453DE6515E073A59F6AFC14132571B4C3ECE176DA75B9244A1CD5224D6348A99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//49321CFEBE589D1646EB716015DFBDDDBC5CB3611EF0CC5F0E546054368EF7FFF2A13B5AF228BB9481A39AE66C23F091EECA5628AEFC29837E2DAA08BDF0F01A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):750
                                                                                                                                                                                                                                      Entropy (8bit):5.752183544639771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kft6v9LuO4bi7XKfRWkGmbkLwT5zxjAHo8JP9wuRToElNyhV3eEX2:7e9SlNLiafEv9KO4mXCWkHWIOHo8JP9h
                                                                                                                                                                                                                                      MD5:25AC661CB1DA437FE20306E83B1F0752
                                                                                                                                                                                                                                      SHA1:44E4613D0C73D7A51F4C649022AD3117E4ABFD7A
                                                                                                                                                                                                                                      SHA-256:262AC8842829AFEEACDF6F83AF411381669D507CD3D60A51BA200C9F13385F28
                                                                                                                                                                                                                                      SHA-512:B8B8C5DA963A5EE2A0357C45B70A8DE1465135A8764BF8251CEA65A8F56568796C663116F2EF58B91192F538D17937CFB9A83C580247CC74E172B94A35EECB9B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA3959D20712220C1EE8D6030BFEABD0FE618A56739AEB295AA1FDD7536506322ED0BDF68CE43EF03EB8900FAD16939DE7E65016BB3BC3B1C54618D07E1FC9D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):688
                                                                                                                                                                                                                                      Entropy (8bit):5.5142215205780944
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4biqkCbkLwT5zxjmT9wuRToXk7YVbFXyREIa:7e9SlNLiafLYFv9KO4zkCWIoT9ZRekU9
                                                                                                                                                                                                                                      MD5:5B28705E4840EF14D1893BE363B803BD
                                                                                                                                                                                                                                      SHA1:10BF34AF49949E96B94A2A0E013BB156683B4D3E
                                                                                                                                                                                                                                      SHA-256:4E0D93048BB7F2995CCB68C151BDBD5D8589948F81DE2280502831DE03DCE62D
                                                                                                                                                                                                                                      SHA-512:FE75224A87BE247C7114BB049ED25F55F427F1CDBDBBD685366F036E8891B270214F77958A6D8A905B66DEC529129C644321E5125A1C5317099DA2C780A8A4B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//4880C596D977ADDC5F6D3DE47F016E24850A8A25B6B56EC102FB57BE17EF30F108D9A49AE7BFD248E08C2CE6AE5D4B173F602DEC34B0926DFA5EB9F879CC09F1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.532615699841096
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToroabkmwYn:7e9SlNLiafrFv9KO40gnWIqgV9ZR5En
                                                                                                                                                                                                                                      MD5:8E6F1DCBF2BBDD4812FA4F2DAB9C43A8
                                                                                                                                                                                                                                      SHA1:180B797F99229214046DCB1C5BC9F2D646A75E13
                                                                                                                                                                                                                                      SHA-256:D2BE5B199291B5BAB255A83AE6B0AA82D0EFE0E0DECF8937DB521C6708DCB980
                                                                                                                                                                                                                                      SHA-512:5C4373EAD81032E51B69798A250890B9A2FBC9A63D26749A72CEB93B7F43682BF883BC1C10F273C92DA13996DD466130AD28803E42A78DD5BE0FD3B3B05FCBA8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA804C15F6975C084E7F423A39B1C4D1E061F52EE01933A21C16015FB0611C02DE575E939968EAE27B083C0DD9A5D7D263C3CC462F91B26A3EF4321880F1C8F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.522511534706463
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToTZ/xVUhxkeGdnEV9F:7e9SlNLiafrFv9KO40gnWIqgV9ZRK3Vw
                                                                                                                                                                                                                                      MD5:98EFE7D3B444951AFDCB0ACBB730C25E
                                                                                                                                                                                                                                      SHA1:EC3799399BA47D27AEAC09EB21B7E18714E1B2E7
                                                                                                                                                                                                                                      SHA-256:10252291B3535DBCB63E84374010830ED20530C03A4E25B2A499120FB356FAAF
                                                                                                                                                                                                                                      SHA-512:89CC94F506B6F0DCE08A037EC0ACA6821A2DBF258A2043AFA4D2884B14A21540F0467CA01E0B7909D38FE16997A034E50CCC04D9BA8BECDE2616143448128D69
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D230E1F1A500DB032A710473C3AECDA773F053E1419B3DA43B5CF22F51D59DF2B34B096545A072A09360F6AE735D8607C07EBE0C97AA8BF78D6E1D3083E3556B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):692
                                                                                                                                                                                                                                      Entropy (8bit):5.533689253513386
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfft6v9LuO4biu6gbkLwT5zxjAHo88WN9wuRToGKheR22I6n:7e9SlNLiafsv9KO4RWIOHo8Z9ZRLEA2A
                                                                                                                                                                                                                                      MD5:D0C17F7AE5C3DA9BE7BC96245E9D0F5E
                                                                                                                                                                                                                                      SHA1:9BF2CDBA16C3CCCCD7A2E069086342333B573D0D
                                                                                                                                                                                                                                      SHA-256:DCD5D47D3477438074B190ED1E00A72ACF74401354646F02CF00A1A77205D317
                                                                                                                                                                                                                                      SHA-512:48C3C0647EABF13366E919EFB7E7A24B520917098852C49DEEA36CF430A8879C2225A2997C4F8B75A1F86CE3E5C0BEC68E714BD6D1DF2B6FA8B767FD16820DEE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BC956D6A6A53E1F7AAD19F3D631FEF940A670FD790C7DEB3A241CABBBF67E2083B495DBB95B04F2262B036B552D8A56A0044921BF062E1DD666173CB9843DB94++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710
                                                                                                                                                                                                                                      Entropy (8bit):5.55151240094457
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRToEkhTpm8n:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRSz
                                                                                                                                                                                                                                      MD5:BC4A141B5CBC453B3F05FE63DF0BA5B3
                                                                                                                                                                                                                                      SHA1:0855321761C9A7035A8798FC211F597B2BCD24CC
                                                                                                                                                                                                                                      SHA-256:6C373DF185597E9B942D5738D1077919AF981DBEAE5A2DB69F7D06BB58137EC1
                                                                                                                                                                                                                                      SHA-512:85AF7B1CDD91DA5F1BBAD996866C42B6EFB2D8A35A52799F85C025361C211AA2BC40B1869CEE7A50EC9A24FC3B8862A58A290258D741018AB6E5B350541CE0B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0F0F9CFDACF5B41C6C177531339BE320FAFEF6A800775EC347D5D488EFA8F8317B5DE20B713422F1FBFDC13EC57F67B1CC08B1A30C59525F06DEC2E0D56A5668++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710
                                                                                                                                                                                                                                      Entropy (8bit):5.530208948535214
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRToc3PJYs5aA:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRnf
                                                                                                                                                                                                                                      MD5:C44E59985A55311E7F6BAA87EF993B98
                                                                                                                                                                                                                                      SHA1:12134E8C69120B2FBC8AF82E1BE8183DB5BB898E
                                                                                                                                                                                                                                      SHA-256:32E9956A1AB7DFDC54EB77B1FFFCDADD2DFEC0CA5B4D38F2A5B950A79F5D062D
                                                                                                                                                                                                                                      SHA-512:2ADCC224B551C403FF00FC21311FF9D842027FB2BEDE9F64B66F08A128D561517721CE3C72BC5B8F38D70E7FF526C911BB99BEC23021DC5589B80BF7DF2203B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//998ED52278AF698342457AFEF2ABFC43EB8E1CA85C5511CF6E5DEEC26B18184BDA7A567652CA7982A1162D16F248961F2D98D598A2792DAA948A5069C85CE9A3++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):703
                                                                                                                                                                                                                                      Entropy (8bit):5.518105253351284
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biaBzcbkLwT5zxjHT9wuRTo9g3Zlw:7e9SlNLiaflv9KO43BoWIVT9ZRdPw
                                                                                                                                                                                                                                      MD5:DC378106F4DEAEC0CABD0F5E88A515AC
                                                                                                                                                                                                                                      SHA1:F67E647DD898830A46A8B6480D8806E2A73917BF
                                                                                                                                                                                                                                      SHA-256:CCE7D0C8F783F6D14436AEFC89B8879A4700AE8BC1DC5912D0B9C2EBF365A0A3
                                                                                                                                                                                                                                      SHA-512:39DD91FE9AFBCC7D4D31134315360D595A83A845799C256147A71B94A08696FDAF383867CD51961950821D75CCD4748EFD0D844AC6F9568038AC8649D235C4C1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A493FBFB5AE3EC66777ECF1DB2BA30F9F1F4A6E6DFCBAC4EDA0DA7443D2DC28F3CCF659841F3F6446712C6D8D47AC143ED02C8A4EAC11C700573E2C920ABF9C2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                                                      Entropy (8bit):5.599467220659489
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfQdU6v9LuO4bihIHmdcbkLwT5zxjAHo8Kwv9wuRTo4dzeBXMPjZS:7e9SlNLiafQd7v9KO4k6ocWIOHo8Kwvo
                                                                                                                                                                                                                                      MD5:04D4B5B205C463AD95BD36318E6714AE
                                                                                                                                                                                                                                      SHA1:8F2D5223224D0DB4445D37B29F624DB2C56BA0E8
                                                                                                                                                                                                                                      SHA-256:6C47EA4147DB11C121F90CB9456CCB273AB45B7D3BF291F795DE4D99CA8DA668
                                                                                                                                                                                                                                      SHA-512:DEF6234A83BC211AE3CA539A282400869A8FFF95ABCDB90C2F31436D0A27EA2BBA26A0094089196C8F1C173E52FA6A1AD1C50E369148DE4908C07BF4433AB738
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CD9F5CF6CBBBA54C3F23A659D3912D647862A87F5273FB0E2DBFF22941D2BE434F1A6538BE7A4CD09D28EF385A95B92D9C48A687DBE1B013FBAA731521673633++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):697
                                                                                                                                                                                                                                      Entropy (8bit):5.539019069592982
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfy6v9LuO4biNkbkLwT5zxjm79wuRToCaP1QsZzXt7lP8:7e9SlNLiafVv9KO4akWIo79ZRBYasZdm
                                                                                                                                                                                                                                      MD5:66DA2DC63D6A3925D48F40AEB602D502
                                                                                                                                                                                                                                      SHA1:A53F5FA1B97FC7CAFFAEDFF3E3FD7B8C0725D2A7
                                                                                                                                                                                                                                      SHA-256:1638AB11E485CA57AEC94F987B5B0CA7B9D0B8B09CD7B80A36FD3DCF0BC3F55A
                                                                                                                                                                                                                                      SHA-512:13766D0071C8B96FA222645026C7BBDF78D1C629C0C5A7FE7796A3F05384C652B36602D792A8C9106E90C1B0623DC11AEB7BFBE4DDBBDDBB1BFC7AB409B474CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//01F59DD33A54B1B634D2DAD086EB337D2F51F8692DD0CF7F590351097B7C81BBFA9106E0E29D53425605E0B0A607D8C11B05FFF8CABBAA10DA77B6B84C1D138E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):808
                                                                                                                                                                                                                                      Entropy (8bit):5.738433406660423
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7e9fLdo5ijdfA6Dlv9o4A2AWIOHo8UHv9ZRenKLs:K9fLdICdfA49XLAWIOfUHFqms
                                                                                                                                                                                                                                      MD5:AE48A5FF7596694A4FD1AB26F50B00E3
                                                                                                                                                                                                                                      SHA1:702780AC40822B2ADD3139E0B7B123834CA4B487
                                                                                                                                                                                                                                      SHA-256:6DF0DEA4086371AD6A3F1DAFA584FD2531F0229DFC518396AA3434F3DFEFF7A6
                                                                                                                                                                                                                                      SHA-512:DC188AD001508C0BAD665E7AD9886551283E5B16BC590FCD5B14373401ADB137119C93FFA68C69B939E1989D6861449A4C200D7BDACDD97BAD82190B51BC272D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1C4184071F95F14CF00EEBD3AB4A7D7995B06EC7F97188DFFC294ECA8E75AF545331449C57697749715F92FE166E2E4AE3D22882960F462CE6F6996A1E75D592++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):742
                                                                                                                                                                                                                                      Entropy (8bit):5.822041209914263
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSd6ds63i7R6ikfV/i6v9kc4biyGbkLwT5zxjsGiFW9wuRToQciKdyhQyVSTrF:7e9Ed13isnfVtv9kc4sWIViQ9ZR8yQDl
                                                                                                                                                                                                                                      MD5:DC7B76F9DE7F35276C2143C5EB102EBF
                                                                                                                                                                                                                                      SHA1:8D2AB5544CCB298761AD43B3644041023B758BDD
                                                                                                                                                                                                                                      SHA-256:B7AF107F96B56FC6FCBC642A0A6F94F0ACF0352A2FC8D6A30B0DC4F7A78F3576
                                                                                                                                                                                                                                      SHA-512:B231589775366E1B6B4D12497F321E9A93D2C8DF0C5CC1BBCBA1012CE8BD4429FEFA91BE68EEC9C797649FA2A14FA7DA8342F23023EA4B17C6F6F1B194EF7BFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//AAFA73BEEF104F5ADBF69569B45268191B8C4082876E870E1484D98FA17AC8F7275EE9083D7D9FBE552E3144770D5820AE3AA2B0FCC2E732A3BA80B338CE1904++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):696
                                                                                                                                                                                                                                      Entropy (8bit):5.563291933943177
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf3Hi6v9LuO4biqyNLMBHbkLwT5zxjmf9wuRToSdP3oynrr:7e9SlNLiaf3Fv9KO4zyNsHWIof9ZRZ3v
                                                                                                                                                                                                                                      MD5:DD4688CB4523EE561CA94C2DA49E335A
                                                                                                                                                                                                                                      SHA1:8047EC0B501FA264F945957C0E362310B1CE66E7
                                                                                                                                                                                                                                      SHA-256:3F1E1DD5CE540E4DC4C06313851F35FFD1D7DFB27961059FD32947F2D8661F05
                                                                                                                                                                                                                                      SHA-512:9FF8C8392F336D7291574542505A8175693CA1534D4BA26977F1817E261727FF5CBBC31788A23735E7617950F06DBA20EAEACA563399A492EA155E48B60CD191
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//9E9A1473D0E14AFD79647DE49EBDB6500B342965F5C3E5F660CA5BE56755AB544CE8034283771B76E169B8FCC0E95742C6CAD1E238FC2211EB505CF6BC884601++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):746
                                                                                                                                                                                                                                      Entropy (8bit):5.6087546952598295
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfP6v9LuO4biqLEnbkLAWB2CT5zxjAHo8CW9AWB2CuRTo4r/0Wp:7e9SlNLiafyv9KO4zLEnWtB26OHo8CWo
                                                                                                                                                                                                                                      MD5:12B1FCF468BEEA23810C5E29E00955A3
                                                                                                                                                                                                                                      SHA1:1C5829EDEBAB9768FA20308DE723FB452A09BD2D
                                                                                                                                                                                                                                      SHA-256:F214DF27C228AF7545300A18535433501C730B035A46E5F9C5B6D8EA134ED3E1
                                                                                                                                                                                                                                      SHA-512:8309B74B03D8D2E5F55ABA411DA06B604B74586438CF13CEF59A92E07C0EC9D5B389420B73CB98558ACD0B3266311E861CFAE71D63ADAEE639A128872461BEFF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CB6340B4EFECAB3E71CB08FD5C0F4C5285E77639F0E2D8361F3498F4A47F78E2FAAB43BD5148673AB645AC0AC3E22C9D3110834DD0FE917B44E73BE905B94BD7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):709
                                                                                                                                                                                                                                      Entropy (8bit):5.547492619756502
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf6v66v9LuO4bipidGGnbkLwT5zxjmO9wuRToozzFT2bGG:7e9SlNLiaf6vtv9KO4oMGGnWIoO9ZRkH
                                                                                                                                                                                                                                      MD5:8826C3D661F02DF18E529EE006C0074E
                                                                                                                                                                                                                                      SHA1:3B34EB20315AC50282146A4204D3EBB1BAB9E5A2
                                                                                                                                                                                                                                      SHA-256:AADC501672DFC69A1443DB6DF6E7E265105AD0D35E2970A0BE0B581934EBFBA8
                                                                                                                                                                                                                                      SHA-512:8299A48AA7B13FB6CC757FE0D01FC33073218FCE89E0AEE014A5550FA8EB0DA43295E9B81113E523CBAB26531CDEE98EC65D7D3E3FE9742A640651381E2D934D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//17FDDA361C160E1D310873ACC18B2A0ADD5102010B762EB776BD100F17C46301160D84E653EC76428F9ED2C2B81B441B716B90800DF6CCCA3ACA5D867D193D60++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.538511894040431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmHbkLwT5zxjAHo8kf9wuRTo1AMvVqghkK2a:7e9SlNLiafBv9KO40HWIOHo8K9ZRqA3w
                                                                                                                                                                                                                                      MD5:FDE3D3EA8FE84835283B9B56430EC29E
                                                                                                                                                                                                                                      SHA1:1264DCF81224D50E00668F2AB05954205445704F
                                                                                                                                                                                                                                      SHA-256:F320951C0B9E57DDF7A910E0B94F4125B15320C8656CAE832DA0D1DAC46604E3
                                                                                                                                                                                                                                      SHA-512:1DEE807E2BEBFDCB144421FD9CE53EF5CC26352CDC29E784498727C6966F92CDBFAFEE0E9584F25361ABA2726AB656FEAB3FC8D7A65348AA939D1BC1A398E0BD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B6B6A9911A08317B36CCB25A27F2A509E5FE6E73002120AD1BED572BE9D87A7CFDBA2607ECB9E5023860C494E0F4F0708E84CEEF8BFDA4F07F53491FD9BFBEBF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.537523162423459
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmuybkLwT5zxjmkf9wuRToc79Bz72b:7e9SlNLiafBv9KO40nWIoK9ZRHpBz72b
                                                                                                                                                                                                                                      MD5:14C56FFA20920CCDE1B19B733CB85FAB
                                                                                                                                                                                                                                      SHA1:474AC88709CE4B55BB54137F467949B09CD147EB
                                                                                                                                                                                                                                      SHA-256:9E00583D89A3A1C5717D2D1659E4AB128F86AD0801B2B3BA5F85F3CF7BF170C2
                                                                                                                                                                                                                                      SHA-512:EEF3A6C625083AFE5261ED7659B63E59D793228B7A07F791833EFCAD699F239D0C3B60BEAB2C65F194AEBF4019B16086E6D81D429DF42A96294FA15ADB83E0AB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D630EF6834C2DF4F454AAD8AC93FCDBEA26EF7FBE1396FC5E95D2ED564E46E5A122BBC1943EB4F39BC54CD5FCC0768C696B62861C1259FF82F57120574CAC80A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):751
                                                                                                                                                                                                                                      Entropy (8bit):5.762905150784842
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf96v9LuO4biq0epiXbkLwT5zxjhKgE9wuRToJ2UwvOlBtORchW:7e9SlNLiafUv9KO4zrWWISt9ZRfvOlDo
                                                                                                                                                                                                                                      MD5:D37EE749862FB89C64AC60108D7DFBF9
                                                                                                                                                                                                                                      SHA1:20647A50F8807D09819EEF6C2CD29230882373B1
                                                                                                                                                                                                                                      SHA-256:9F3AA8EBCDD309AFDDAE08C5331CFF223DCCDB026BBB20618A09AB84C26789C8
                                                                                                                                                                                                                                      SHA-512:F0FA804CC1DDAC94CD15B5414A12B89F97E6997B02E14337C0DEA619F5D83AAE3F78456DCAECC896E79B8DAB1074F8EDC9CC3041AC863DC55658F65B753EDFDE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1BBCF622DFC15CFEB9A52B5F5D981C8B8413EDAEA7B714254A99AFC82C962439630225D096E319595DC777402B74CF57B39402B61FB4A77DAF7FA0278366CFF5++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):719
                                                                                                                                                                                                                                      Entropy (8bit):5.608359372203038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfa6v9LuO4biIAbkLwT5zxjAHo8+9wuRTo97tJVLLjpPhv:7e9SlNLiafNv9KO4uWIOHo8+9ZRY7jVr
                                                                                                                                                                                                                                      MD5:039A4B97702E56DDDD98E64526364190
                                                                                                                                                                                                                                      SHA1:39FE5D4FAA2B83D9F7930D5EF64711BCAD9E4830
                                                                                                                                                                                                                                      SHA-256:FB4283F741112BFA20A09C4693585AEF9521D2A7D70D66440030D957DF819DAC
                                                                                                                                                                                                                                      SHA-512:C8403E82680B6FE1E2FF9FA14969ACD4C33AE3CBF2D6C1291AAD10A10B63B4F35D6BA7F7D7614DF1C481E300564EF39FAA39D9D079DF4F6FFB9F6A99304A609F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E574C8953368BE6E9E4E2131834E332BB1EF2B469C106EA92F119638AB8BD08E79E61753671722021A4AA0BDCFA111B5319B3EAEA44DBCEA84E4DDFB9109EDB0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):706
                                                                                                                                                                                                                                      Entropy (8bit):5.563197455028977
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biagkcbkLwT5zxjHT9wuRToJhfbkEm2Z:7e9SlNLiaflv9KO4cjWIVT9ZRetRzZ
                                                                                                                                                                                                                                      MD5:0B067B696A6F2B7FDAFC6E733872401A
                                                                                                                                                                                                                                      SHA1:E804B3A048F3381C3E8DBDDD2DD51F0C11156971
                                                                                                                                                                                                                                      SHA-256:B42F2EC3B128DEA5FB95E19BF3C9B0794D7DF0E9A9CEA51199C3D69C252AF9BC
                                                                                                                                                                                                                                      SHA-512:204EE91380D9F87C8895EF29EDDD3FF2A1E4E79B423DE38DBCD6CFE79ECAF22E30CC4A79D1B756C9D9658D7347C088D89B4185D1ACAF347F91AF08391E1AA61B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81CD68B5ABFBD1D2EFFC9A3778314BDBB771A2770E9125B7369851DF9C36434CEF054A284B0CED6E3AEF5F9E4D745F2507A51DE8375215334BA83E007F2E1661++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):690
                                                                                                                                                                                                                                      Entropy (8bit):5.533144558424333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bieGbkLwT5zxjmf9wuRTo2kRhFSVhfXn+h:7e9SlNLiafLYFv9KO4JGWIof9ZRdE/0I
                                                                                                                                                                                                                                      MD5:49BD8D622ABF07A89C6450F6760A934A
                                                                                                                                                                                                                                      SHA1:FC7C55ED457358DB7A0A34042F3E17AB21A000D0
                                                                                                                                                                                                                                      SHA-256:5491BC1348519AB1130D9E1859272FA7336B6386E6F002E92C725007E1BFC8CB
                                                                                                                                                                                                                                      SHA-512:BE3210541077EEBC083B43E330AC32C2ACD6092D658D9E725B2D1467D6A7FC5B7769506007E110DA390BFAD12C3FED038601E34E1405949AB233D42A5D51D0C3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//99592B3FDCD482063EFDD4D0D71A45608159E4B410EE9DA426896483C35C9A1576F22AF8CC2225CAB446BF6640B248A7E04B2250D9880E21EC2D34AFBA6F0592++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):696
                                                                                                                                                                                                                                      Entropy (8bit):5.546230689160202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfT6v9LuO4bij2VbkLwT5zxjAWoN9wuRToBebfZkED:7e9SlNLiafGv9KO48QWIuv9ZRpRL
                                                                                                                                                                                                                                      MD5:0A399950FB2D1D80725F3CEA6BE75322
                                                                                                                                                                                                                                      SHA1:F78707F7288CC04320CBD855830F7D0D5C5862D5
                                                                                                                                                                                                                                      SHA-256:11BCB1325493DD7886DB10309A616EA8ADF395D470759ECE01540DA39CC02B31
                                                                                                                                                                                                                                      SHA-512:3978A9F55ED7075C3642C385818C0A099FA914BDFE67CBB36AF94773BE4447D6BC838DD605D7FAFD2DA0915403BC2435B664F5AA8E88C14928B13604CB2C7EEB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//459C6B15A94C2BDDB33AC8749C4799657210EC421A307BD0DFEA6943FFE5A4E0E3F6D7E94E3FC34F7581AE498B26A46ADAC1C962E3C5AF1E01563551E7C83D3B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):713
                                                                                                                                                                                                                                      Entropy (8bit):5.911021719409146
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSuKxi7s6kfF6v9bgbiE4ebkLwT5zxjtDYv9wuRTo4QCejK:7e9uui7s/fsv9bg/HWIv49ZR7QCejK
                                                                                                                                                                                                                                      MD5:61254A9C6CE57B8FB6DAF5C47840C53F
                                                                                                                                                                                                                                      SHA1:D9B109B65B5B725D90E4366FCDEE509012FB0751
                                                                                                                                                                                                                                      SHA-256:BD6876CAE0889DB066FB4F8F7FA38ED517023806C7D41341C7522DBC0E412FC6
                                                                                                                                                                                                                                      SHA-512:31A0C944BB7EB098AAFE2FB280D21248834F3AFB7CE21D818C8CED3CFD95D0EC8F61F6023BD8EDC3178AC39AE7A9059EFBA35A474E18BC8C697DB9546B6CA9E8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//C49666C6D17B3380489032D792278402A58C50CA24B473ED94B458FE49F52BF29B7E9CBB0FC9915FCDFCE0CCE37FB45A71D3DB9EF0EF754DDD0177BFEFDAA76F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\jslang\wa-res-shared-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):694
                                                                                                                                                                                                                                      Entropy (8bit):5.692484981098063
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfF6v9LuO4biP3emebkLwT5zxjgDYv9wuRTosTKGxVWv2KA7thn:7e9SlNLiafsv9KO4d1WIG49ZRknmhn
                                                                                                                                                                                                                                      MD5:A62FE1D5E76F93DE63A6CE0848412310
                                                                                                                                                                                                                                      SHA1:951E5AF2615D9D352124599DD8B1E0A5796479B3
                                                                                                                                                                                                                                      SHA-256:FAD192A1E13114CFC65AA7EBDA0589240B08C8516ADAE145F2CF7309B5156CD3
                                                                                                                                                                                                                                      SHA-512:FB1D86DE2F4975AB293B10062854A3D7944664109EFF5679011D4E22AEF3FAF8C6A611BCBE67BEEC343DF89B0C7DD8C062349CB223302791F595585C97657BB5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DA60579E457B68E8BEED2C221EB14808A61CCB56CE7A89168B68C6933874687459C88D14DCF7061DF466EE138F540489BDA6C24DB96B3C8D0E348B97E735E643++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\l10n.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 259404 bytes, 513 files, at 0x44 +A "\l10n.manifest" +A "\jslang\new-tab-res-toast-cs-CZ.js", flags 0x4, number 1, extra bytes 20 in head, 39 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):281404
                                                                                                                                                                                                                                      Entropy (8bit):7.9353344781841635
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:/9+TNUI6J8KH06JGFshKyAY4WTP7o6E1AkbVz/mI4V:/ET+I6Jd06JGFryAYpTP7ZQAkZaV
                                                                                                                                                                                                                                      MD5:3D2DA95E75C0FA4FFF38C977227891B1
                                                                                                                                                                                                                                      SHA1:246CB3E6BD274AC51AB45A512BF7B02B7E993681
                                                                                                                                                                                                                                      SHA-256:2EDE69815E66AE0D47F6121CB92C74DBAAF68D9E09AEE7F0F1675CA6CC0EB249
                                                                                                                                                                                                                                      SHA-512:400929026E74C78D1E86C767445637FE6C7196DA3C9DA54A055010705D12503010201717739A302256B3E2F427EE0DEEFA8703F7055E8CAAD4EBB8D0ABECABEE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF....L.......D...........................L....U...........i..'.............SW._ .\l10n.manifest.#.........SW.^ .\jslang\new-tab-res-toast-cs-CZ.js.#.........SW.^ .\jslang\new-tab-res-toast-da-DK.js.#.........SW.^ .\jslang\new-tab-res-toast-de-DE.js.#.........SW.^ .\jslang\new-tab-res-toast-el-GR.js.#...!.....SW.^ .\jslang\new-tab-res-toast-en-US.js.#...D.....SW.^ .\jslang\new-tab-res-toast-es-ES.js.#...g.....SW.^ .\jslang\new-tab-res-toast-es-MX.js.#.........SW.^ .\jslang\new-tab-res-toast-fi-FI.js.#.........SW.^ .\jslang\new-tab-res-toast-fr-CA.js.#.........SW.^ .\jslang\new-tab-res-toast-fr-FR.js.#...."....SW.^ .\jslang\new-tab-res-toast-hr-HR.js.#....&....SW.^ .\jslang\new-tab-res-toast-hu-HU.js.#...9)....SW.^ .\jslang\new-tab-res-toast-it-IT.js.#...\,....SW.^ .\jslang\new-tab-res-toast-ja-JP.js.#..../....SW.^ .\jslang\new-tab-res-toast-ko-KR.js.#....2....SW.^ .\jslang\new-tab-res-toast-nb-NO.js.#....5....SW.^ .\jslang\new-tab-res-toast-nl-NL.js.#....8....SW.^ .\jslang\new-tab-re

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\logicmodule.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 1558063 bytes, 2 files, at 0x44 +A "\logicmodule.dll" +A "\logicmodule.manifest", flags 0x4, number 1, extra bytes 20 in head, 138 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1580063
                                                                                                                                                                                                                                      Entropy (8bit):7.999600937770339
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:3785frT0NhG01q/YGqiz/lDiTiS9kLkLCHjQu4K4VPgF6czJ9tXq:L85frS8YqwLg/K9kLh4x1nczJ9tXq
                                                                                                                                                                                                                                      MD5:4AF485B15421E8B721457AB0286220C4
                                                                                                                                                                                                                                      SHA1:DE370B917B0ED36963CA95BB94FB6D1365FAD4FF
                                                                                                                                                                                                                                      SHA-256:117969CE7A430D98F1B51BF6830DC729F664D71641F064654ABB9C79C0C1E8B7
                                                                                                                                                                                                                                      SHA-512:F45A1B31CA9D7475FF51E41107C6BEA0335EDF95334AC3EA2AA4EF96F8BF78CCC7CA952AFC52818B266B0C42BA939E99BE3B99559B3802C4792C64FDED7B24A6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF..../.......D.........................../....U..................@.D.......SW._ .\logicmodule.dll.....@.D...SW._ .\logicmodule.manifest.&l...,..[...< .......4....._..Vi...Fc.....9......X..E9.;....T.v.[7....]-...Si...#g.NJ.a41g........b..9...|s..|.._.'...$.z.R.".2...R.....%.N..;5....7...rV.............I:...F...E.;.... )!..>.+ .....]@.............f.h............yc....1.R.IX&@....+...7tvPI../.g@.<.]..y..sJ...r.........m..Dvv.XeSr.G:.;<OvE..v?..7_..|.w.D..vo..W...r.-..z.n.."].....s.5.%.I.?.L..E.o.?...L{..[.....[jz.w...~-...y.u..~K.3Y.....V}.....H..H.$H..o..k..[..._...zz.........J.........<.#^......W..\.?.L.{.S.X]..B..{...[u.......1U.............%.D...]......k[7...f.4|...be.+..h.....<}-...'|........W.}..../.~..!/W.^.+...f.H...o..g..w.+I.......Y.|.{..x..s.o..7.i..?.J?..y[......^k...>6...g..;.~l|...i|K<.+.e.....{.).O..d_.....[~.Y...%2W.6|..L>....>..5.>.u.^.}O>.O........w.......c......+yc.[}|r.........9....{..,.#.....<9......)5k.L.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\logicscripts.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 36383 bytes, 20 files, at 0x44 +A "\logicscripts.manifest" +A "\logic\aj_logic.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):58383
                                                                                                                                                                                                                                      Entropy (8bit):7.922554941357534
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:HOW1MNmm9D36XCHJUj2aff4i3Sx/p31tbLxO7:HOtNmm9DqSHUf4j1O
                                                                                                                                                                                                                                      MD5:ADD08210F32AA8FBCB6472FDC03F9440
                                                                                                                                                                                                                                      SHA1:E46956E5462B34A284FB0D7F39FD0604227F3064
                                                                                                                                                                                                                                      SHA-256:E9BBD57E9AEAB34A1ADFB8E6F0B9F7F150F8797BC2C3405BA16F9AD3E333360F
                                                                                                                                                                                                                                      SHA-512:6D1334252BFA9A314BA1B8A5F7DD0456861433D4087DD102E85D8731BEAA21A9F108D6B4A81DA509CE2D7AFBC9E704AB9B702916D5299CC8DEF84EBF3633731C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF............D................................U............................SW._ .\logicscripts.manifest...........SW._ .\logic\aj_logic.luc...........SW._ .\logic\base_provider.luc.w.........SW._ .\logic\edge_onboarding.luc.T.........SW._ .\logic\ff_monitor.luc.....l;....SW._ .\logic\logic_loader.luc.....RC....SW._ .\logic\miscutils.luc.#'...S....SW._ .\logic\oem_business_logic.luc......{....SW._ .\logic\providers_selector.luc.?x........SW._ .\logic\ss_logic.luc.E'..C.....SW._ .\logic\tests_logic.luc......!....SW._ .\logic\type_tag_utils.luc......*....SW._ .\logic\usage_calculation.luc......2....SW._ .\logic\oem_utils\affid_monitor.luc.0...%7....SW._ .\logic\oem_utils\oem_util.luc.W...U9....SW._ .\logic\oem_utils\oem_utils_wps.luc.Q....L....SW._ .\logic\oem_utils\oem_utils_wss.luc......U....SW._ .\logic\oem_utils\oem_util_selector.luc.(....X....SW._ .\logic\providers\bing.luc.`9...g....SW._ .\logic\providers\yahoo.luc....2/..[.... X.q...D34C.P..._....$.Ir........=...M'......n

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\lookupmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 469579 bytes, 2 files, at 0x44 +A "\lookupmanager.dll" +A "\lookupmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 48 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):491579
                                                                                                                                                                                                                                      Entropy (8bit):7.998529856255498
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:nmVR3NNzot3a/AImtlCvyJzyyvEV3q3qJ49DWlRvSxj/FvbN8v:mVlNNz+tvBySy3g9CSZ/L8v
                                                                                                                                                                                                                                      MD5:417EC3C8C79435BC05A035E1EEC7C7CC
                                                                                                                                                                                                                                      SHA1:F4007A7889B6C7B85429E1E5CB777B49FEEE7C47
                                                                                                                                                                                                                                      SHA-256:0F5584619C6B6B0A40367EC3DCC2BD97CB037F912C7C5C806FC98D4A53940C3B
                                                                                                                                                                                                                                      SHA-512:EEE040F0290907B0B97BD2D98A450782CF72684C392C25442536E579687DE8A3E4DD1D5D778736384BF6D781C8A5573E4DF074CC203430D5DEB65531854478B9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF....K*......D...........................K*...U..............0...@.........SW.^ .\lookupmanager.dll.....@.....SW._ .\lookupmanager.manifest.k.&.....[.... H....@d.5......myS.Tk.Sx.K....[j.\o.....R(-..$.g..Q.-4.....X.,..-......q}......#.:3...3y.s.....\w......z..F..T.d.w..*@Q..d...G.a..)..].c....US.-...I......-.c.ga.A.3.......d..~....1...3......{.s..t'..#1G...5..5FO\.:.Y4a....G.M...w..y.fH..?....E.m>.8.6}..k..PY...(..{....S../.....|W..~)....../[._p..d...~.l.k..'..k7...xxw.m...r..r.....s....am.......#.-..7K.u...c.....\..\..}...Z.7.7=u...X.H.-..n.1.+V.~[]......7...`.m......m..![........dg6...d./<.......W~.g4?.....M................n...E....X..f~..?....b...[..M..}.[.q...o|w.i.C.CG............6.........._M.....U..V...o..sW....RC/j.{..mo/...$,?dQ.lz..[t................./...O.z..3.Uc.....m.........OY.,....~)w..c...../...{.[........c.n..;..|V....o....A..zw7.......J~X?.{.E'...zk....Sn6..R.......v.g.y.'..........=E........u............g..7..zn.m

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\main_close_large.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 13 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                                                                      Entropy (8bit):7.185064395828422
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7Jmynud+EVDvBXmY5j9yEhcZxAalEbKWwz:vyGbVDvxJ5alnWwz
                                                                                                                                                                                                                                      MD5:3F33BF7A71F1A94B30AD98121F2DC31F
                                                                                                                                                                                                                                      SHA1:533B933BACBAE375164518AF202EB90086BEFC44
                                                                                                                                                                                                                                      SHA-256:4D3581315F5AB93538BEE793BA9727FC9E8444E9B09773566C4BDF0C44618828
                                                                                                                                                                                                                                      SHA-512:4E768ABACB878A5F9BE79B91E9BC77778F62AA4ACAEC4A246AB3359E86FF685250A1BA9E7765CE5174A42E5936CFAC27CB381B505F92F30EBF4B43806848899C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.10/1/14........tEXtSoftware.Adobe Fireworks CS6......IDAT(...1K.a..........+ht...".96..\....M..f..9........ n....~.KK..o..~..g{8.:...I..D%...^..6V......w<K.......z.?..dk2..p.G.U.&...?..U.].m.O....L2.o.`<,.....k....|....L...Q._.<.....?(...[...lW...O.6....Z....r.q....Nr..p2.d._.w...1....F.....@..x....x.X..T./.H..w./.yrd.......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 67 x 57, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2052
                                                                                                                                                                                                                                      Entropy (8bit):7.890065571351557
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CHjblGYXQQEZZyIOrNK6rC4lWVkOjKpgOojQ9dCe2LfmC:PYgNZKJKSC4YF+WjyOZ
                                                                                                                                                                                                                                      MD5:18344204EC04F1E95E086D3BC94FA0FD
                                                                                                                                                                                                                                      SHA1:87CA3ED8948774091B451F7CB2F95139E56D351B
                                                                                                                                                                                                                                      SHA-256:30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
                                                                                                                                                                                                                                      SHA-512:13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;|VO..{{{).`"...VAb....u.|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.|.K2..'.{.j..c.<.|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+.*...KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......*3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d|..?.8S.........}.|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mcafee_pc_install_icon2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7205
                                                                                                                                                                                                                                      Entropy (8bit):7.9471260512499375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:KS4Do1RyFyKSZ4pTSumpAO/Ap6CQU9Uw/JLO/xvifnL:F4E1RCFpWumX/Ap2UeMq/xGL
                                                                                                                                                                                                                                      MD5:F2E3045621ADE164E9DA40F294BEB00C
                                                                                                                                                                                                                                      SHA1:36E9D967C679FC898BED1FF6751A73BB863EAF79
                                                                                                                                                                                                                                      SHA-256:D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
                                                                                                                                                                                                                                      SHA-512:7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mcafeecerts.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with very long lines (2293), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):126293
                                                                                                                                                                                                                                      Entropy (8bit):5.969613768259596
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:sY+8or+sWZ21Wzwtp31uRla7GTvfwjBobALAnr+sqDK7G3lq0lAE:dcPsjO31ui7GLjA8rPqDK7Gb
                                                                                                                                                                                                                                      MD5:D0CD30BD9B02F33B222FF8A846821D4B
                                                                                                                                                                                                                                      SHA1:DA85556707CB3FD59E08DF69017DF6BB82E52F62
                                                                                                                                                                                                                                      SHA-256:1CC3969AEF3DC3DC2330DB0386C6C27C09A58D078689D8D97D900A2B9ABE31A0
                                                                                                                                                                                                                                      SHA-512:6C1F9DE0897F02648638B26F20728C5F2E9822F8CAD232ED42ACC18F33AAE7E102C7A00E5D42B80C10E423DB937DC6AB783255342B12B0DB07B378508886C2ED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" ?>..<Package Version="1">.. <Certificates>.. <Certificate Name="McAfee Trust:0">.. <Privilege>PRIVILEGE_IOCTL</Privilege>.. <Issuer>Microsoft Root Certificate Authority</Issuer>.. <Subject>Microsoft Code Signing PCA</Subject>.. <ValidFrom>20060125</ValidFrom>.. <ValidTo>20170125</ValidTo>.. <SerialNumber>6115082700000000000C</SerialNumber>.. <PublicKeyMD5>4A171B7E5701870357585DD1BAAD752C</PublicKeyMD5>.. <SHA1Thumbprint>FDD1314ED3268A95E198603BA8316FA63CBCD82D</SHA1Thumbprint>.. <Data>MIIGgTCCBGmgAwIBAgIKYRUIJwAAAAAADDANBgkqhkiG9w0BAQUFADBfMRMwEQYKCZImiZPyLGQBGRYDY29tMRkwFwYKCZImiZPyLGQBGRYJbWljcm9zb2Z0MS0wKwYDVQQDEyRNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDYwMTI1MjMyMjMyWhcNMTcwMTI1MjMzMjMyWjB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3Nv

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mfw-mwb.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 10303 bytes, 6 files, at 0x44 +A "\mfw-mwb.manifest" +A "\packages\mwb\mwbhandler.luc", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):32303
                                                                                                                                                                                                                                      Entropy (8bit):7.808899056176092
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:jbr4L5oOh8J2C2HiPvYdAMxkEuvpq41tFAMxkEg:jP4L5X8J2C4i8xavp31t9x8
                                                                                                                                                                                                                                      MD5:47CE729455BB56778B16B97EF1F5DE3B
                                                                                                                                                                                                                                      SHA1:D81688BFEBE2E51A5BFE5C7B8BE1A492B790F553
                                                                                                                                                                                                                                      SHA-256:E639502F668950CE99B5E6ADD518A12E43C98B3F8CA8EF524B75F190396AC4D5
                                                                                                                                                                                                                                      SHA-512:2BA5DBADB091D441BD372A5C104F464EFE9CEDDE9900925049E7DC7C1518D0A402491C807625886F9FBAF9487D9682C9D120B0B4FAFB6B9AD85480D838C49614
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF....?(......D...........................?(...U..........m.......W.........SW._ .\mfw-mwb.manifest.~...W.....SW._ .\packages\mwb\mwbhandler.luc.3.........SW.Z .\packages\mwb\stop-video-alert-icon.png..*... ....SW._ .\packages\mwb\wa-controller-mwb-checklist.js......J....SW._ .\packages\mwb\wa-mwb-checklist.html......T....SW.Z .\packages\mwb\wb-rocket-icon.png....6.&@V[......d..A..#..O...%......Jk..m.?.D8....V..".A...|.8...|........w) "4.5#.p...`....t..8...`.4.....P.y.[7/.....IU.....}c=...[.j...5k..zX....C...a......j.h..>..... ...#.DD...U3w//ro.V...@#...). .P.YP"^.p....x|...|..a..$R...&.`(..=p..+ti...C.....F.U...!..0"E.%&...bM.[..^*L.?B..mr.w...G..U{s..O.}..$...]p......6./......l|..&P..AMN-A8<..L.*(.aP.?..q4...,...~/....='..2.$F.1.'...0[U.'..y..QeF31..(..H.......N.$D$m.q.5...%....33.".>.O-..o0...@..../.3..{caRV....$eL..<..b.{.p...$.~Q0..p.....~.I...9..(K..Uy.T.9.E...r..I@../..I.......Er...oQ..PT...........%.0./...c.c.P3B_..Y.\.........Y*\.r.......5...H$#Z

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mfw-nps.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 12598 bytes, 6 files, at 0x44 +A "\mfw-nps.manifest" +A "\packages\nps\clipboard.png", flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):34598
                                                                                                                                                                                                                                      Entropy (8bit):7.82948620298698
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:XSORz4/xsyc3I1jjk2HiPvY9AMxkEApq41t9O3AMxkED:XSyAWn4ikxsp31tgx/
                                                                                                                                                                                                                                      MD5:E1995E6890D79881E969BE718925F2D8
                                                                                                                                                                                                                                      SHA1:686278ED110BACE808D3122349B0823A57CDAF1D
                                                                                                                                                                                                                                      SHA-256:85DF465C4E7C0AE9F821D7B291DB4E9AD22609822C2258EC5F9A50EAB5C04737
                                                                                                                                                                                                                                      SHA-512:D69DD972F318206D6DC980905E36C562F17CA5C6F5E93F560081F05DBF6487D1DB092470F4E3F92742D787F14319EF7BA2B1D00C604A9D3966679B3B58D3858C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF....61......D...........................61...U..........Z.......P.........SW._ .\mfw-nps.manifest.k...P.....SW.Z .\packages\nps\clipboard.png.-.........SW.Z .\packages\nps\info-16.png.o.........SW._ .\packages\nps\npshandler.luc..j..W/....SW._ .\packages\nps\wa-controller-nps-checklist.js..........SW._ .\packages\nps\wa-nps-checklist.html.-+..|*..[.........B.....=....$".^..=......Z+~...Rh).Vi...VG.V.....+hBX.A#.`U..V.x.$..W.o%h.^N0.^-Iw..fk.2.D.q.....w 6..P{._..........jdh.=..~AI.n=.....'.yZ......|E{.K#.sQ.#.t.Y.<M.2..wE.GF.!a...N....055..3.i......ORH..%... w...7...^..L...f....F..oZ[...Z.?.~Os..k~....U.h]....................Q.|8j4....~B}............K.......L.G.I..7.....;..~.~.1....~.. ...8....Q.Z.v......)hq.....z.?....c..,..'..X..../.._..j..pk.*fS...?.=?..._)w.i.IASM..3..n......+^[........a8L....@...U..{.._...E........S3.."....w}7?ok.....7.......>.>.E....y......Y.5.~}..o\Q.qNyr.../......zjOjo..%..........2.G/.........B..9.8..0.......98.@D.(~.....@..B.......82.T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mfw-webadvisor.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 914590 bytes, 203 files, at 0x44 +A "\mfw-webadvisor.manifest" +A "\packages\auxiliary\reset_handler.luc", flags 0x4, number 1, extra bytes 20 in head, 48 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):936590
                                                                                                                                                                                                                                      Entropy (8bit):7.997351059282376
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:tPzcWKTytcy92IEMZN1YVMaA1eIQg/Qi2FvRho:tPzVKTyWyzEMZzYVMavIvELho
                                                                                                                                                                                                                                      MD5:0927B8B2CADAE4A10A45FB4AE65811DC
                                                                                                                                                                                                                                      SHA1:1B4894803F93009E0DCB1979ABA89B4DE74AFE15
                                                                                                                                                                                                                                      SHA-256:16733E6356B7EE58EB78FFBD53925FA305712C9BC524C2480E6D5B9B37533A76
                                                                                                                                                                                                                                      SHA-512:39928E91E95F1322D2989283EF55991D9111A490180BA2D0824EEEF5DE6AD3BEC768E13EA5C2D198E3E4DF98C39733B2851716F286CBFA16FEF393ACF5C8DB1B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D................................U...........1..0.............SW._ .\mfw-webadvisor.manifest...........SW._ .\packages\auxiliary\reset_handler.luc.e.........SW.Z .\packages\builtin\allow.png.....,.....SW.Z .\packages\builtin\balloon-arrow-right.png.....).....SW.Z .\packages\builtin\balloon-arrow.png..5..6 ....SW.Z .\packages\builtin\card_bg_image.png.....%V....SW.Z .\packages\builtin\celebration_white_bg_color.gif......Q....SW.Z .\packages\builtin\close.png.8....R....SW.Z .\packages\builtin\close_icon.png.T...%T....SW.Z .\packages\builtin\dialog-balloon-logo.png..I..yZ....SW.Z .\packages\builtin\enable_ext_guide_ss.png..R..d.....SW.Z .\packages\builtin\enable_ext_guide_wa.png.d4..@.....SW.Z .\packages\builtin\enable_sideloaded_ext_guide.png..8...+....SW.Z .\packages\builtin\keep_changes_guide.png.W...id....SW.Z .\packages\builtin\logomark_white.png......e....SW.Z .\packages\builtin\mcafee-logo-1.png.)....k....SW.Z .\packages\builtin\mcafee-wa-logo.png.EP...t....SW.Z .\p

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\mfw.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 295347 bytes, 54 files, at 0x44 +A "\mfw.manifest" +A "\core\class.luc", flags 0x4, number 1, extra bytes 20 in head, 32 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):317347
                                                                                                                                                                                                                                      Entropy (8bit):7.995080582141161
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:MwGiG6qjT+zS/pwIW2XFTKWmeprMTWbLJzWe2vh/ehYsgM5RA6JoCJSTfr422:N7G6q+zn5aYWbprYqLJCe2JW6hM5xoCx
                                                                                                                                                                                                                                      MD5:94C4D71DDA561624BBA345AD8FFED580
                                                                                                                                                                                                                                      SHA1:F6C9ECC1C418A82F75FC42F5BB727AFC3A7C746B
                                                                                                                                                                                                                                      SHA-256:A1A28B554B155EAE43329F216F05C1CEC8F5B91A39EA7487B19C8B2B2BB4B736
                                                                                                                                                                                                                                      SHA-512:C3EE2671C0267291474B970C7397B207887D1CBEA07377B0B5600EBD3CD8BDF1EF6760AAA101EA411B41300A07B54951C3F7558150A455D8B38FCE297D82473C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D...........6....................U..........3... .............SW._ .\mfw.manifest...........SW._ .\core\class.luc..'..H.....SW._ .\core\dkjson.luc.....82....SW._ .\core\handlers.luc......:....SW._ .\core\init.luc.....oD....SW._ .\core\json.luc......F....SW._ .\core\logger.luc.....*I....SW._ .\core\postinit.luc......L....SW._ .\core\priorityqueue.luc.....xQ....SW._ .\core\triggeracceptor.luc.P...TS....SW._ .\core\uiarbitratorhelper.luc......a....SW._ .\core\uihandler.luc.u...Rf....SW._ .\core\uithreadexithandler.luc..d...j....SW._ .\core\win32helper.luc...........SW._ .\core\utils\browserutils.luc.`...].....SW._ .\core\utils\common_utils.luc.c.........SW._ .\core\utils\packageutils.luc..... .....SW._ .\core\utils\settingsdb.luc.}.........SW._ .\core\utils\stringutils.luc...........SW._ .\core\utils\telemetry.luc.^...a.....SW.Z .\packages\builtin\green_check.png..>........SW.Z .\packages\builtin\icn_mshield.png......I....SW.Z .\packages\builtin\installer_background.png..l

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\resource.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):38888
                                                                                                                                                                                                                                      Entropy (8bit):6.344666762097508
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:EBr3M65hS2HiPvYumAMxkEVLpq41tuAMxkEW:Et3xzS4iGxNp31tcxK
                                                                                                                                                                                                                                      MD5:9FC3387AB7332BA77EC8EDAEAF67FFCB
                                                                                                                                                                                                                                      SHA1:9DFB79913911F0810357021026F72088138F4A44
                                                                                                                                                                                                                                      SHA-256:7E3BE8083094958386B39F4A2C2E0E7267065EF4D2D44495058B0E571D76A17D
                                                                                                                                                                                                                                      SHA-512:D758A43AD9FF77CF976C5C72AAC120D5BD361353295510312A2501D0E6D45BFCCBBDBAC8CCF99718C673CCE723D84281E6A64489FB92DD8981FB52DE2049AE07
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yj=.=.S.=.S.=.S..~..<.S..~Q.<.S.Rich=.S.................PE..L....k1e...........!.........>...............................................`......c.....@.......................................... ..\:...........@...W..............p............................................................................rdata..............................@..@.rsrc...\:... ...<..................@..@.....k1e........z................k1e.........................k1e........l................k1e............................................RSDS.{xU%..H.|5.+.s'....c:\jenkins\remoting\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb.......................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\resourcedll.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 31998 bytes, 3 files, at 0x44 +A "\resource.dll" +A "\resourcedll.manifest", flags 0x4, number 1, extra bytes 20 in head, 5 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):53998
                                                                                                                                                                                                                                      Entropy (8bit):7.919912822738636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:Sis5kAEnybrX1wvHu3g8U7jeWWtlkIQx7L6do32HiPvYmTZAMxkEGnpq41t/AMxM:SPkAQy/lwvt7JW3Pu34iRTBxmp31tfxM
                                                                                                                                                                                                                                      MD5:B182229CED974DD50A4CDF384D2C9D0B
                                                                                                                                                                                                                                      SHA1:EBFCE8B75FDEEB4E64BC5C3F9EB3245BA4A2266A
                                                                                                                                                                                                                                      SHA-256:1F4FE65A3D4EBC4C4DB02E91F5D3B8EA92A2BC45E25A8633260E8792D7BE799A
                                                                                                                                                                                                                                      SHA-512:4F0BADB6995269C9B4B20525F10DC43131784615A1F459D75C96023FB4B022ACEB5AC2AAD3B06EB871A6F99BD78F4F659336277D9E152A47007A61470CD5F62E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF.....|......D............................|...U...........................SW._ .\resource.dll..........SW._ .\resourcedll.manifest.4.........SW.Z .\webadvisor.ico....y.<..[.... w.q..@........m<{....D.7y...{....J..U. R%(R$.$*...N..$E.......8..~0......v...T.[. `$.......N.....7_d..Y.X..nj..Y..<.d.>..7.8.ki||+.mk|TS...b*y~x........._.$..t.. b.DD`TU...+.|.......Z*d..%`."..t....Q...g..Du.@G.AX..u..@`.w..O.....(../xyP....D.....qq..j@.w.V.gf.q.......}......7.6.l...........h.\h...b..T.0....{`.>..S....,..TcB.....4..>...X...G.4.(/w|c.....|.?..J......`..t...A^v... -.w}..z..->....j......\...?.u'r8F0............."4.!x9....!..Q!...@s..3hbP.P.d.K.>.7..0.*.*.q.....,.K..E..3@..C.c.;K.c..[..k..:....4/...1.".:..3..*.7*....j._ccq:]75D..C..v6%./..4>....n.ps..s......tdu...w...t.Pt-jmkr.b..B~..../.F.....K..B.....-......=.z.{... .WZ..Ny.....n.1....#...`.*.I........../.%...^.yw.....2Pa .P.A/.....d..3.aA.C..E.....>1lm.b......A......m......|Gi..*.yy...p..>.......azy.P....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\servicehost.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 291149 bytes, 2 files, at 0x44 +A "\servicehost.exe" +A "\servicehost.manifest", flags 0x4, number 1, extra bytes 20 in head, 28 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):313149
                                                                                                                                                                                                                                      Entropy (8bit):7.9960870127885775
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:6JhXKZw39cG3twDjK9Uo2o8Pb48++8WpU+3CN9nF4f:0aZw3913tkDDl3z8WSz6f
                                                                                                                                                                                                                                      MD5:5612671EA047C3822127208FF3D393BA
                                                                                                                                                                                                                                      SHA1:D575548A6B5C2607FC266269BF46EF7B89BFA209
                                                                                                                                                                                                                                      SHA-256:CE830C787B162732C718DCF7399DE12D8D109BC9E568DE3E0663675E7A42F6E6
                                                                                                                                                                                                                                      SHA-512:377286C251026795F6891D3701F9FA617C1CC34D3E6C967228979125EF9C2D9B80BFE045E52512B7AEBC5362AE1C9A9A36DD03005933B00144299BAAB7E464E3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF....Mq......D...........................Mq...U...................u........SW.^ .\servicehost.exe......u....SW._ .\servicehost.manifest..N].....[.... H....R.4".....m..]1...D...6.W..;5K.i....i..v..VW.....v.\e/.`v.HZN...y|...2N./.Q.#; .#.g4VU...`..y{sg.9._...~/?.D....P,.\r.. ..i....X.-....d[..(!...IA.h!f..Q....B.... F..t.......P.]...5....p.....w+...h*.x..IR......1=..=.....,......U.m @.R.O....+..=..E}.U....,....u..A....Wv?+...o.......d....Nw....]..W;J..........M.d.{N.~q.D.o..?..!O..a.M.Do...n..w.08.b.r..j...{.......W{....^...#..a.X..~$.Pp...=....Y|......r..._v..o.......>.~.........).Iv.=..k..{..........d.3.oZ_o..C.......*&R..5}...|.....jo9..........S2..s.X?>sWN.|.B./.....V..~u..2.A.c........U...lkD........3..D>..+EW.#k.].?../.l...x....l.|....(.Xv....~.w......k4...j..-..A..[..o.....)C.?...ud.......Y...........".9.~....-Y....x..........dd.....Q[?..Y,L.L.#...*....7....{A$.^M.....B....W...........<k... .2.,kW....wi@...".M.......W.:L=.:){Q..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\settingmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 858839 bytes, 2 files, at 0x44 +A "\settingmanager.dll" +A "\settingmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):880839
                                                                                                                                                                                                                                      Entropy (8bit):7.999427454798419
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:ntRLJiUu5JYJEsCuVV4pD+U/VpBQf775UR:n7LJnEsCk21d/Vgj7yR
                                                                                                                                                                                                                                      MD5:19647CE69AA4B694E2771A182A5151C3
                                                                                                                                                                                                                                      SHA1:AA9063652BC38BEEF7F382F75BEC0B512C18C845
                                                                                                                                                                                                                                      SHA-256:A0D70CD5C72B0B30CFEC2DA7569E417A0C0E7245291C3A5360587866EC0173A8
                                                                                                                                                                                                                                      SHA-512:51C0E9930F1234BF78DDEE8151855CFBF8847F7336B175891AE8D8FDDFB606A36C0074F82898B5C8761D9340971DAFA2C05BF95AC7AF7457747AD7B10B070257
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D................................U..............D... .!.......SW.^ .\settingmanager.dll..... .!...SW._ .\settingmanager.manifest...T.....[.... .....@d.5.....V.A.L[+.4^w.w..c.p.-8....X._.-.;...0n....r.;.#..i.......mUjXc#.........X..<..~.............d.L......V.@.k.m+2;A..2.P.dV...C....0.e...X(.cd.P.......(.N<..a.........H.....{.....s.U(l$.! ..@.u.%.....$:.u..=.t.f.B^}<.f.f.L."^...d...Y.[;~..2.M6.......*.S_.]......N...=.7/......../R.}...o.5....t...w...Y./~....b.L....c......W/...=y...3|.....C..9.~.a.0kzZo;.........gR..3..../........P......./.V=....u..s.e..u^......-.O...[.4....E....f....m.l.B>^I.<....i?.^..n.}..7.....4H'.....h...#.......\.J..y-=.__.r.....v.._h. 1..$...m.....w.W.?~..K..f.}..oo..o.v....../me.q.^..}.......q2.'-*S.....>xS..q...N.........w.....a..k7..Q...F.).Y8.^.O.nt..e..?..<x........X..~.s........2.H6.1....5\.-..O.\4.......q...~....Y.Z..Y.m.d...............^.u..>X=.Y..[.jR.............$.^..n...Q...a.........pwx.OBo&..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\taskmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 1355431 bytes, 2 files, at 0x44 +A "\taskmanager.dll" +A "\taskmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 126 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1377431
                                                                                                                                                                                                                                      Entropy (8bit):7.999544124187063
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:qrxkLyANS3bkj3UYZqzhn+OJVJtL0vGVdj5G2Mi6BcMuvIXd/PpmVyDEZ+PZGK:qNkLNObE6n9JVJt8Gjj5GW6Huv+dnpm0
                                                                                                                                                                                                                                      MD5:A749E4229060DAF3181DB8B3BDB48A09
                                                                                                                                                                                                                                      SHA1:EFBCF90D3E3470350F906353749D5CBDBA085C79
                                                                                                                                                                                                                                      SHA-256:8ABFAA7FA12ED325AB48628B3E089D128381545A3A14E8E507F4DA41EEFB3D88
                                                                                                                                                                                                                                      SHA-512:4528CB6225B8100C1E633A5BC2664AF21D2685178F2FC3BE11D56F562520015D2D3173410140ACC13518DAAA57D1FDB0D0BE1004BAB0CFBB2847236745F5F392
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D................................U..............~.....>.......SW._ .\taskmanager.dll.@.....>...SW._ .\taskmanager.manifest.........[...E .D...@R.5.............v.dLv0n8..ej....a.d...d..9.ae:.j.S..-.;.\........dG....y....T.U\..5.......}.....I...[.F.U./HH.-WW...q.f&.c[....H.7.....)I.Z..P6.:4...W.J...7....T.T...~.,...B../x" .<..D...%....4.U4`5wP.E....N..I#'.-.h..T[...(=...`q....^.....FYc...^9...p..D.x...m..N../.Q.....6.NId.|.-...y..NJ.J.ne=c6q...n}.W..v.;..-g..K......M..7n...^......zO.?..n..S...c........lL]_..s^Gj9.(.7.v..b.o..~c.....Fm..bd~...!.j...........Z....D....o..W.~.U...:*8I..x..~....~..... .....oX....l.}..r_|..2)*.o0.s.....#...Ra..d...G.~.o...y.%...._......?yy.'_........1...o.n..E.'...z.?K..5.a2O.6....~.gM..a...._l.sr...o.^y.BU.{.k..U.c..w[.._7.Y......{_G.........|<...-..~./..O^z...soI.[.).-...};x........4W.T.a.Awx...^..PQ.>z..Oz.=u..~w.'.......C......~.3.........z1..8p.o.P..N..Sm.=.;2.S...[......G.w...6...g.0..g.a..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\telemetry.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 69888 bytes, 123 files, at 0x44 +A "\telemetry.manifest" +A "\dimensions\dimensionconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):91888
                                                                                                                                                                                                                                      Entropy (8bit):7.922281166531392
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:nldBqCdB/UFv9iuO/BwDMnTX2rt+IOguWBvfgoMyfS14ioGx5Op31tmlxMg:nld5B/UfqTmh+pjW5Y3yf84xRg
                                                                                                                                                                                                                                      MD5:5E210B6385D6CF0D469C1F6B9F34EB1E
                                                                                                                                                                                                                                      SHA1:9E61166A27F70C54E06340B6A3301D17FDD93112
                                                                                                                                                                                                                                      SHA-256:29DF965DA8DEF7ECBA6669188E6460A14038762AD98E22FE687258C4FF006529
                                                                                                                                                                                                                                      SHA-512:5911A1E28BDD5F0B7E274501423D1495FC9A0AE917758095E9BF2912ABB4EB7B495A385975DC044F45F568D1921889BBC5CACACAAA3099C9E1FE9F5EA8B03571
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF............D...........{....................U..................@.........SW._ .\telemetry.manifest..\..@.....SW.[ .\dimensions\dimensionconfig.luc......h....SW.[ .\dimensions\dimensionhandler.luc......j....SW.[ .\dimensions\dimensionprocessor.luc......p....SW._ .\dimensions\version.luc......q....SW.[ .\events\eventformatter.luc.....Tw....SW.[ .\events\eventhandler.luc.....h.....SW.[ .\events\eventtransmitter.luc.....j.....SW.[ .\events\handleonnavigate.luc...........SW.[ .\events\sendonping.luc..g........SW.[ .\events\telemetryconfig.luc.....K.....SW.[ .\events\telemetryhandler.luc.....E.....SW._ .\events\version.luc.....0.....SW._ .\serializers\download_scan_ui.js.....0.....SW._ .\serializers\edgeonboarding.js...........SW.[ .\serializers\edgeonboarding.luc.<.........SW._ .\serializers\edgesecuresearchonboarding.js...........SW.[ .\serializers\edgesecuresearchonboarding.luc.,.........SW._ .\serializers\extensioninstallationtoast.js.]...!.....SW._ .\serializers\fw_av_warning.js...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\uihost.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 285929 bytes, 2 files, at 0x44 +A "\uihost.exe" +A "\uihost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):307929
                                                                                                                                                                                                                                      Entropy (8bit):7.996513692611283
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:Wnp+VXhNiQZ2zDA67IFcIvnYZxUn4qMbCtU5C4Zm:qpuXhNCzDA6wnYZxUn4qMmULZm
                                                                                                                                                                                                                                      MD5:8DD7B2952CC7A3A5EB8F1AC3E8B30215
                                                                                                                                                                                                                                      SHA1:39AD040718F144B92BA57D4D8FAE1C3086D67BBB
                                                                                                                                                                                                                                      SHA-256:B9EC5CF56F89263A2F1EE10D0F7A09525A988C3BC636F6819BF5191D00A35EC3
                                                                                                                                                                                                                                      SHA-512:4CB56D69A3C50BF34F87CA6BC378AF52004BB2F65A31360389D7F4D4AD04146A528FD856BA84FF3B65342F1D62A2E147C06B9EB90E482389C0927496AC45BD2E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF.....\......D............................\...U............................SW._ .\uihost.exe.-.........SW._ .\uihost.manifest..,3.V...[.... .&...@R.4".....n...jk.5.Lm..T.g.Z..t...6R....T2..EX.^./.7#o.....)......QL.....A.U.Q!V6@\F..h......s.y.5.......t}. .k..,......D.U.%f2`[.21.....%.FJ.@.B..J0...PKR.......}.}"..... .........B.....d...[f..T.hQ..{..1..x.t.....t.zo.d{.Sk.h.XX.@.lbk....l.>mdF.tX....}o..Z.-.A.}g.......%E....%...-.31.%.s{.p.F...s.;...g.S....y..5f......J...n.p.f.......)'........Z.v.{.r..m.........L...Ove!.79A.3..w..8...{....=....M{..%...g...Z.yw..........^:.....;....VS..9.........Dn..m..z>..c....Y..Ac..z.mO.._?..z'.I....6K..._..k..>~..=..{z.E|%......._....h..7...;...E.......A....,..m?t.'@......~.M7`....>:......s..z.?{..._.-....JKe.|`.sv=*.4h.:eA.....x{=.{..}w...k.......6.....y~...S/f.x..'......kn...l....q^?..[..k...h6....l.......z.....~...M. g...<p[.o...x{.>....'.+.e..-;. ..]._..q.2.A...fK....6..l.5......My......8N.V.....'\.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\uimanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 1751629 bytes, 2 files, at 0x44 +A "\uimanager.dll" +A "\uimanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 167 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1773629
                                                                                                                                                                                                                                      Entropy (8bit):7.999595046383415
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:bUl6tnb++OYwLammut7SK0i4Ar675EsY7m/l9ML6r:bBnbUYwLaNutIi4aegKd8A
                                                                                                                                                                                                                                      MD5:47E1D0B80A30A92E69B82399CA89121A
                                                                                                                                                                                                                                      SHA1:4DB660A2DF048015754FA9C107986B1FF460C00A
                                                                                                                                                                                                                                      SHA-256:7B476E41FA265A84630CA0C806684DEDE107DC09143695385CCB426879845333
                                                                                                                                                                                                                                      SHA-512:67AA7519763A394E73D66A0D03264F1C8B353BC72D72E7524A9AEB2C85F8F4D44C86617A689FF6BCD618450BEA8E27FD1C9521367FAFBEB89250EAD3B163BC30
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF....M.......D...........................M....U...................)S.......SW._ .\uimanager.dll.)....)S...SW._ .\uimanager.manifest...jM.3..[......X.."c`$..n...Y..{.P@C.A%*...e..i..d.....+A....+u...gyl..1A.;..~....we"..5......Za^F.034W2..`...o...Y.&g.M..4.A.MjFb..pSs....d...M..5......@[.4& c."G....d...k#Af.lF....&$.............*....l...yx..&T...$....a].w...c...E......b1.vB.S...|...+`..w..w.r..k..^...zKj..7...K.V..t|.Z2V.Y.....5{...CS.s<wZT.mr.{.Z..p}.[..s'[ruR[|u.*..".-...YltA.4."._.?..&G.8.F>I.....P.x..(.-....n.|.8.n'...}}n...Y.]}.4l.._......we.+T.5.h..g....p%...(.x...4w.P%.x.......H?Z^.Q..>>H...!......~.......M3...V......K.f...l...q~*{.^.....h..f..."....._..Vk6.I..I.H=..<K......Ky9%.z%e.eU$7'\a.k.\.'_...I.I..QV.v....$E@S2...r..W...X....i..nK..r.k..=..B.....r.-..u.O_^.^X..y.u...=...h9F;?.|...S5......a.9.##q..T.we..8..x.R.......!W-.$]..*.;...ee...b....OS..*Q'...E...Q.Ox.<.U.8.i+.......?~....f.A4.p2..G.9....a.R..5<H+.D.."U.%...|%8|....{.*.=...G

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\uninstaller.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 896328 bytes, 5 files, at 0x44 +A "\uninstaller.exe" +A "\uninstaller.manifest", flags 0x4, number 1, extra bytes 20 in head, 78 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):918328
                                                                                                                                                                                                                                      Entropy (8bit):7.99935092902814
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:ld3svCfMqwCoOPV98+Iaxm8Y+nvSL7LVzONM:z3sv5qGrYmMv67LViNM
                                                                                                                                                                                                                                      MD5:73AF0159DBD92E6039AE1D86B84F312D
                                                                                                                                                                                                                                      SHA1:F69A327A885DEEED29AF60FF26F382C4AC4F2DF5
                                                                                                                                                                                                                                      SHA-256:4D8CCE57584B25B71EC547958E84E95954090644CCE0C7284243DB5E5EA48DE0
                                                                                                                                                                                                                                      SHA-512:D001C8A65C8A7FF09220DAE89DEBE0E07EAAB3A2C36542ABC0A735AB6AD615321BB4869A075C6735A16606383C38023B7D824F9FE3F5BF113220B1E7DFFADAC5
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF....H.......D...........................H....U..............N...@E&.......SW._ .\uninstaller.exe.u...@E&...SW._ .\uninstaller.manifest..'...W&...SW._ .\wa-ui-uninstall.js.......&...SW._ .\wa-uninstall.css.......&...SW._ .\wa-uninstall.html......,..[... .......4...........*.Y.l......K..KvS.Z.KQXm.bl.........aka..d."i.b..QX.@,f..f..........._.N.{w1.1s.).D........[Z1....n....6.......TI.,.;.jl,...9e.I.ZK.q$.i,Z(..,F3..0...`...&zH/................AA?.{.L.1...9n..v...T.T....E.-...E.Q..i..V..Y...^Y..v..ES....((.c_..h..aOrL....>...1N6..[.\`7.+.n.o.f... ....r...\..{`s|..n......./.7%-c.....c..y.8o....l/.\2.D.!....,c|.9..ay.`...y.z.Y.A.@...Q~.....v.v./......$\x..(......sM.:.W......;...5C...J.-....d.*...5.P3.h.._O.Yb..)..............Tk....W.v.&..e_....?..B.....*&........v.`...P..~....C.r....a...........%..[.:...D...........S|*....s.-.Zm. ..j...[.....yH.z.......uK....V.C0.z....G.Fs..........W.=...^.T....i.V....~..o.V...\.n..O,}...2u.......x.......l....G

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\updater.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 855441 bytes, 2 files, at 0x44 +A "\updater.exe" +A "\updater.manifest", flags 0x4, number 1, extra bytes 20 in head, 77 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):877441
                                                                                                                                                                                                                                      Entropy (8bit):7.999306815127104
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:yYAnl70cOcfMZSej3ekw7ZUtbKfOkdxgPVbzV2xDx3Z:yLKcuSqbNkdKNMNlZ
                                                                                                                                                                                                                                      MD5:15E28F4C08E79950B8534200C09E5F37
                                                                                                                                                                                                                                      SHA1:CAD828D2B815EDBC916382F68FB6EFE810D0EB49
                                                                                                                                                                                                                                      SHA-256:CD5920D44F5A5663B556098836F04D932769AA86E96129816FF63D0802CE2BBC
                                                                                                                                                                                                                                      SHA-512:80CEF52CE5A4A98EED6AEE65B5555F84AA97EF5431100CCEC33C0B96713F12F0875A4F54C2E7F7E29C343F3DBABEE44B1747DDC158001F182524287E27353007
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D................................U..............M....M&.......SW._ .\updater.exe......M&...SW._ .\updater.manifest......*..[.... ......d.5......m.ZV.........,..B.R...R.HR.[..K.C.m.......q..q;.a6.t..v.....Zl...!3..23.~?.w.9......w.f..'.2iE...l#.3O.B.c......fC7.$..Bw:K.6...-......WP. ".v..TP.([....T&b.&.Z.m..9..cM,.3KY......Dh.f........~$../..7.y..P)M.@.......lQ.....N@K.,...5...*._f.7....YfU..~.{..J.'...s...,=..y.....=.g....}.k..k.}+...=..x\.o{..E<.N../.:.....t.&.J.&...,.fS..I....t.....)}.#......go...i.c...H.c...b.H.....H.F....I...i.1q6._s(...W...H.myO...3...].e7.l...J......i{.fH.q^u:..=,'..l.Y..6.g...%.R.t....-4+...?....C|7{........mB.>.....?..S..R.Y.<...z..#.......fX..cG..W......o.O....1...l.6..w.....h....J.......f|.i....N..a*_.....^g.9.1.K.e..{...;...T.6Y..y.|.Z...W.....zl...z{...oU[-..}._..i/..t..........e.....~.+..tHmM{...oJkfM....l..`....ak8...>..K.%....,..z.nx.....F..m.....@8....6..s.v.>g.j.........-...-Z

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-common.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (33246), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):34082
                                                                                                                                                                                                                                      Entropy (8bit):6.048810099348607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZW:E9DDI6thXjez1jtn9
                                                                                                                                                                                                                                      MD5:BED2FF23927C34F86C480203AA7F87A0
                                                                                                                                                                                                                                      SHA1:90B1B32D7A9CEECCD555D674582CB8AEE64E8909
                                                                                                                                                                                                                                      SHA-256:9D7AC9A5AE897E993C0B6BAD468F56BF3B6CEFCFEAAD6FD2307CF8370945A2C2
                                                                                                                                                                                                                                      SHA-512:6538FEDBC2DCE5EAF944CBD18F93783CDBFDC2920726A3509D0686BD062793B422AE6C6F67DFB0C344AC3E084F8B1F10425FA4636D1BA0FBD9E2ACE86EA6AE83
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-core.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26073
                                                                                                                                                                                                                                      Entropy (8bit):4.774476579925344
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:J+6T4vNmgN8t0+yycVCI6z0jG7RMDX4WUMRmvm/W:IDIy+
                                                                                                                                                                                                                                      MD5:4C7B6F8674B7AB6F82D336DDA5EA7458
                                                                                                                                                                                                                                      SHA1:273346C8B26F0804D5D4AD8DB1382A2775FCB230
                                                                                                                                                                                                                                      SHA-256:7D6298561E441CF79CE9B698D1040FC19460E1AF44EA1216AA27E662247895C1
                                                                                                                                                                                                                                      SHA-512:58DDD8819F40D37BDD1236DC7C2CCAA28666C3DD84DE24F7C6A3F8B590AAFEEAF66AD609B3DFE97C452C19AAC0E6FA455FC1C2710BAE58B59AC017C27139B9F6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Core */..(function (wa) {.. var core = wa.Core = wa.Core || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key || this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-install.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5549
                                                                                                                                                                                                                                      Entropy (8bit):4.066110247641768
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Uji+oLbHInScwC0oljdaLDb2nD6nu7aabv5k/yigIAMvda0hS/iS:rbonScwC0olMLDb2nD6nupbv5TbIAMc5
                                                                                                                                                                                                                                      MD5:F537A07AE7D570F52EE50643365B1FC9
                                                                                                                                                                                                                                      SHA1:F3EB5BF057F2F981123FEBFCC568741E4E0F8FFB
                                                                                                                                                                                                                                      SHA-256:2518B71F18A08AF85F79A3947C975A098346346750F0136891279B803F369529
                                                                                                                                                                                                                                      SHA-512:1DCA227E358932ADEE77011F3E0A949E20A402FE99AA71B204A2E1936EF9C159D8DDB39F1DD36E2A974369232CA59D703334833DAE72F2DEEF12C8EC48553F0E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. background-color: #ffffff;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....img {.. -ms-interpolation-mode: bicubic;..}....#wa-installer {.. width: 455px;.. height: 378px;.. border: solid 1px #BBC7E7;..}.... #wa-installer .header {.. height: 50px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: solid 1px #BBC7E7;.. }.... #wa-installer .header > div {.. display: table-cell;.. }.... #wa-installer .header .title {.. padding-left: 15px;.. vertical-align: middle;.. }.... #wa-installer .header .close .button img {.. float: right;.. position: relative;.. vertical-align: top;.. padding: 4px;.. cursor: pointer;.. }.... #wa-installer .header .close .button {.. float: right;.. position: relative;.. top: 2px;..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-install.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1222
                                                                                                                                                                                                                                      Entropy (8bit):5.1935835170409215
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:csYR7A2NVMz71Mz7FMzrVMzPVMz6LVMCo7jpSZvF5aB:3C7A2meCeiCoH4V7aB
                                                                                                                                                                                                                                      MD5:52675F42F15FEF49BD83972DFB0BF87A
                                                                                                                                                                                                                                      SHA1:4582F2C4B969F278E341B2291690817E042F9568
                                                                                                                                                                                                                                      SHA-256:97D5EBA4BCD228D7F99F1E132DA57AD12F1AEDFA8C883CFE89E3CFD2787B6429
                                                                                                                                                                                                                                      SHA-512:1AE4D696542E48D279342F8846488CC3D2E42094310F7DD9DDC6CA1A0BE14D1F8DA96CB3A9108B82DBED990C19204E4B12EF25BD2C222AF82435B2771B553A59
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-install.css" />.. <script type="text/javascript" src="wacore:jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-install-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:wa-utils.js"></script>.. <script type="text/javascript" src="wacore:wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-install.js"></script>..</head>..<body onselectstart="return false">.. <div id="wa-installer">.. <div class="header">.. </div>.. <div class="content">..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-ui-install.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19389
                                                                                                                                                                                                                                      Entropy (8bit):3.84079067044455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:GVtiO2qyGuMW2FnrjPfGUfsdd5nwwCbvlOzNZLXQDCR1ZgpNW:GVXyRMBbPzCR1QW
                                                                                                                                                                                                                                      MD5:013999C3E34A01093530CB57DFAA82AB
                                                                                                                                                                                                                                      SHA1:1A596422E65CF0D6E725432D90DE2FFC01BF0E83
                                                                                                                                                                                                                                      SHA-256:5F34A5F6E926F8A15029FC82B975123CBCEDC3E6C799CDBCFC8CF6EF7136A8AA
                                                                                                                                                                                                                                      SHA-512:25D8E78297EEC091E85C93E538A58A6A5A4633250C95564CB51DA15523A7FB9644AB3EBE0E541B9621C0D2FDC7E4CACBD6518FB439E7EEBC71DB8D015B8118AB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Installer UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.INSTALL).get,.. _window = wa.Core.Window,.. _external = window.external;.... ui.Installer = function () {.. var buttonId = "wa-installer-button",.. _this = this,.. RC_INSTALL_ERROR = -1,.. RC_INSTALL_DOWNGRADE = -2,.... open = function () {.. _window.ready(function () {.. //check preconditions.. var productName = wa.Core.WebAdvisor.getProductName();.. if (!_external.CheckDoWeMeetOSRequirements()) {.. _external.SetInstallResult(RC_INSTALL_ERROR);.. _external.ShowMessageBox(_l("ERROR_TITLE_CANT_CONTINUE"),.. _l("ERROR_OS_REQUIREMENTS"));.. _instrument.log("Installer",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa-utils.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15448
                                                                                                                                                                                                                                      Entropy (8bit):4.445434608553055
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:BZwBjyfDzRj5csy4h11lidEaCaNz46UcEm7dO2qSFZC9OQ/KTeV:Wefpj5csy4DIE3oU6Um8CTE
                                                                                                                                                                                                                                      MD5:D83DA2A43B7160E76863E4D73A390C68
                                                                                                                                                                                                                                      SHA1:0C93A9B7CD8290C536ACFB1C98B86B2DB5A15FB7
                                                                                                                                                                                                                                      SHA-256:5D47BA4710B8DE34145DF1732FDEE9A5E7EB016322AD50DA1CCF56A21BCA752F
                                                                                                                                                                                                                                      SHA-512:0ECAACEBD247AEBB320CC96199B24F40EBACA6B9704F877069A97D1233F47CCF9528B1DC71EE568FBFB90C7DA91149586DC67A73CCE3451B2C5B4BE3367A6107
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_install_check.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):558
                                                                                                                                                                                                                                      Entropy (8bit):7.494810764492959
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7iIHftwTmWkW3O+xbR/GfmNFycqV7o5jNiXrj0IGDfjo/1:zT5+aVefmORm8bnGD09
                                                                                                                                                                                                                                      MD5:F8AF1796D709A69C3FBDD16822596FD6
                                                                                                                                                                                                                                      SHA1:D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
                                                                                                                                                                                                                                      SHA-256:055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
                                                                                                                                                                                                                                      SHA-512:FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_install_check2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):785
                                                                                                                                                                                                                                      Entropy (8bit):6.380231936591206
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:nmwBSRPy8iSvgv+aYS0NFVO/6cgDHNUPZ7SCOr2zhxNoEMBxNB:mwBSRVL4v+/jNFVO/6cgDHWhbOKHCEIj
                                                                                                                                                                                                                                      MD5:5367B11C1B0484E2B64AFFF761DB5B69
                                                                                                                                                                                                                                      SHA1:CA05EC2A55FAB6A4035920C38B6FF198044DA594
                                                                                                                                                                                                                                      SHA-256:1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
                                                                                                                                                                                                                                      SHA-512:322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_install_close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):327
                                                                                                                                                                                                                                      Entropy (8bit):7.1140535970703365
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPIcWn2ofLbzmoGGaKdwjXI76l4AXT8ctmzXxNuJpTqAp:6v/7DWn3btahecDAuJp1
                                                                                                                                                                                                                                      MD5:C0708D1E58F1EF1BAB621620F3B09130
                                                                                                                                                                                                                                      SHA1:0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
                                                                                                                                                                                                                                      SHA-256:834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
                                                                                                                                                                                                                                      SHA-512:241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_install_close2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                                      Entropy (8bit):6.591404605834916
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPIcE/6TsR/nQV32e46OIoiMr6FRK7MhtCxllbp:6v/7DE/6Ts/nnPIcr6+ozCjz
                                                                                                                                                                                                                                      MD5:F79A1953A8E6CC342847B4B00DDBD736
                                                                                                                                                                                                                                      SHA1:9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
                                                                                                                                                                                                                                      SHA-256:4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
                                                                                                                                                                                                                                      SHA-512:DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_install_error.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                                                      Entropy (8bit):7.367179920202989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7iIHbGI9XbxzlcdqzUCOXC5pC38WWn9:eGIrzlcdL4CZW9
                                                                                                                                                                                                                                      MD5:0EF65600F5A2D01876B6F9EC668C9D2E
                                                                                                                                                                                                                                      SHA1:31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
                                                                                                                                                                                                                                      SHA-256:17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
                                                                                                                                                                                                                                      SHA-512:7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 233 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5361
                                                                                                                                                                                                                                      Entropy (8bit):7.956335361585333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:tXYxwio7C2guemm5poLpMmjxiN4f7DsCk7RkuxKBaKeVfGJiQmiMQ2qileA2I:toxpo9gKmsMmjwSXgyLBepQblA2I
                                                                                                                                                                                                                                      MD5:0D8F8EFEB474FC9B2C825D7F2A875471
                                                                                                                                                                                                                                      SHA1:ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
                                                                                                                                                                                                                                      SHA-256:ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
                                                                                                                                                                                                                                      SHA-512:90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z*#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3.*.9+... ].4.Y.2.....r>hM....}..-..|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wa_logo2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 232 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2938
                                                                                                                                                                                                                                      Entropy (8bit):7.909981061900822
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:nv/69bTJ0Ji4hnEhRHzXJH3ndGzDr9zHUeqr7zpiT7efEgo3cRE0+U9sLBCYv2ZG:vSdJN7HziDr3S9i/efLQcRZ9sowGdK
                                                                                                                                                                                                                                      MD5:65938FC9439B2307513A95D515BCA1F7
                                                                                                                                                                                                                                      SHA1:DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
                                                                                                                                                                                                                                      SHA-256:B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
                                                                                                                                                                                                                                      SHA-512:93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe*.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...|.|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C*..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wataskmanager.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 2942853 bytes, 3 files, at 0x44 +A "\microsoftedgewebview2setup.exe" +A "\wataskmanager.dll", flags 0x4, number 1, extra bytes 20 in head, 170 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2964853
                                                                                                                                                                                                                                      Entropy (8bit):7.999835391713119
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:jy3xnx08sXqiQVLyAQ6l7xcha+PVhtnZICOkvkEMC1zF5StAx0NDYG4hOJVQijYW:Wpx08sXRzH6l7xktakcE71zF5x0N0G4i
                                                                                                                                                                                                                                      MD5:A9120CBCA8A683E101E61BD787A3355B
                                                                                                                                                                                                                                      SHA1:E0D8376ED24F95110CDB08E3A075243F25ACE126
                                                                                                                                                                                                                                      SHA-256:AD79E799C810DF7822C525E0091FFBB82C195D48715E51C41FE7216851373598
                                                                                                                                                                                                                                      SHA-512:4FA6D8DB590CE8319F6735D9A84AF00C529BF019A1084B5FBF6D02C7C0AA13ADB2C835E17E792EF41A3AE31743D03D4D16BBC080B4E1E704A7280D145633F0D9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF......,.....D.............................,..U.................. ?........SW.^ .\microsoftedgewebview2setup.exe.X.9. ?....SW._ .\wataskmanager.dll.Q...x.T...SW._ .\wataskmanager.manifest......I..[........."S`$..........XY.....$.$B9f.....0`..u$.*.V..w..g;`.......l.........d*<.*......@H..E..F..h....m.l.m...sy;3...r.....g....~.....ml..<hm.......@y.`7m66..-Vp...[Xm......b..`...Zq..7...f.....71K4..\......#.TD.U.E.{{..f..]...BeD0 d"...t@@..A....pr....B0"`Qy.rS..>a.5..@..u...*n...D....7..W+=.W.h.~.[?..SQ}o..I4....*.....vQo..w.K.O.Uj./......Q.?....T.^...l..'P........>.1....-....../...~....y=.~e....c...nVX./..U....4.o....T..O.....;..R..!..`.{l.....Cr.?.7:.Q.....+5.....>Z...,j.|.....-..L..+0.<L}..Ecc...V9s.kq..u.8.KUb...7.w..l..d?..`....K..+Kc.h.=F...~...\...\F.....j3.<.g..r.4.\zO..v.-..;..:.\..wdH&....AU...z.....0W\ X.'5W.J`>...z.......}..dr.."...*V....H.EI..[.A`.$[.fS ...z...^.Ez.....9..h..'.....6../.ut..(.c....0.b*.....'.dz0.!.`.....F~Z.....y.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\webadvisor.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, single, 1209 bytes, 1 file, at 0x44 +A "\webadvisor.manifest", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23209
                                                                                                                                                                                                                                      Entropy (8bit):7.660058320276064
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:E+Vj6ki2HPviQUDvYzhqDAM+o/8E9VF0Ny7LVKNSCpq6Z1tCAM+o/8E9VF0Nyq3N:EAu2HiPvY9oAMxkEtQpq41tCAMxkErE
                                                                                                                                                                                                                                      MD5:F3C3AC8816B1DC7C05278A3E891A24E3
                                                                                                                                                                                                                                      SHA1:C39A727DEF7B1527A0F58000F5EF56865AB2A4F5
                                                                                                                                                                                                                                      SHA-256:FE007A4744205AA6E37BB57F09573DE20AC86E1DD0FC42C895DD31EE19317958
                                                                                                                                                                                                                                      SHA-512:241E4B5308CA6230D9BD010AC9CC06F384F47355F178622EC4FDE01A764980E3108EEE602C6862F46E93309A0EE1DA1EF099B586A41350A9615C4E2BE6C87AA8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:MSCF............D................................U..........i.................SW._ .\webadvisor.manifest.:..SH...[......K..3.%C...v@...N%.... P.../\..f....m_.S/.n..)..p..@............m.m.w.7./|..g....>w.....;.0.FoFp.6j$3c5..!W..............T2...e[.=..2E.M..t4MC.8.....:..fdx..V.j...z:u.t.J...h5....l..2.u,.`0..j....^...w...U..r...*..n.}.S...J......B.....w%o.CT...a&.FjG.9.a.....9.G..."...\..j2.s..L..0......F1D.S/.n...^<.x..5V.........QeFh...loZ6..K....E4.......Z.X.`..@...o...}.....X.. .....l....vv..>\......a;..".....k......G.0..n".P.. 5C..Qw.5{...N......1.8...tOw=./@G....L......n....0.l.U[Y%Z.`...7.i.>.Z.e8j.].A.z..Z.a.=...Zp......:.h......bS.&.-......e....w..%..v,.=.U.X..@...Lb..n.'...o.+.|...F;:..jJ.(....-.....&.{|;..|...Ly..jZ.E..;7.....H[....vF.>........;.(..[].c.s..:......<...+.cQ!.sY......t.1....z_...h..;.5vX..o................~......& ..Up..`.(......C.$..+u..5...OxqIT...f....t..1.i...0;.......C`.1......pj...n../8.(C.y]._H0Bf..C.G@.xt...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\webadvisor.ico

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 11 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):99892
                                                                                                                                                                                                                                      Entropy (8bit):3.9749743269785345
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:JLBqG5eVRjB/jZRj0t4kgU1l50AIDP88+2Y:JLBh5eWgU1B8+2Y
                                                                                                                                                                                                                                      MD5:236FC5ABB597615A608DAB7BE98D5FBC
                                                                                                                                                                                                                                      SHA1:18D3D1CF56898B264A24DE24DC13E4B9B7EED768
                                                                                                                                                                                                                                      SHA-256:06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
                                                                                                                                                                                                                                      SHA-512:155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\Temp3848859477\wssdep.cab

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 581039 bytes, 3 files, at 0x44 +A "\wssdep.manifest" +A "\win32\wssdep.dll", flags 0x4, number 1, extra bytes 20 in head, 46 datablocks, 0x1503 compression
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):603039
                                                                                                                                                                                                                                      Entropy (8bit):7.998659373142574
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:hf9tuG0WZPhmWvaKKXCGqnYN7XtaErgT0UOQ6WpLUti7FLaxlx0ex+yi:J4uhmXSGq80PT3LUtSWXJx/i
                                                                                                                                                                                                                                      MD5:24080993552AFF33FD59C7C8D23DD3F8
                                                                                                                                                                                                                                      SHA1:EEC0A5CFFC8FC701D6338A67B6B1968843DDDBE3
                                                                                                                                                                                                                                      SHA-256:922F51C14ADD9EDDEB7A1B86F82C269DE96AE7E1F3D3626D632D611AD2771C59
                                                                                                                                                                                                                                      SHA-512:A36B0F8B38CC25420A67A5BCE55FF0962FEAAFFA4FEA259EA027DC91714A1D24E26DE3C3C6197E418A72D77E5A0A4C6D5CA3563928683E6E35A19B93180BDE55
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MSCF............D................................U............................SW._ .\wssdep.manifest...........BV.h .\win32\wssdep.dll......$....BV.h .\x64\wssdep.dll...q.<..[...4. ..."C`3..[....]..4*.....F*-.Ck..j...F$`Y.AHe.5G...C..O.;..w.......%.e.D..2HHF5..1..jg.Sf6".p.....}T?.y_.w..|...8.:.u.s....o..;.d.....r%.}...K...;..%R...o..-..f..B(....(Y......IC......E.d-i..'$.....!......".3?+.....y.}..z.5..Yko..Y..e#.#.....B....p..H.....x. b.......q...?...*..'t.Lb..A.z$*..>}S.3..iu.L.$..h.?...].;...%.Qy..}.d%6.=K.T.S..F....?.Qi/=...^l...4..h..z..ZE......Z.-F\T.T.[f.%.P.[...v.W..n[..X....[.zl.H. :.H..]=........o...|...s...@...D$.t..o.S...=..PK.....7...}.f6.L..nm..r..J.y.....U2..wr..t.C%..{.Z.V.8..U.b.ku...7I\..V.".[Q.OvFQ.K].9..&]t.i.7..^.-..O.d]3.p*.WD7 ./..DjO.]......[..(..F.d..Z..N?.u.a...=;i..j&)Ev.l............N|........[KK..UuR...^.0i..i..H/.....Z.H.J..f=.e.Ka../Zk..*!1W....f..V.s.......0..-uZ')i...2.f0.IJJJSi.#7J..^...3rfz...6.F.r..z._..x...M

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\class.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):656
                                                                                                                                                                                                                                      Entropy (8bit):5.276996274143321
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:+5X0IlMlq23HklYm1BSE4w/WnVvYsAjoBzkp+TkNixUKXfUlecMk:O0Z5IZ4wWnbAjoBzkp+dZfUo0
                                                                                                                                                                                                                                      MD5:302A4F692A6B360B5FEF6B94FBE2AD4A
                                                                                                                                                                                                                                      SHA1:76F5E66667C5C0604BA2FCD8636367190880F852
                                                                                                                                                                                                                                      SHA-256:D8489981E953F07198A9B82774621D0A1BF67C63C90EF81D00D50C78C258ECC7
                                                                                                                                                                                                                                      SHA-512:DAA8DADC53B5BD84A118CD1A86E69E16F91880232FA5210583162D4B910D89B7A649180402786243372D1AE35428E97BE6CBD9A798A491B55A866B83B3528795
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........2...4.......+...>...+.......T...+.......C...=...T...+.......T...+...7.......T...+...7.......C...=...H..........init.setmetatableR.......4.......>.......T...Q.......T...)...H...7...T...)...H...._base.getmetatable........%2.......T...4.......>.......T.......)...T...4.......>.......T...4.......>...D...9...B...N...:...:...2...1...:...:...1...:...4...........>...0...H....setmetatable..is_a.init..__call.__index._base.pairs.table.function.typeB.......4...7.......T...4...2...:...4...1...:...G.....class.core._G...//F4B9FA13B5E21481ADB13436343E0B3AF539657F6B9FB6358C2E5CB6B7AF3AA9D60C8A411BB19C5554E19C1A3BC258E42765D13F1DFA092B4C36523971F24ECE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\dkjson.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10224
                                                                                                                                                                                                                                      Entropy (8bit):5.588652870010626
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:iAjYnl5VRXESz733js/N7TNdmXrLSombvx9QLPyn9ICsV9zDryJjZFdbHxB:HGl5VX3wl7Te4GyDS9iJ9FfB
                                                                                                                                                                                                                                      MD5:0231BC2B2C61B8A8EA6BBA237185FC2B
                                                                                                                                                                                                                                      SHA1:DF0DFECA2A148310196B4104453E111B50E0262C
                                                                                                                                                                                                                                      SHA-256:02E1E047F2D73507026726D6EB01B25C8F2FDFCE10C3D62EB7BFEC261DCC88A9
                                                                                                                                                                                                                                      SHA-512:4AF4D9D084E0C96FEDC367C07B73DB2B01AFF69E6B496CB9030DF3AEF4639378920A566FE08E1379A3B687B60683028169DF7AE410ACE0F252DAABC58BD0A3C0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..>.......+...%...>...7.......T...,...G........getmetatable.debug........%...H....null........5'...'...'...+.......>...D.......T...+.......>.......T...........T.......T...+.......>.......T...'.......T...+.......>.......T...)...H.......T...........B...N...'.......T.......T...........T...)...H...).......F..........number.n..........w+...6.......T...H...+.......'...'...>.......T...'.......T...'.......T...'.......T...'...............'.......T.......T.>.'.......T...'.......T...'.......T...................T.0.'.......T...'.......T...'.......T...'.......T...............................T...'.......T...'.......T...'.......T...'.......T...'.......T...........................................T...%...H...(.......T...+...%.......@...T...(.......T.......+.......>...............+...%...........@...T...%...H...G............\u%.4x\u%.4x.\u%.4x.............................C.......+...........>.......T...+...............@...T...H...G...............A+.......%...+...>.......+.......%...>.......T.0.+.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\handlers.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2193
                                                                                                                                                                                                                                      Entropy (8bit):5.731788125933509
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:vfm26JIcjHmWhrVeYOneTCeeQN4DWdz8ddyJmlF4KjC9Mn:3m2uIcjHmdk27y4Wm34eCu
                                                                                                                                                                                                                                      MD5:2CD1B87553CCC7CAFF14A7E834EEF985
                                                                                                                                                                                                                                      SHA1:5D7ED683520B38C55208875B426ED414FFCD048E
                                                                                                                                                                                                                                      SHA-256:2E1E2B982A4B7688C6E4675BB0B28ABC5DD59DF12876F64BF95C2F8A28452508
                                                                                                                                                                                                                                      SHA-512:5918229A97318EF27E368133EBBC6528C72C20EF8664338781DCC3516E41AE16A9043D01B891AFEFB5560B069A68B81162193884ADEB5F820EB58D7FF82204C6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........]4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...7...6.......T...7...2...9...7...6...'...........T...Q...6...7.......T...T.......T...3...:...:...6.......T...6...7.......T...4...7...........3...:...2...9...:...>...T...4...7...6...7.......>...G....handlers....insert.table.check_updater_flag.handler....order._registry.handler must be a function.function handler id must be a string#handler order must be a number.number event type must be a string.string.type.assert.|.......4...4.......>.......T...)...T...)...%...>...7...)...9...G...._registry event type must be a string.string.type.assert........)4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...7...6.......T...G...7...6...'...........T...Q...6...7...)...9.......T...G....handlers._registry handler id must be a string event type must be a string.string.type.assert.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\init.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2470
                                                                                                                                                                                                                                      Entropy (8bit):5.825813853228207
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:+eymEl2PsN0qjwKgVl3icar6JMJlSSS+iwgqLSRurHi7u4eCGPes6Ea87QZvH:+etEl1fMKgucE6JMxiTRujibeCGms6Ec
                                                                                                                                                                                                                                      MD5:90C44FF9B416D93E1EFBD470A3F4BDD8
                                                                                                                                                                                                                                      SHA1:C734BDBD696D492BB99C629CB5A28DB4923A6D92
                                                                                                                                                                                                                                      SHA-256:91BA73DDC4C669C76786A5C5E7E1A67ECEF63D9DB64FC87B6E8E03504DBEDE19
                                                                                                                                                                                                                                      SHA-512:7438E307DAD85876E161121C4D0EF0251A5AC441DC4B5E1F2DA3F82915B20FF3C711FAB85B4B24A8DBD4AF8B6D46EB8A1583D6C0A0638BE4DAB4BA46E457F56E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........3...%...4.......>...T.......7...%...%...>.......7...%...........$...>...4...........>...A...N...G....require.Loading script: .info...luc.gsub.ipairs.mfw\core\.....dkjson.luc.handlers.luc.PostInit.luc.json.luc.PriorityQueue.luc.UiArbitratorHelper.luc.UiHandler.luc.UiThreadExitHandler.luc.utils\SettingsDB.luc.utils\StringUtils.luc.utils\Telemetry.luc.utils\PackageUtils.luc.utils\BrowserUtils.luc.utils\common_utils.luc...... ...4...7.......'...>.......T...4...7.......'...>.......T...)...T...).......T.".....7...%...>.......T.......7...%...%...>.......7...%.......%.......$...>...4...4.......%.......%...$...>.......T.Z.....7.......>...T.U.....T.:.....7...%...%...>.......7...%...>...4.......7.......%.......%...$...)...>.......T.......7.......>...G...4.......7...........>...4...7...7.......7...........>...%.......%.......$...4.......7...>...%.......$...+...............>...T.......T.......T.......T.......7...%.......%.......$...>...+.......%.......$.......%.......$.......>...G....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):539
                                                                                                                                                                                                                                      Entropy (8bit):5.529904555876259
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:AHhXr7ZM1nBgpj+TDaA6AtZA8W5HUN2sn:GXuMj+PaArtZArluDn
                                                                                                                                                                                                                                      MD5:F7C693968280935CEFD552A7F44471BB
                                                                                                                                                                                                                                      SHA1:24305ABA2EEA82B91881757CA6EADA78E0131EE9
                                                                                                                                                                                                                                      SHA-256:9B7EF67345DF32FB6E9BED81390E345E0A03C1654EA9DF43ECC0CEDCDE5DF0B5
                                                                                                                                                                                                                                      SHA-512:AE570ADA0E1F77AA91255E061BBD7641D6C2EDBAAEA51C1D5F74904FA125DC662DD4D5B54507476C5F7CB0B077D58DB223014EBE42758AEB178287FD0E7F2ECB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........7...7.......'...)...>.......T...4...%.......7...'...'.<.>...%.......%...%.......$...>...H.... pos: .',.), error: '.sub#Failed to decode json string (.error.decode._json3.......7...7.......3...@.......indent..encode._json.........4...7.......T...4...2...:...4...3...4...7.......T...4...%...>...:...1...:...1...:...:...G....encode..decode.._json....core.dkjson.require.dkjsonTest.json.core._G...//F1F18E8C7ACE80A6AA865EC052539B03C846CF3772D9E8C27133F61A0EEAC66EDA459F6B5D1398538DE895BB23EF2A7F1892BF348AD2215C06AE223287B82F37++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\logger.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):672
                                                                                                                                                                                                                                      Entropy (8bit):5.304008934697606
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:JVO1ULfwNYtAVvJOsvJFLvJCvJgIc+0OkFocsAwOPFI25BP3zz:C1KwNEsxHLYk+0xocsAwOtI2T/
                                                                                                                                                                                                                                      MD5:053C65E8AF08D3960DA116FC9A274536
                                                                                                                                                                                                                                      SHA1:F9613AD80340AF037491304330E9DE33493235D5
                                                                                                                                                                                                                                      SHA-256:4F38CA877EFDD7B7C2212452250C1B225037056FE59F81C6E8BB9549D8DF4D08
                                                                                                                                                                                                                                      SHA-512:0C6F7FBC2993F80E592795A362DCD11DE57ADDCD422DDCA7787FC89C6D227BB8AB0449E321613F5C75C477BD3C7BE24D4992478000B93BCDB8AE1419235389A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........C.......T.......7...C...=.......4...7...'...>...4.......7.......7...7.......>...G....currentline.short_src.Log.utility.getinfo.debug.format........+...+...7.......C...=...G........Normal/.......+...+...7.......C...=...G........Warning-.......+...+...7.......C...=...G........Error0.......+...+...7.......C...=...G........Critical.........4...7.......T...4...2...:...3...1...4...3...1...:...1...:...1...:...1...:...:...0...G....critical..err..warn..info.....log.....Critical...Automation...Normal...Error...Warning...core._G...//AB4A198CB4AF2C03A1DF81A3AE00A17A3B3996A735B867221F16D59596A822768F76538C2E4A709EEAD61E8E31DD46C37D04AAB5FB328C23A0CF95C93B472FD6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\postinit.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):928
                                                                                                                                                                                                                                      Entropy (8bit):5.708134632942788
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:vneUBa5eU9CwyTcfcAobrLBsxX+PN8+kiKcJA:vnjBQj0wDMbrLB2uNIivm
                                                                                                                                                                                                                                      MD5:E052D30968E43AE4059473DD4822C335
                                                                                                                                                                                                                                      SHA1:B902D601B6DA4043DBC87BB1BDEF37C37C527CC1
                                                                                                                                                                                                                                      SHA-256:A2F1F3E56B230787AB99D25C4BAAAFD46C727748587FBA99F71D7377B9B8B7D0
                                                                                                                                                                                                                                      SHA-512:B0E9CFCEE3285D4D6F237F7DBF973B91E76F076D3820E08B418ADF95C27F4DEC8771DD26A2D827B9033D1DA5634E0D0428B16823309EF07CEC63435FC7A23A17
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........94...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...'...7...........T...Q...7...6...7.......T...T.......T...4...7...7.......3...:...:...:...>...G....callback.id....insert.table.order._registry%Callback type must be a function.function!Callback ID must be a string.string$Callback order must be a number.number.type.assert..........4...7...>...T...4...7.......7...%...7...7...>...4...7...>.......T...4...7.......7...%.......>...A...N...G... Failed to run callback (%s).err.callback.pcall.id.order4Executing post-init callback. order: %d, id: %s.info.log.core._registry.ipairs|.......4...7.......T...4...2...:...4...3...2...:...1...:...1...:...:...G....execute..register.._registry....PostInit.core._G...//D900138ACF93AAFA306880BD27AF10BAD2F909C0A01175EF4237B19182C42A8E43116F93CE25BA6CD776B3C12C893C1BAE7B9BFAA2B389E12B86BB029AF9F03B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\priorityqueue.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1198
                                                                                                                                                                                                                                      Entropy (8bit):4.909867188732893
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:dE8JRJ5PwKwyk5mLMUhQqbuDljoCuDldyuDlesaDS7BmEXlFuIeC+UR7Zr5g:i8PJJwWk5gMKCDlYDldXDl/YWBmEXlFW
                                                                                                                                                                                                                                      MD5:E852C5D03B246C0E53B104C01B59CC57
                                                                                                                                                                                                                                      SHA1:AECCD50B6BE3387A04B01DFF08F25C2BEA6E611C
                                                                                                                                                                                                                                      SHA-256:177A4B5ED2477C563A040AB4104756B8FF2256ED83E45B6E72C4B69D6F1AF141
                                                                                                                                                                                                                                      SHA-512:214263E612E2BE1F32DAA44923E157ADBD3E932D7E13D69F32D362D9DFC2AB16DB874B2D7CBA3A309C771F13E1E81371D07A979C3C2BD343F3635849B96012F0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........1+...7...>.......T...3...:...:...,...+.......,...G...+...7.......T...3...+...:...:...:...,...+.......,...G...+...7.......T...Q...7...7.......T...T...7...T...3...7...:...:...:...:...+.......,...G.............next....value.priority....Empty.e.......2...'...+.......T...Q...3...7...:...7...:...9.......7...T...H......next.v.value.p....priority........."+...7...>.......T...G...+...+...).......T...Q...7.......T.......T...+...7...+...7...,...T...7...:...+.......,...T.......)...7...T...G..........next.value.Empty._.......+...7...>.......T...)...H...+...+...7...,...+.......,...7...H..........value.next.Empty.?.......+...7...>.......T...)...H...+...7...H........value.EmptyB.......+...7...>.......T...)...H...+...7...H........priority.Empty........+...H.....&.......+.......T...)...T...)...H...............2...)...'...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...0...H.....Empty..Size..TopPriority..Top..Pop..Remove..Data..Pushj.......4...7.......T...4...2...:...4...2...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\triggeracceptor.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):476
                                                                                                                                                                                                                                      Entropy (8bit):5.418054935092156
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:vqpQD3JkGkQXMjvoBhT0oZo/DAUECXBSADx1Ftpj4gblgSa:BJkeBhooZyDAULXBBvFD0Sa
                                                                                                                                                                                                                                      MD5:A5C5B951B3A84A808E81BA25F12DB518
                                                                                                                                                                                                                                      SHA1:12CD6C6E945707E1B80B6A575066C1AB91B9F97A
                                                                                                                                                                                                                                      SHA-256:8977B6657DA16F9D201064443CA99087DBA03912E3BF26D72A8607B16C482332
                                                                                                                                                                                                                                      SHA-512:6F277A70A6E50FE2CB813D9BC2DFFBD862EB01FC5C38ABC55310F091DAB25BE2C891751887DAC7C777E73C579E9CA8591FBD4593030863764587850CE003C1CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...6.......T...6...H.......T...)...4.......7...............>.......T.......T...)...9...H...4.......'...>...G....error.include.external.loaded.package=.......4...7.......7...........>...G....execute.handlers.coren.......4...1...:...4...%...>...4...7...>...1...5...G....HandleTrigger..loadPackages.core.core.init..require._G...//A440620070C7C893DD55C055A956A84456937F05875ED805F296BA4201CF771F78F4892DC0703A70BAF21830CC28783A69149A91223C31BAB4BFF8D06F77BA1F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\uiarbitratorhelper.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3664
                                                                                                                                                                                                                                      Entropy (8bit):5.515664499369645
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:mqTRdCM6qCNUedAWFXWPhz8w6zQieb8Z7w2hzly44LkLc:mq9dd6pFAn8w8Neb822hzly44ww
                                                                                                                                                                                                                                      MD5:B8EBFDEB78E67C342255B8CBAF32D4D0
                                                                                                                                                                                                                                      SHA1:1994D7F8B42FFED5F650E4196D8DF5E3E0E8D636
                                                                                                                                                                                                                                      SHA-256:EDEC892ACED4A2245AC85167AEFBFF8F426898BE8411AF623A373BFC17035198
                                                                                                                                                                                                                                      SHA-512:A2C0FF6D63C6E930D810B54A478416B8B0869756ECFA631A629FCFC5A4AA0718DBCCA7EE24E4F9BCF2F306436EC15D586EDACA72049EE8576DAAF6E5C9FA6A1A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..T.......+...6.......T...+...4...7...7...>...9...+...6...H......new.PriorityQueue.core........+...9...G.....T.......+...6.......T...+...4...7...7...>...9...+...6...H......new.PriorityQueue.core........+...9...G.............+.......,...+...H......0...........2...,...2...,...2...,...G............B.......2...4.......>...D...6...7...>...9...B...N...H....Data.pairs........"1...5...3...+...:...+...:...4...+...>...:...4...+...>...:...4...7.......7.......3...>...4.......7.......>.......T...)...T...)...0...H............StoreArbitratorState.uimanager....indent..encode.json.core.ShowingUiRequests.PendingUiRequests.UiRequests.uiId....DumpTableData...............2...4.......>...D...4...7...7...>...9...4.......>...D...6...7...4...7...>...4...7...>...=...B...N...B...N...H....v.p.tonumber.Push.new.PriorityQueue.core.pairs.........1...5...4...7.......7.......>...7...,...7...,...4...7...>...,...4...7...>...,...G............ShowingUiRequests.PendingUiRequests.UiRequests.uiId.decode.json.core.Construc

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\uihandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1198
                                                                                                                                                                                                                                      Entropy (8bit):5.907314306620713
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:lYGBBXwDQP3ySSzU06BePBh5DKScPDDQ5c4acKf3gV1Q0pVqMpvpx:yw4I//QRKScPDvAlv1px
                                                                                                                                                                                                                                      MD5:5850799BED7E74A95AE88FE77B96A449
                                                                                                                                                                                                                                      SHA1:1F816557D0A382D9405A5252F78326855BA5B9C2
                                                                                                                                                                                                                                      SHA-256:598DF4FAF016CE200FA98B48AC2E4CBA2B9B2A2714CFF93EADF2881655F0ADDE
                                                                                                                                                                                                                                      SHA-512:560BF5D3CFF64F587A81331A08058739B2411D94A0915B789DB05105BE88A8E169FF1033767BF685394FBBE852B56EEEA7188521A07AFC7863FF73120E7A420A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........)...4...7...7...>...7...>...:...7...7...>...7.......3...:...:...>...4...7...7...>...%.......$...7.......>...).......T.......T.......T.'.7.......T.$.4...7.......7.......>...4...7.......7.......>...4.......7...........>...5...4.......T.I.4...7.......7...%...7...$...>...7...............>...T.;.7.......T...7.......T...7...4...7...7.......7...7...7. .4.!.7.".>...=...)...7.#.....>...4...7.......7...%.$.7...$...>...T...7.%.....T...4...7.......7...%.&.7...$...>...7.'.............>...T...4...7.......7...%.(.7...$...>...7.#.....>...........F...6uihandler: no special options, removing request: .AddPending"uihandler: adding to pending .skipPending,uihandler: Added a delay timestamp for .RemoveRequest.time.os.setting_name.setting_scope.SetOption.SettingsDB.utils.delay_data.delay.AddShowing"uihandler: adding to showing .info.log.ret.Show.uimanager.encode.json.overrideSelfPriority.TopShowing._.Browser.EventData.tostring.templateArgs.config....AddRequest.UiType.UiTypeInfo.UiId.GetUiId.GetIn

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\uithreadexithandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1141
                                                                                                                                                                                                                                      Entropy (8bit):5.940399632373928
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:cIS7l0ybV2omlMIqWiwaUCvwgefKS6VlceP1Q3D2c0dlre+GpzaXOL1:cVG+BtWi54gWaZ1427dlrPGpuX01
                                                                                                                                                                                                                                      MD5:9E1E0431420A8CC808387C39D83CB3D3
                                                                                                                                                                                                                                      SHA1:6921799C697A3223644001864FD602F877053473
                                                                                                                                                                                                                                      SHA-256:45C6CD41816D50C6C84D49DB68B857C74CEAA19F28986188ECF38307986DAB44
                                                                                                                                                                                                                                      SHA-512:830B89F854136C92D7FC8DE76CB7E863F0513D65F59AC891430D1B4630C6735778992F8EC5A93A87C2255CD86CE2B91374DCE777526FD290D96F0024B852303C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........$.z4...7...7...>...7...7.......>.......T...4...7.......7...%...>...G...7...7.......T. .4...7.......7...%...4...7...7...>...$...>...4...4...7...7...%...4.......>...%...$...>...=.......T...4...7.......7...%.......>...7...7...7...>...4...7...7...7...>...%.......$...7...........>...7.......>...7.......>...'.......T.+.7.......>...7.......>.......T.......T.!.7.......>...7.......>...4...7.......7...7...>...4...7.......7...7...>...4. .....7.!.........>...5.".4.".....T...7.#.............>...G....AddShowing.ret.Show.uimanager.templateArgs.encode.json.PopPending.TopPending.TopShowing.NumPending.RemoveRequest.RemoveShowing._.Browser.EventData.UiType.UiTypeInfo'Failed to run onExit callback (%s).).(.load.pcall.tostring6UiThreadExitHandler: requestData.config.onExit = .info.onExit.config,UiThreadExitHandler: requestData == nil.err.log.RequestData.ID.GetInstance.UiArbitratorHelper.core.....j.......1...4...7.......7...%...'...%.......>...G....Core_UiThreadExit.UiThreadExit.register.handlers

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\browserutils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3251
                                                                                                                                                                                                                                      Entropy (8bit):5.538218926425805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:yXMczkQwcg2LrLkFn3nvn3nlnonMngn9nMvs1hbzD:Jczocg2LrLkn3nvn3nlnonMngn9nMvcJ
                                                                                                                                                                                                                                      MD5:3E808E826CC4819BA5514F76C28300AE
                                                                                                                                                                                                                                      SHA1:DCEB404479E9725B4EAB726F4F0233BE396FD9EB
                                                                                                                                                                                                                                      SHA-256:202C4C3E5284D7F0697236C02F93B9BB14760D9830FA1EC14370777F345A4155
                                                                                                                                                                                                                                      SHA-512:34F0C23F9C7C15C2DED960D34C175C9A5A7428642BC5025AEDB23CB1CE8642495D2EB6F04DC3C32D9E9BC21A3FC428BD146233731448595D80BE2CB16A73C459
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..a.......4...7...7...7...........>.......T...)...T...)...H....GetBrowserStr.BrowserUtils.utils.coreI.......4...7...7...7...6...H....BrowserTypeString.BrowserUtils.utils.core.........4...7...7...7...6.......T...4...7.......7...%...4.......>...$...>...)...H.......%.......$...4.......7...............@....GetOption.settings._.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core.........4...7...7...7...6.......T...4...7.......7...%...4.......>...$...>...)...H.......%.......$...4.......7...........@..."GetUserOptionWithSystemBackup.settings._.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core........"4...7...7...7...6.......T...4...7.......7...%...4.......>...$...>...)...4...7...7...7...7...F.......%.......$...4.......7...........@...,GetUserOptionAndErrCodeWithSystemBackup.settings._.Unknown.settings_error_codes.common_utils.tostring.Wrong browser type .err.log.BrowserTypeStringLow.BrowserUtils.utils.core.........4...7...7...7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\common_utils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5984
                                                                                                                                                                                                                                      Entropy (8bit):5.583892391622832
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:kjfJYxPlevECOq5BY8yQP3R7eEg9L9Uo2qS9w6mXL2tOPCeYubd:kjfJYxNCOqAKR7eEg5Z2qS9w6mX8zeYe
                                                                                                                                                                                                                                      MD5:91C871CA0D7F0340755B6718E8A558D3
                                                                                                                                                                                                                                      SHA1:C500233DE6F7A9519145F6AC523E75FB37C38C33
                                                                                                                                                                                                                                      SHA-256:D1D3FE21137D0CAA17F43F5EB6C4A9B2A9FE042B142A504D4DFB8B883991571A
                                                                                                                                                                                                                                      SHA-512:39EBBA979FF7E2B2B6487208A54B5E05D86B8DD5D6C985FFF19A2B9851C37128CA0B4063E42865D42E4FBC305B1D971AEB86912A02ACBF764AC8613B9A6F2A53
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...7...%...%...'...(...>.......7...>.......T...%...H.......7...%...>.......T.......T...%...H...4.......@....tostring.NULL_AFFID_ERROR..affid.QueryValue.READ_ERROR.IsValid+SOFTWARE\McAfee\MSC\AppInfo\Substitute.HKLM.Registry.Win32.core................T...4...7...7...7...7.......T...4...7...7...7...7.......T...4...7...7...7...7.......T...)...T...)...H....WrongType.DoesNotExist.Success.settings_error_codes.common_utils.utils.core.........4...7...7...%...%...'...4...7...4...7...7...7...4...7...7...7...>...=.......7...@....IsValid.KEY_WOW64_64KEY.KEY_READ.RegistrySamConstants.bor.bit5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core........04.......>.......T.......7...>.......T...)...H...4.......7...'...'...>...=...4.......7...'...'...>...=...4.......7...'...'...>...=.......T.......T.......T...)...H...4...7...3...:...:...:...@....day.month.year....hour...min...sec...time.os.sub.tonumber.len.string.type.,.......4...7.......+...!...@......floor.mathY

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\packageutils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):867
                                                                                                                                                                                                                                      Entropy (8bit):5.432998811769363
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:pufrcUtccotqTrcT++vrrjkvFwceUkOaXVq:pMcU+ckIcpvrPk6Hzk
                                                                                                                                                                                                                                      MD5:7F7CBC69F38143C067B92C2E163EBA5B
                                                                                                                                                                                                                                      SHA1:543A78DCFA1940DF41B625E30702988E154305E1
                                                                                                                                                                                                                                      SHA-256:CE7561153D826E37B8FA073868459DC40071DCCEFFC9D42B6F429BF63F804A6B
                                                                                                                                                                                                                                      SHA-512:D66B3FF734EE0111EA000E25BE528FAD1BF985DFA865EABA3DFCB0A68B78EAC64A850F3E11D8442A6B60659E6A23F4E6676B4BCC8B28D4833B121FBAC18CDE71
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...4.......>.......T...)...T...)...%...>...4...4.......>.......T...)...T...)...%...>...+...9...G.....%Package version must be a string"Package name must be a string.string.type.assertr.......4...4.......>.......T...)...T...)...%...>...+...6...H....."Package name must be a string.string.type.assert.........4...4.......>.......T...)...T...)...%...>...4.......7...>...%.......%...$...H....\.mfw\packages\.GetInstallPath.utility"Package name must be a string.string.type.assert........&4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...4...7...2...:...2...4...7...7...1...:...4...7...7...1...:...4...7...7...1...:...0...G.....GetPackagePath..GetPackageVersion..SetPackageVersion.PackageUtils.utils.core._G...//B62B06F3A47C3CB6DCBE86D4ACA60A663FA9CF9D014B7374747E3501816A2ADE301CE157D2FA79E3CE37D6BC596960813AB3C9FBD3E8438E451BDD419536CC14++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\settingsdb.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):761
                                                                                                                                                                                                                                      Entropy (8bit):5.488665434947188
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:+7Of2MysdmYQjf89YbUiBO5qqxDaxz8+TuJH9gLfdNEELSYi+KIf8wQjXeqqxDxB:+qpHmg9mUigC8++Cf3a+8wUe9RlHP
                                                                                                                                                                                                                                      MD5:E2F498793C66755F1B146B1BE0E4FE35
                                                                                                                                                                                                                                      SHA1:CA341BF5AD1CD04A9368E8E124DA90A37A0ABE4D
                                                                                                                                                                                                                                      SHA-256:9B6EC2909A68DEEBC772EF4C72DAD762259E50E04ECC30294D4A606FB06F985E
                                                                                                                                                                                                                                      SHA-512:874726D988C6937C990CF012A76CB098B757478AF049E94827C9CE013C86E1CED8A0A9B5AEA44ED280C3F9677F96A30E322EC9DDD4A3123FD29C48700F068AB0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..6.......4.......7...............@....GetOption.settings.........4.......7...............>.......T...4...7.......7...%...4...7...$...>...H....Name.elem.Failed to set option: .err.log.core.SetOption.settings.........4...7...>...T...4...7...7.......7...7...7...7...>...A...N...G....Value.Name.Context.SetOption.SettingsDB.utils.core.Settings.ipairs........)4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...4...7...2...:...4...7...7...1...:...4...7...7...1...:...1...4...7.......7...%...'...%.......>...G....Utils_SettingsUpdate.SETTINGS_UPDATE.register.handlers...SetOption..GetOption.SettingsDB.utils.core._G...//BA064BBD6C961AD90A129B2A40D9889D6AA0EEF35B2A76B1CE9D32807CE2FEB71FDEDC1EE41CC46F5A2DD4BE6944B075CBD444C9B4009D49F36ADBAD9632501D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringutils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):381
                                                                                                                                                                                                                                      Entropy (8bit):5.2572900003489815
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:5xk6weLbmqJStrRgR68/GXDal/fqa1F9gLf9VZYcR7QhMQFZlXkfLFjeQkZOPrG:AUJKrRgRF+TuJH9gLf9VKtfbkD+gi
                                                                                                                                                                                                                                      MD5:014A827B47EA55E276744BD3A905477D
                                                                                                                                                                                                                                      SHA1:7AA21869F823AC82AB1CD2E5A2AE113197984FE4
                                                                                                                                                                                                                                      SHA-256:57B3CF2CF69F14B8B204C4197E2ADFDA5654587B5EBFFDD882428025A7AC32D3
                                                                                                                                                                                                                                      SHA-512:5E007A1C93B9B56730D514D8E13698588822C03304449C69D2680A77ACC1552F9D81899909A28A62A791286BCC3ECADA66F797A272AED2BA643D48FFBFCDEA67
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..O.......4.......>...T.......7.......>.......T...H...A...N...)...H....find.ipairs.........4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...4...7...2...:...4...7...7...1...:...G.....MatchInPatternsArray.StringUtils.utils.core._G...//5F329B9C566BACB8FE9B8B521D39D211D166466CAEFAEC1DC1BE17D60E524C29CAB9C08F725FC13D85458B07D6D730F2E04C2F97998A53E3A42ED4E7E613F6D9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\telemetry.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):715
                                                                                                                                                                                                                                      Entropy (8bit):5.528123672687843
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:5SjrFSHkRjWlvObBma76OWSgLbht2SYuui8+TuJH9C4cGYi+F6pqQBunxSmnNnMj:5WFSH0z4SKSgLbhISKd++Ctg+F6pq5xo
                                                                                                                                                                                                                                      MD5:8E5BDC8B9E55B6BD44C01E17DE346BF9
                                                                                                                                                                                                                                      SHA1:CEE53B1B473C32CB83BCB21F9E5E1B38574156A3
                                                                                                                                                                                                                                      SHA-256:A7662585389DE51DE324275A5D354AF6675579376366812BBDEF366A71CABF55
                                                                                                                                                                                                                                      SHA-512:110CF48886560E8885812A66BB82F247C01BA72129436086D470C462D5493DB4762117173FD7A3162CB92278B9D95D357CE4EA8939D33BD9FD7EE959B232BF87
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........*7.......T.......T...4...7.......7...%...>...G...4.......>...D.......T.......%...4.......>...$...B...N...4...7.......7...%...7...%.......$...>...4.......7.......>...G....SendTelemetryEvent.telemetry% with resulting instrument call !Telemetry event handled for .info.tostring.,.pairsDEvent data received does not contain a name for telemetry event.err.log.core..Name.........4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...4...7...2...:...1...4...7.......7...%...'...%.......>...G....Utils_Telemetry.TELEMETRY.register.handlers..Telemetry.utils.core._G...//4B7D164CC79C27D67E2739FEFBFFDD7B8A64403F6A77D3546BB75E58A0551143F006563368CBC7BAAB9F79D4B2693EE5BC60AAC9E3CBBBDB5326CC91DFB3F0DD++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\core\win32helper.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):25827
                                                                                                                                                                                                                                      Entropy (8bit):5.653067104880243
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:X+TLK0EBBhyA/Hqr1vFBMFbwFqYnKgWW805:XS20EByA/H0vrMFbwFqYnXWW8y
                                                                                                                                                                                                                                      MD5:72DF882DD6D0A7C9D72287AA760251FA
                                                                                                                                                                                                                                      SHA1:FD296D0A322FA1ACED5CE0C69DFFD917D77D67B7
                                                                                                                                                                                                                                      SHA-256:7FFC41E1160ECEB6EB40CA366DE192029ED5BACD2E41A02F953CBC0A05F731B9
                                                                                                                                                                                                                                      SHA-512:E1FECF45B882DFDC9EC6D13C7FC9F74B6D770D0ABF8C86E4A950BF3FF61E7822F2ED2003B3246187491CDFD9A38C7FBD845B1B5EF1CE7A1BB439CC4C41E4EF06
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..9...........T...4...7...7.......>...G....CloseHandle.C.ffi2.......:...4...7...7...1...>...G.....gc.ffi.handleV...........T...4...7...7...7.......>...G....DestroyEnvironmentBlock.userenv.Win32.core/.......:...4...7...7...1...>...G.....gc.ffi.env1.......4...7...7.......>...G....RegCloseKey.C.ffi........<....T...%.......T...'.......T...4...7...7...7...4...7...7...............>...5...4.......T...)...:...0. .4...7...%...>...:...4...7...7...4...............7...>...4...7...7...7.......T...)...:...0...7...8...:...4...7...7...1...>...G...G...G.....gc.ERROR_SUCCESS.Win32ErrorConstants.RegOpenKeyExA.C.void*[1].new.ffi.hKey.rootKey.GetRootHKEYFromString.KEY_READ.RegistrySamConstants.Win32.core.(.......7.......T...)...T...)...H....hKey..........7.......T...)...H.......T...4.......>.......T...)...H...4...7...%...>...4...7...%...>...4...7...%...'...>...4...7...7...7.......)...............>...4...7...7...7.......T...)...H...T...4...7...7...7.......T...4...7...7...7...8.......T...4...8...@...T...4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\auxiliary\reset_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2829
                                                                                                                                                                                                                                      Entropy (8bit):5.562027588731734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:1LJhOJPjvbGScwwqxj0UBhC2/94i03T0z0707Hve24XLHStNovSoowyLHeyl0WeH:1LJhySRqxQGN/94i0D0z0707HG24XLH/
                                                                                                                                                                                                                                      MD5:41075800FB029DEFD6FF8288A95A000C
                                                                                                                                                                                                                                      SHA1:7F70B8E77BF3967BE31E459EC572851EA8B38F56
                                                                                                                                                                                                                                      SHA-256:559D9E02B178AE5F32F9A903D31BFB9A7A619A60FDC6FBED1D227097E1939216
                                                                                                                                                                                                                                      SHA-512:9D738FD7A3BFD3D1B3820F2820F95E08FDF6D637C876A1E1C29FA891BB38019E11ACBE5EB6936169F637A0A0EA6C6336DF9892AFD2C95A1E30F50C166026EA99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........Z4...7.......7...%...>...)...7.......T...4...7.......7...%...>...G...4...7...7...7...7...6...4...+...>...T.6.4...7.......7...%...4...7...>...%...4...7...>...%...4...7...>...%...4...7...>...$...>...7.......T...7...%.......$...4...7.......7...%...4.......>...$...>...4.......7...7.......7...>...T...4.......7...7...7...7...>...A...N...4...7.......7...%...>...G......handle_reset_event: end.SetOption.settings/handle_reset_event: local setting name is ._.reset_value., reset_value = .add_browser_suffix., browser specific - .scope., scope .name.tostring+handle_reset_event: resetting setting .ipairs.BrowserTypeStringLow.BrowserUtils.utilsBhandle_reset_event: no browser field in event_data. returning.Browser.handle_reset_event: start.info.log.core........;2...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...1...4...7.......7...%...'...%.......>...0..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\allow.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 123 x 127, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1893
                                                                                                                                                                                                                                      Entropy (8bit):7.818694714241724
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Q/6gmJZSP7Lx45VjqtJr9E6y6jP1CCrAJJe052IoqZT:QSgmm7u5VmtE6vP0Crke0kIo8
                                                                                                                                                                                                                                      MD5:27A2992C0DC4D2968404F3A0436B0E50
                                                                                                                                                                                                                                      SHA1:42A65AAE398A086216E4240DA626EE2425D5E343
                                                                                                                                                                                                                                      SHA-256:7B6B15968EB22203596DAE54A8DCA5CCD766112C85F7D64D21EB2DA361790D40
                                                                                                                                                                                                                                      SHA-512:AA6892A82F14203367D25FA4C11E8B32CB27B681ABB2433806BDC889BAB483796B2C1C79C25336D7D4F07725F1F97207AD13D8630493BCE49F11976AF6239251
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...{..........V.i....pHYs.................sRGB.........gAMA......a.....IDATx...Ol.U...........(P..@B.J0.?+.C0.11." 1.E..I.JLL<...=.z.D..E.A..A!$..J.(+..m..{...-.3..N..4.N._........!..B.!..B.!..B.!..B.!..B.!..B.!U.a....I..@...Oa.-[.S.......g..Y(.2.@....^.>cu....K.w2..x.f.S..q+C.4.K.Os....p.xa*fE...MA/#...$.\.f...(..........k@.B..80~.......b0...'...Q4F{.@x....R..= }S,..Vs.....a.......*.Z.b..8..E.-z...i.`:l..P..0.m...)2..hT.K..0.t.i..V....X@......Z..2.6O$....@..B...K.. SaO..1.tgA.Z..S.y#..d.....g.[!..........J..........vm@..k..Z..W...c...1[!..B(l..6fOd......?S....?......PI...'...........,...Ba+..V.mc...~...U..j..Z........J...l.....AV.......Ba+..V.....[!..B(l.P...|.....'_....{~.N.:.jW........[!..B,.... B.0.]]]=Tcy....u.<.j...wv....Ba+..V.....[!..B(l.P.....Ba+..^/..<1.'.....&O8o.S..}@fj..H...-....w....c....DpEL..W!P.[.h~.Mc7`....b.......mXo.ug]..ehz.o.....U.!..&'.".h........ ......w.......z......o.k........*....h...0.t.\.{..;

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow-right.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 54 x 46, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):509
                                                                                                                                                                                                                                      Entropy (8bit):7.265106458574301
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/76lJ/6Ts/4qfsK+Sz2D2cP03cbekp8LuwkWBjMAraM7P:9lJ/68fsPSyFP03gpLWqu7P
                                                                                                                                                                                                                                      MD5:B9239E137DA0942222FD6E7FBB95F084
                                                                                                                                                                                                                                      SHA1:4D8B1C9DA9E1A8772F5C6929A4337D5D9A659EF7
                                                                                                                                                                                                                                      SHA-256:FB3B5BE9639CDB51AEDA6F379B0E3D78E64035C53EBBD9D99D28E6913A6BB761
                                                                                                                                                                                                                                      SHA-512:02EEB55B6C2A00D6E638B57CF448A5110C40A0962D68121BB869C8CD82812AA50FCC882A0E3FCFBF9DA5047F15A2686176CCFA1F61044DD8BF7F0CC957A630BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...6.........c..+....pHYs.................sRGB.........gAMA......a.....IDATx....M.0......kzH..+d.6..$.0BF..e..!7. ......B...I..g....{.].b.D.K.....".e..."}k~..Sk.y.R...1.x.R....rcp9'.!.......n.&.<.zc.9..(..W..7..9.ZbX.d..e*.....n2v5i.x.!.8.0d....l.D..7N..q.D...N..q.D..T.X.....Ccq.ah......S..MS<..b...C.KI;h......a...k.%..`fx......{e&.r7.)...P$.T.Q(....(........h..P.G..Q(...(....i(....(....0....p....i....5`....p.c...5`......i^.e....dC!.0M.c.....^...4?..R...Kb_}nL...i.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 46 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):525
                                                                                                                                                                                                                                      Entropy (8bit):7.401937246200202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7W7/6Ts/B2l3fqAXsMj1VswTbTfH9O95UzdOo9Fy2S97:F/6B3io1p79O/kdjHy2St
                                                                                                                                                                                                                                      MD5:CFD3007010FA11DFE25FA8D48E65E72A
                                                                                                                                                                                                                                      SHA1:9973303D168AECC57EF380EB705DB4B7C6055766
                                                                                                                                                                                                                                      SHA-256:8FFC2BAD58D0322050F9AF74D140A23A589AA6E0710D6E48285FCC123A80ACE4
                                                                                                                                                                                                                                      SHA-512:DA7514A4B7CCED85378E25B49742AB674937B7CE3AB714923D848CC1F3CE38CF6C11A0DEA8B97C2860B0BCFC770ED3CC39E74AA358A63BFE81E9DC47754DA60B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......6......<......pHYs.................sRGB.........gAMA......a.....IDATx...MJ.@..........EA\y....y........'..R.B=B.."dmM.L...$........4...$......I..........\ '.r;..~.o...zy(Ujq.vu.,.C.W.!t<......Q..h.....@C(.(x......#.P.>.......pD4..W>'.<...........#g..s..........r.c...p.7"&....k.._.os...SL.b......../8.......w..B.%.K4./......9.......&5'....x).}.........P...3Oo.^.........P-^..r...h.W.,.q...2.\..>.........}2M.G.t.3I.{... .....Cb.b8u.....1.:.S.p..N..c8u.....1.:.S...Di.(.."....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\card_bg_image.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 198, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13807
                                                                                                                                                                                                                                      Entropy (8bit):7.980033051105471
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:r82XmabuE9fiCT7j5ggQkSDKoEBF4mRzzJt:40XiClggenEBp
                                                                                                                                                                                                                                      MD5:A7522FA80144583C5F0E070F50E06C47
                                                                                                                                                                                                                                      SHA1:FF32E2DB5468B183DE1FC7A68D3F82BCAC033262
                                                                                                                                                                                                                                      SHA-256:AE9F79BE354331730247196BAF87001D48330E8452593952820AFEE0DCE5724D
                                                                                                                                                                                                                                      SHA-512:FB8E730EB796F051AB4E84A1277C2C6B53CC8DFCA96CAD8B3CCE4DB48675B3D7AE008F1A1B100D776E1BB9F040CE0DCEC020462F13C9CC42126F463F87CC0802
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............0.y.....pHYs.................sRGB.........gAMA......a...5.IDATx..}m.#7.% _..c........{....X."upp........Uf. ...J...._......p.y...?.v.........UA.....k.i..W.+...f.?..8h.F.C..:..z.=...\.)..P.+yW.....km8.O.N.;s..9Hs....x....ni.2b..1.....$:.V.c%.~...4Q.w....VuT<N..... .....^.....j."Q../#n'....K..d...h.c...tQ'....L.U6@^.K..g.. .....>1;.@..m./...<.0.......d..o.t#........!d0.^9..|..D..K..6..Z....<....N-...M....%....B04Rr.. H......u...f.........|\.q...r.'Vt.g...,...[.V.....t%..]..H...J .G:.....x.....).....,.K..)....jC..........d(.m7p*9L.Lr=.Dc.~..f}8.J.c8.`..`i.Q.'..S.......ZT^1..L{n.Qy.._.6..)hv./41!.i.7'}..F.L:. .... K._Ag.L%{..:/[n.P.I..g].D.80J,o....)g..~.z.P......y.\..K..7^+..d..]42..k...+=.>.......k[..(....E....Zk.;..q.xu..?.H.t.*.N|.....].u..B/.TJ.+.x'.I..$@.)8.7..R..:9.)y....x...e...;^eP....K...H.G...#.)..t.=..>0..........I...n..,K|)8.....o.?.n'.....h......u.s_..`:A.....R.7G.v..$'..9w5v ,..x...xL1>.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\celebration_white_bg_color.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 227 x 161
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):129961
                                                                                                                                                                                                                                      Entropy (8bit):7.769772439114844
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Bcbqed21Gq2m9prSuHM+unzoCySEjsOOKnh8acQE:+urGq2YIuspnzoljsOhh8acQE
                                                                                                                                                                                                                                      MD5:3EBE8FB664F1628C041FFDBB93589731
                                                                                                                                                                                                                                      SHA1:A59297E734DB199CCEE82164069D1B86E598E987
                                                                                                                                                                                                                                      SHA-256:79010FC6FAD8A3BEDC14ABE936AE3EC5D97CFA47D2B1E6698DBE595D68653D3C
                                                                                                                                                                                                                                      SHA-512:6F53DCC48FA1CB703062BC4503979080E9CFB61B3E0BB175D5C4E7A53F569F171E85C31190B2A58442864A8ED13AC2B3A9ABD87651DDE0484D943100D6E247DC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a.............!..!..................................s.......).....:.Z....J.R.!.....1....B....B....k.1........).........c............s....1....{..J..k......{.:.....Z....c....Z.:.....B..{..c..........).....J.R..J........R....s...c.k.Z.B.....).........R.).Z....k....B.{..k.R.J...........s..k.B.......k.............................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H......*\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+vI....$.0(.#@..IL8...b.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):287
                                                                                                                                                                                                                                      Entropy (8bit):6.630313782289296
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPZ2/6TsR/yxgwQwuAaLTfmSaqpnqJ7a4EinE4p:6v/74/6Ts/Nw99aLTiNFES
                                                                                                                                                                                                                                      MD5:73E2C1063696B7A83E47689B4CAE1D45
                                                                                                                                                                                                                                      SHA1:04E47994EC2A2AAA399EFF0EAF527E997527A0FA
                                                                                                                                                                                                                                      SHA-256:93422C9A002E4662D8EF3D0F4A51B266C116132B1D58C025BA865CF48095F92F
                                                                                                                                                                                                                                      SHA-512:ED73328E7C85EC369902A51E21F174491B5E7C1EA44022D87C1728F84CBFBCA02A8DB4EC921703F49D075B92021FB40AEA241BF0DA87EAE4816D6BFAABA5BB9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a.....IDATx....!.E}..(3.#..mC.(.ls.0.#..@...)..SD.....o0...o=......?K)/P..o...~.ukm.9W........s....>.l....L..H.-..........T...........k......".~..s..`.7]:hW..x...ML)...5*......o..NU.6...m....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\close_icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):312
                                                                                                                                                                                                                                      Entropy (8bit):6.773823438465042
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhP8AMx7/6TsR/Jr5OhJTtEEc+GbxMWMEHFGejHr5fDp:6v/7kAMx7/6Ts/Jr5GJxJFmxMQHFG8Ln
                                                                                                                                                                                                                                      MD5:539828AA00E3933554AD071A88D2620B
                                                                                                                                                                                                                                      SHA1:EAB3ED1CE4E11D3428840E48870BC138DAD58499
                                                                                                                                                                                                                                      SHA-256:CEB6F6C99816B65716862B6353DF4D4425D9E023A6BBEF7180E63954BAFED91B
                                                                                                                                                                                                                                      SHA-512:0982F97ADA2F432BFAA87AD0598F4CB5AE482A4E57D5CD81F4848B62A7C9783F988DCE1E8DCCDB2C7D0F16DEF28387BB702E91C33E65E6EECE365548201536D2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............w&....pHYs.................sRGB.........gAMA......a.....IDATx.}....0....-.#...A..$.H&@....F.]..D6`.2B.T...d.X....>.g..)..\]h...ho.,.j....N.'p5.Jj.....0..Y.........<..1,.v.....Jj.wr...d0.....cz(..b......d...w.......eW...C'ah....0....`..3..b.)..R.#....3q........IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\dialog-balloon-logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 44 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1620
                                                                                                                                                                                                                                      Entropy (8bit):7.801361627421433
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:y/6nDZIGswiTaw1GdSET4w+r3RMMzXVetutVp6ipbIlSmdTKS:ySn+UP4wGMMzXVEut/6gElS+
                                                                                                                                                                                                                                      MD5:6432DED3B3287224306B81E0204B1515
                                                                                                                                                                                                                                      SHA1:4CED825AC86462D8004F80FEB0D771A8BAB89D0F
                                                                                                                                                                                                                                      SHA-256:41998FBE91B8B250B389D89D1AA80D5817E4F2D51CE929A7D89F37AE0093D8B5
                                                                                                                                                                                                                                      SHA-512:25AD6EA2105CDFE64D7153DCBC27F6EB64AD2565ABF378F6B8E0B7B8BDCADC8F370962B843714137720FC290CF41277ED612EB4660A209C67B1C7B44A4CAE486
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...,...0.....j.......pHYs.................sRGB.........gAMA......a.....IDATx..Ml.E....&.*M..qZ...R%..a.....VH......ZG...PW.=.!..*R..'.........:.R...I.TD,5j..`;..M.;...7..^..H.K....L~y~...1.}..c..}.f..6*.r..;..05sei-bw.....@..Q.\..<.X..........C...A!....m.!.<....=.y.h_<...D.\.A. .q.....oW5mcn.o$..{..]...^..q..p..4...O..5..D.(g.Cv-^.O....fLZ.6[...A.5.EN..............6(.<.~.d.a.Yt...nX5.-V].R....?......l...."...x..].......~..Qh^I....,....S...u.....b.4...Z.j\8......_........_.W..<^...e{..8.(I..r.PPa0...)<."h4....g.$..j(J.....-J.;x.+......6...V..V=sa.)..R:#.........[...^.>K.&..J.V.....=.ww...5[.L...&.".b.../..e..........iq...K.Y...K,d.'.,b..c....a.A.9Z.j.c.^X......]1.\{......y..C.O....8..px......(\L-f.=..0..x)....?......?.-..k.e\c3.7'.N"..'..]....9..K...5...95..k."<.....&.a.Z..w.>........Z....&_SL....B7..FD...0.)J.a.O7....*.Bd...oU+.|Z.di......^.@.s.TF....u9.+E.|f^.K....u..K..v..^....N.n`%Z..>ZYw=6v.g......Q..._l.gFS.Yl.O.1.~b.^...s..~d.I.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_ss.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 190, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18923
                                                                                                                                                                                                                                      Entropy (8bit):7.9861701934335665
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:rRQZ43uKP67gxwrBM1vfj16druGvBBuf9aDGCdOGuQ0Xzu:lQ/KnnAJdy1aNdpuQ7
                                                                                                                                                                                                                                      MD5:414AABA2691D865AF446A88F56DB10BF
                                                                                                                                                                                                                                      SHA1:C7DE664C4AE999D4F31678C106C336A8AA12FEBE
                                                                                                                                                                                                                                      SHA-256:A7B0B6B5834C71BF51DEA60B92CDB84692D7082D219F2FD460DA8B06D761B088
                                                                                                                                                                                                                                      SHA-512:394AAFB7F371DF5A2456E4D1F478515099EA077E2EC3B3F749D1CF7E2EA1FF27BBF28DF369345D785A74D920A6829F2E11C27B380C94E175EA1221DF90638800
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a...I.IDATx..}..^Gqf.....i.dI^dI.....&..c..-,38.@&..`.!...pfB..L.,..@..$.93$.r.@0.Y..`..[.-.................."..x.....]]]..uuu..}.=..Ax..1...S.v.m.h>e<....9B]....y..h1+B...]OO#.Z<s..t..*....2.Z+..pBhF..`.J...1u....R..d.OQ+^..\...S.3..I..b....a....V2..%..G.L$..e0..d.'*(e*xA... ..k...:E.B.........h.).%].!..&.&...y...<.......R.....]....k..P...|.X.[KUZ+..@`....h..qJ.....(?...@...NF.u*..<......D.Q..OXn.2.^6.N...tQ.]<......}.7. ....~..!"....%-.....e9....sA/*'.5..D....]...r....i.TfQ.".).d....E.&@.x..l..'7..]......$....+..... .P..<....r..2.1..0.h......?... ....E.@..[.n..<..y#..,..Eg.$.2.F~.K-..^n.3..S..x./}YHD......8..FI.gB..l.5.,..lN..C...S...'F.P.....a..-.a.p..E'.I\y..5M.;..'.........+z$'..x.N$u.m.`.`...+aHY...yT...$...j...G....P...N.....&n.nA...*....5....Z.^(`..7P.|.@.:... .......P.).C...^...Nc...J.b.b.....z.<;Le.....).V=.0.2.0Z)...;...:?r.Z..&.Z.4&..:O....W..kh...u.k...+....,.k

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_ext_guide_wa.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 210, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21212
                                                                                                                                                                                                                                      Entropy (8bit):7.98325864342395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:O2GbDyxp4nQlUyEOZgtE0QsuSBmaibS7oiFaRXrDaLr:9SDyL4nOT9imai+7qXin
                                                                                                                                                                                                                                      MD5:F1FBD29E2D0C3FAA510DA6A8397532DC
                                                                                                                                                                                                                                      SHA1:FF5237B7D22A08182534B9083ABEDC36C0D3E349
                                                                                                                                                                                                                                      SHA-256:7371BE7448704F7CFD6A8776482774791ECA122397006DC5841CE1D69436F065
                                                                                                                                                                                                                                      SHA-512:EE496EC6F940CCF236FE8F86B7BAC8A62698049F2F310103A6BC4DCFEC4D2B3244762B844231A0326DC42197E3C851A82BF1E9E5D87A26B8EE7C5F686E4A2AD4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............J.....pHYs.................sRGB.........gAMA......a...RqIDATx....&.q.........f03.\.....^0.r%..D....k.&W.k.%..*V.7.P...I.+.....r7(KdH..eY.LZ.@..M..A.$.......s..w.?...U......;f...3.............:...!c. ^....R..g\.ri.....X..%..h%.B.....N%.F<.....X.~..\.^j.s...... ....q.:..IY).:YM....xM...L.......O.a]j.y..^.D..H..$........D.L..^..4>....8O......#B.y.8Z|JF.W....I.I.oD...2O...!3..)G.a.....J.|.(YCB>.,..*...f 0.|Xj4t..{.....!iQ~ i{.(...':......<.:H3B...$KezBs#.i.gc. .A.=...A.rF....cP.~C.|..!"...%}>..2m.2.y.,....B...."0.<....]...r`R}..%Oe..W.5e.....(....O...(..M(AW8..T.<.@z.......A..B9.....w/.IMx&4....!..r*.0&..t...8oe.j8...".>{...8<m.R..(.].Ss...O..5.+yx.rC>..q.....|HD......8.XGI.g..r.F...<X..<.....BL..B...C.&....#O.C...NQ.h$<.{^deM...A.I.e.c..r....|$..Ny.F$....r..)....C.E.P.F..hL.|..F.+y.PzW.....I.<#.....[.!...DCGe.,,T........TU.7#....5..0.<`(..E.r<...*...j.4F..u......Z8.e...T....."h5C..!........j...#.Uy.dY..D....7I.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\enable_sideloaded_ext_guide.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 133, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13412
                                                                                                                                                                                                                                      Entropy (8bit):7.975594232205093
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:w0HE4jJ0oyx9ehCCmVEKtChcK6pRhXUPFLe1iU:5P0o00Ej8cdnCluP
                                                                                                                                                                                                                                      MD5:12187FBB7EC8ADA4E6334B2297D78A6B
                                                                                                                                                                                                                                      SHA1:9155356FDC70C7BB4C60950ADC4EF55BEE023B6F
                                                                                                                                                                                                                                      SHA-256:05D775AC7CC5F970FA2A0DFF5A1F732B8DC43241F789242C17E39F4CF9AB39FC
                                                                                                                                                                                                                                      SHA-512:55920F35FDA8F19C2372439774DED2B8E7EC61360DB81C8DB78B2A2F75F9FD10556203067E129F4D52F3BD1C9DD2B28788A12853DA15EEC9C2C18086FD68CC0B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............r@....pHYs.................sRGB.........gAMA......a...3.IDATx..}....u........;......H..D..-n.DK".."Y...P.*.TRN....8..*;.Sv.E.n)v,Q.(J"...Iq_.. @.............g...x.p...L/.ow..}.v.<..s..DH-......>..E...}....Q$....+K.....n.%..+<.N>~\...7.}.S..oV[.rx.@<..>.....R.Gy../H.Y..4.g..PTD.Ne.:.t=J:.W)...G*_nN..(1...$\Iym0.2..By..G.4.._H..."$4N.........D.t..Dg..U\..'.....f.D..rEN.".8.A@....]......$,..xheH.)..S.N@j..........x.b...kT....#.`............^...J.......c.u:.(/..^.Z.+G./.........QR.:..*...H.6....ld\.%1../.{]P.........D&..S.P$...u...T.2@.$r....<.j...t.R...t...I."%.9..e..!H=......'.-....y`.5[...L.B..... QI....6....uX*..`..}\.Ga...5..4,...2..?.<.K.B,.0...._..............N[.+R.-..!mc.mA.N$r......Ny.MD.O.K.1.O....G.t}.L\P.g...F.f{..S.E...d0..)......R*.-.I2'..HN#...@0.f:.A..lm.R......?y...u.w..e.d6.)..'..w. ..EH..>c .($..V.$...g.R.1..Vf...a%.!O.&.l.x.q...............>......J..\....9+.||.%...d..1#...).,<p..../..X$cVX......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\green_check.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3166
                                                                                                                                                                                                                                      Entropy (8bit):7.890916051269147
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
                                                                                                                                                                                                                                      MD5:2048DF489A12C4C9E2341BEF42883205
                                                                                                                                                                                                                                      SHA1:281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
                                                                                                                                                                                                                                      SHA-256:DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
                                                                                                                                                                                                                                      SHA-512:815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\icn_mshield.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 28 x 29, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16099
                                                                                                                                                                                                                                      Entropy (8bit):2.1119107535632073
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:R/6qMh8k29WJsEv+jJ/Zf9lnkouuJvBLD1LpKLxN+Y9rNGcfNGvsc5jq7LcQEdBp:RSB8kEWmjtZCxNXrNGQNGvsc5sx0
                                                                                                                                                                                                                                      MD5:FE56C156669CA636CE71E5D23D9C685E
                                                                                                                                                                                                                                      SHA1:6EF641E2CEDB274F9CE2AA2037697372C49CCA25
                                                                                                                                                                                                                                      SHA-256:CD48CA4C27625C9286738652535097FCD7406C709371D85AD8297F8FEA19FF32
                                                                                                                                                                                                                                      SHA-512:B82ADD72111983CAB0DB650F3D12D11E3E2CCC9681DB18484F2219EC4A8AD7F4E5BFEDEFBEE4362CD7CA03A17A025EA1E54E566AD2C458C1221F6EADAD099D62
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............Q.1....pHYs...............<AiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2017-05-31T16:18:28-07:00</xmp:CreateDate>. <

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\installer_background.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 541 x 82, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6612
                                                                                                                                                                                                                                      Entropy (8bit):7.943206975174219
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:jSDZ/I09Da01l+gmkyTt6Hk8nTMVKh4rpfjDXliiulxWYwu4vw3eP29VIaUz:jSDS0tKg9E05TMq4Nf4QYw43v9V2
                                                                                                                                                                                                                                      MD5:13029396423BD78CCCBB0223EA143844
                                                                                                                                                                                                                                      SHA1:D23C69FE2AFA8469C06CD31FC8FF077B415EABC8
                                                                                                                                                                                                                                      SHA-256:9979AC854DABCBFFED54312E8EC33B5C0402E220E100E47F0A22852EC695F248
                                                                                                                                                                                                                                      SHA-512:32D34F2FF23DDF24D387D8A3B8A4B1D9258F525B785807466D9FD88A4097C288F0FC89E6B1C5A010F51E5C92F6941189404E194D9A3A85978F77418AA53AB85D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......R........ ....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\jquery-1.9.0.min.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (32132), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):93205
                                                                                                                                                                                                                                      Entropy (8bit):5.288083612999653
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:fYcvR3VhH37Ha7EmakRhIHASkCDy08otU6myJXXxMZyYk0AjrzCqlKDo9YhnaTdW:fY8MaW2c+UELKUqnAdib
                                                                                                                                                                                                                                      MD5:90FB2C3EB8241D4E59B0751972C609FF
                                                                                                                                                                                                                                      SHA1:7BD0AFB3562851DC6B9376D6B1E14E7DE3FB003C
                                                                                                                                                                                                                                      SHA-256:369907573BB02E2C8355F5F629367103A62A999A19A5C9F249473A6FF7DBB637
                                                                                                                                                                                                                                      SHA-512:3EA7FEB856EAA7BEB4FB1D8BDF1C637605CABB43FE1F3E8462C8A1C394528E42CE6BC460287352CC05A2911FEFA7CB929F5448EFFDF1C30EDFC6C443A1C3AADA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license */(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()||st.guid++:f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==typeof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\keep_changes_guide.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14533
                                                                                                                                                                                                                                      Entropy (8bit):7.978234763785096
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:vbRTZyLGqlTGW2+6E7JfwA1fKUCYhVwKqpU:jRTZyKK6E7T1SUCYhVwA
                                                                                                                                                                                                                                      MD5:AD6E786595C48812BE2D9BC7FE5D1485
                                                                                                                                                                                                                                      SHA1:E98E3B2DFA4354754EC58188D88F6687DC239E22
                                                                                                                                                                                                                                      SHA-256:4715BA3F13FB3554D64542BA93605E87DDB8601301F2C15B9CD65B708FFFEE57
                                                                                                                                                                                                                                      SHA-512:2C0735D80841CEA8CE8F4816E9548B5A9474530781B1510A1FB72951EB36679B43F4ED86025CB9C5B8E2E81432B356D3466ED5FFE5A783773A77B142253BB0B6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............~B.u....pHYs.................sRGB.........gAMA......a...8ZIDATx..}y.^Gu...M.V..kiY.dk.!v,..bl.c...c.....@&..0......rfB.29.....5... $..c[F.dc.,.R.%..t.....^U.......^..}.~..u..{..u.V...S..r...c../Mu..n..Z.8..@.......b5..Q=/.O.\t....r.TS.|.1......... ....`.J.s....~....$+...U.V./O..kf..t.g.*...x....J2.i.y.G..#...d.Z.5.(......K...o..4n.W....#G.>.<....'_.!.].P.P..*.._..=.ya...o..`0q...zd..T..f...7TXci.d6....1....9......._.p..9.i0......*....:..%.D.Q)-...e.u3.y,..:...<.VW_g..].....o.U_.n\C..8.kI...l..ux.Y01....WJ.q.Q.I&....C...J )..T....<.....v..b.u0..qv[.s0An.;..tC...S:.:XzB_G]....O.tc..1C!.....Ly.I.a.~xts.A.%.{....4...ln.g.)..........=y..@...:..QQ.]i...0....p........5K.xxTE.:.}...q|...pq.SSSX...5.Wa...hin...)N.p..G]H..O..j.F+.<@..x......F.}.[.F...2-...%...=hmiv...$f..a.4bI+...C;.L.6.iM.....G.......DH.}QO....|.Y..|.i.Y.....x.......e..:.eZ:t..p&,U..KL...AM.iw..7...T....t..\oy..2%.!..!.p(V... ..X. V......).,.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\loading-spinner.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 200 x 200
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):61451
                                                                                                                                                                                                                                      Entropy (8bit):7.343059446968563
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:9fvs6a/gxRWNtTA4EOvbc51qb0zFy/Sc6mS8oyYVX3YeP8XFWZLNCih:9fkj8RWNtTA4EOzc3lBl58AdNCih
                                                                                                                                                                                                                                      MD5:CBE8A62A079FCC257A6334A506A865A1
                                                                                                                                                                                                                                      SHA1:B0135BD4B9A31BC7105111213C286FB3C06DEA7D
                                                                                                                                                                                                                                      SHA-256:3A0F2212D503E07BE1246CFEBBBDEB40B642A44B4A3DEB959DFF78063A9822E0
                                                                                                                                                                                                                                      SHA-512:C7AD87184B524C5908E9832675188DEC751484C849020031F91E5030AFA94AECEEB2DF3777657533947339A48A96A24C21D22D29C4A51C75BBF6000634993A05
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a...........2/.50.4/.4/.4/.4/.4/.4/.4/.61.>9.E@.HC.HC.HC.HC.ID.ID.ID.LH.UP.[W.]X.]Y.]Y.]Y.]Y.]Y.b^.jf.nk.pl.pm.pm.pm.qn.qn.ro.ur.yv.~{..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,............[..H......*\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h..x...W..[Un[.u..j...}.J.,.*..N.#f.x....B..RF...;..x...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\logomark_white.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):343
                                                                                                                                                                                                                                      Entropy (8bit):6.9403490183632535
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPUp/6TsR/N7FDkQp+Fj4zBeQzdHLqOkNTcvKMK5iloCQl53fHKxgjTfv6Rp:6v/7Q/6Ts/N7tWAHdETeKMKsoCc53v/+
                                                                                                                                                                                                                                      MD5:37F342F2D1658BF871B235B20CC254B5
                                                                                                                                                                                                                                      SHA1:137F20C7685717B19BB089041AA03FA001601D09
                                                                                                                                                                                                                                      SHA-256:432AF358A422B668D90A9B05D2329922BA20DE2E24F419232967601E7B8E77E7
                                                                                                                                                                                                                                      SHA-512:B20465A790529F063309426AB878CD67823EA40FC5B464C5ABE2DCD7A26721FB57D26BCFADDED47CE584E0F575CC0FF922C29DA2DF6B8A18AECD567B678B5DDB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a.....IDATx.....0..[....n...&8.n .8....t...6...;...[z..../5..g(9.B..5....5..7..K...fk.....D.......~.b..'Od.B_..%....P.T.(Y`......i!.....\...l.F$....l...=.ab}.;.f......N..Y.K...ffy.(.g.....,.<.M..2..Gdio?..A.W.~w.....5...:S...S....3.Z.......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\main_close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 7 x 7, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):535
                                                                                                                                                                                                                                      Entropy (8bit):6.070255751604191
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7nsXUyptiPCC0turztDt5q8j1Age/6TZ+RyxtWcHzSoLiKEMBLKBd:YynOf0tiztDt4yxe/6oE8cHzhmKEMBWn
                                                                                                                                                                                                                                      MD5:78118351597A04AE4CC8D899475BBA49
                                                                                                                                                                                                                                      SHA1:3EED037A8879EC6F84C2545CBC3D710494C2FF88
                                                                                                                                                                                                                                      SHA-256:D9059CE8A29D6CE4FB46BBC2292EFCA3478FB5D2DF106B33D4A37B50E41FEC39
                                                                                                                                                                                                                                      SHA-512:DB64A010162385441800F0CF0212C68791447EB5361793389BC632B7B14E15EEA3CE7DDA89987EBF7414334022FC64FBB1002816532EA106F0CD873D109A1081
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE[y.^y.^y.]y.`w.]y.g|.[x.ez.^y.To.\y.]x.]y.]y.Zx.\y.]y.^z.]y.]y.Hu.\y.]y.]x.]y.]y.]y.\x.]y.]y.]y.\y.]y.]y.]y.]y.]y.^z.]y.]y.]y.^z.]y...........,tRNS.............a}.C...l.3.>...=B. i.S.U-.`e<..*.>....bKGD,..q.....pHYs.................tIME......9.3.....@IDAT..c...g`..d.......``.....af`a...gcg`V.VTR.`PPQ.TSWe.........aa. .......%tEXtdate:create.2022-02-16T17:16:42+00:00.v\^...%tEXtdate:modify.2022-02-16T17:16:42+00:00.+......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-1.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 87 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1559
                                                                                                                                                                                                                                      Entropy (8bit):7.837839289025892
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:s/6yUlzHLuHwW1nx0MX/pET0ltUxHPJH3jT2M0wlH2s3R3LqyT7UFStz:s/6yOLP6vX/w0YlPRT2M0wlHfLjYstz
                                                                                                                                                                                                                                      MD5:FA83BC8E14C9D2734DDBE84015E5BF3A
                                                                                                                                                                                                                                      SHA1:2A863213DC1905FE82EFE6B1A5C4A039A34569B7
                                                                                                                                                                                                                                      SHA-256:89F1D402046412A2921E41B0C4660DFCC9EE8C126EE8852CEE8B450038836B2F
                                                                                                                                                                                                                                      SHA-512:3EEF9CC44509E74A4147BE230A372FC5E29E7A8AC85BB08B03FC584D9AEDECDBCB609208BA8951802FC770F70CA570159AC693C8BDF3F1EA2EC9F1F160A694C2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...W..........]B.....pHYs.................sRGB.........gAMA......a.....IDATx..X.j.G.>g....Mb.J6.&..(O....^Y~..O.]...].-...V. .U..$?A..........hd...v...=.^....\...F.g..|..9g.?.]....;..}..eD'.V,.'&..(.......MO/..J........8.7.o.6..h..4Y...T'.....MO...1.,....I.....f..yqr.?.s..../e.lIeo.B...7.&....P.bSel".Y..y..a..:+@*>g....B.j.E.X....l..;t.h.A.vw..FhbHq.*Z.KH2WA.:H^...@...>.p...:{,...d.M..^.$......-M..Gp.S..).\.r.........#.Q...Z...1..g...(!...'.7_m.C.T:=....8.....R........%%..@...q...1....0.}.?....H......)..5Q..x........i.8.$...i84J...&.lr..).....U@..H..eaq,..k..P....h...b.Ur......-gN....7..OPd.=rt.)\E7.kC8#.IN..}.7ol.i..%...\.=......hMy...t..i.#.........$..r...n..2 %.zG.@.B[=...;.....K....<b.#C.B.B........K...^.B....!...V.mw.M...d...R+.\.......t.. ..i..13.b(}.!#..6.B..qH.cn....Z.....E#[%..........P.06....B...3......;ba!...-.w=!.\......w.....&.....T,.:...i...Q.k.~..w^..S.....'.P.<.G....G<14.`.p.D7..u...#.:e 7..L..9V....r*.\R..g...Ml0d.d.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo-lg.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 112 x 22, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1940
                                                                                                                                                                                                                                      Entropy (8bit):7.870572433344458
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:XC/6ajsovRkZHy/em1P2FGb2bQ3t/3NJ4BNofx6yRQG4R:SSagovk+emwqQYbJIo0yRYR
                                                                                                                                                                                                                                      MD5:2E6E7984268E9D344B13491198D160B0
                                                                                                                                                                                                                                      SHA1:E88EED75E8E8CA8A2458761B561927B6DABB8C00
                                                                                                                                                                                                                                      SHA-256:3EF3E4739C30F116531F7B40BD0E14D3A487C3F28C27B52C47EB04D8AB0B9C5F
                                                                                                                                                                                                                                      SHA-512:E60EE5CE3183AEE8C157CFD0922F9310103F0B291254897FE504AC0F10C440F3F7D3A32AED6383E8AD63D4414BD8E27A0C773929B63012D9CEB792445FE5EDC8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...p..........M......pHYs.................sRGB.........gAMA......a....)IDATx..Y.n.G.>3.`T.\..6\d....d...O.y..U.6.5Hq..........^...^d..8i......~gw.....M....I.fg...3.9gFx.R[.5.:......t.J.<...2..V....mT:..N.v....]...,."../Ju..Q...v..k.....kB..$.<..s[.z...?.H.\L..E.bb..6.a2.._-.4{}W..M......._....e..W.q.!...!`H[x8....W.L.7dqD>....R..O.S).!...S.,pR.Pq.....wI.".d.M...bm.X\..y...f..:.`7{.e..*RH*.,.X.R...1.P.*...XD...2...]..{..S.S..V.5/.H*6.2eb..Xg.v....3...b..G.\5.|v;X.7.b..C.....R....LJ]..*...\..{..]:[....^../....Z..x2...M.]....jM..l.I....&4qF.bM.v:L.vE.'.Y.h0.."S...y93...W..;.........s......4C..H.t....n...((p.4k.5/.}V4..HF!8 a.k.........nr.r.j......CY.b.d.....H&.Y3f.$.4.J.Z....w{=6r..l.o.....V_>.?.'...x..b..zY..J....h...Ay/..s....o..*.I..c;s.\^..^4...U9...r$..\....l..m...1..6..q.........+.Y.V ;....|'.d...b.=..]....4Pj...BK..X..&..I......L_.m.`f..iQT... .....&.ou.0.'....c..;.=..t.c|f).....i01&R..7oZx..B.?.}....J3 .KTD..A!O<.....jJ..,cA.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 86 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2238
                                                                                                                                                                                                                                      Entropy (8bit):7.897965521812157
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:a/3bdLf7SAa7meAyze8p8XMnkL4NpP+Tl1TcVhCx4:qLddUJAyzVZnkLu6lF8hCx4
                                                                                                                                                                                                                                      MD5:2B2ED7BD7CD047459628DC4AE1728E85
                                                                                                                                                                                                                                      SHA1:F8F4933BEE5717D3CC67704F863896258EC023E1
                                                                                                                                                                                                                                      SHA-256:1DB0EC3C7FFD1C9DDEB5F0E4217C1EF38EB02700E4A7F3A557D1F052092D4E42
                                                                                                                                                                                                                                      SHA-512:B3CE912074BDE9758A93B18C6478AEB689A0AAEBC5F9D228A5C95F045C0BA24963FC7F32EC1E1BC93D50890132D3B1515247C9ED3DEFD99F517752A23BA7EAB5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...V.........G.[#....gAMA......a....uIDATX..X{p.W.....4,y.y.n..S..U.E.I`j....X..-.j..Gk.U..QFl-.p..V.Ne.hU..PBv.yF.....iI..I.$......../,.M........s..{..>vbAa...Tg.1....j-......R..M.?v..Vk..V..<.........y...t..%W|A.v..v..t:.......i........-.xud.!...\A.M.X.e...?0.7.w5..9......=1........~../#.wD(4.d./...-|..V...<f./l.Z..:..j].H.8..P...q....YZ....jsg-..I;'UqBJY....!.L..:......g.,.#W.4..y..f......=..<..B.......|..<..L.....G.uR.z.L..?L..H..al......W...4.3.......La..}.t_.".j.p.;.....'"..]yy5.... ......=.Q....QH.R...TU.I....f.......v{.V...?.{.......D,....}..b2..6.......^....nf""...\|.............w..J.i.W3!j....JCd...e[....$.U.F,OH.8....f.v.....z)z'.../...`8Pb....`xf.........^.7..`.K..}.c.S..7/z..Q..e.!9./..o..`.7.....v.$.'..X.v....v..".B._0Z.F..#......S]O..:.r.N.X..m...........Dx.....]....s"Bt.6.<..F.o+.z......B|..5DC..).,..y.0L.X.5$.Mh+.\].....Xq...~`..8..;YQ..t.{&....H.l.b..3..@(...#r..,......-...,..#..,......C7..6~.h

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-logo2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 86 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1201
                                                                                                                                                                                                                                      Entropy (8bit):7.763272753991154
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:8B/659eWA6XuELEiVKshz96Ajxbd/ErBYPwxhYvjtcFpcG69X7VSkHVs6Lb:8B/63VXuELESZPxbSVYPwUvBcFpc1Dpb
                                                                                                                                                                                                                                      MD5:A624A806CD38AA64130A0C228271DE75
                                                                                                                                                                                                                                      SHA1:118201F6A512D67C5EE112CD0A0C4EBD5C66FAD5
                                                                                                                                                                                                                                      SHA-256:A6E96121FE3D151FAFF5B247F926F93D27790250F9E2A27BAAF841DF5D82B6E1
                                                                                                                                                                                                                                      SHA-512:D8C08C245A6F68FFC058D2571567034229EBB96A595B17469FC7B6E26F6BF47FDF34C2527B5800667790F88648CAE8C7F262677E53CCB713968A6C03B0D54FE8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...V..........W......pHYs.................sRGB.........gAMA......a....FIDATx..X.Q.J.n..b}["x"....dNr.."@....$"."...8.t.]>`G.2.n..w..t.j....v.@W.4......L.]..,......&.'TUGdL.|.r.....N@.XJ'.BL).&(........A...L. ...,...d|...`0,...8T...EQl.PU?.A...!..aZCL.w....^.....v ...xUuI,3.1......s.1....g.uj.#Z..A.Q...^.9ww).....Jz.....-..d....k...C.m.=3(....rc.'.avwKM.u!........%.._..;4,X.}vbh.r..s.W.4..o.3*.n.B...i{_..Z...7..}e.Q.\n.j2j}.T@"O....Z.B.....b/..l.[.....G..3d...&....AS.UG5..Q..)e..<.5....|...O....g..b#..Mb.B.s.t.........R..;.1o..`..[.a.,d`E.....9.oT.........9..}....Y....Vf. i.3.. .....]..&.)...S8..u.(u0.N|.....+.(........:.0.m<p(.[...X.P....`Hu....!..c...).Bw..|.F<".7..;..........fT.......|..P.........|..-l.E.Y....E....L....e........V.W.]....~\...j.a..8...G4J..uC....(.....W6.....\..FDk..1...n.. Z...:....C;.F...jvbp.).....n...r...w<.j.Z....Q..|...u....8e.(.M.,B...E'&1............._`..../....6'...VU.....amZ....E..;...Y....S..(..B.m..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee-wa-logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 154 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2089
                                                                                                                                                                                                                                      Entropy (8bit):7.869800467961287
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:rkB/6Q3xZL5SraMMlkopWj0tAPMYZT8C3JwifFX7+6/g:r2SuR51hQj0tAk2ACnBg
                                                                                                                                                                                                                                      MD5:96D3FBD61D479F4F188A025B53D4B63C
                                                                                                                                                                                                                                      SHA1:4294806A93CFA7B232D82D805C26B368F111899F
                                                                                                                                                                                                                                      SHA-256:DD62F1970E3DFF385709002AE676B93F9CC5D4C7AC37492C0F1E0752F9FFD057
                                                                                                                                                                                                                                      SHA-512:7E8BEF427C4E798D2515168D0504B87487948E12916AB5F1EDF0D2C584DD9FBCFC785A37A8BF48DEBF5479ED10225B2FC1B8D81DC94E0E9C997779DDBA8E02FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............f.....pHYs.................sRGB.........gAMA......a.....IDATx..YAr.J.....W..,.Hy....'.8A...?..... ..&'.9...LN`....,._.W.....#Y..;..]%$.zzzz._..z.htZWW}...k.Z.Ry.7.....h......h...o..@.:.s<....}......vG.qM..w..~.....Q.qqV..;G.....8.......y<.3$O.@tD..9..uG.g.puT..)...j.\..{:.s..A...v.d.$....s..r0...R..y..Y<22 n].5...r.e....`x0..q....h....b.sF._....>{.\%....54|.k.4......J.d.ur6...{@g.t.z}...c:G..;P...B...x...,..D..|k.8.Z_..n......5U.t...y.d....`.[.,S..W.....n'|..5.N..."hM&.....?....|.SRrT.N..H.l.J.....W.....P..X*....u....-O...O.rA...Sn3.0.s,na....f<..8...1Fme....E.~.<G...b....\.F}=0O........D...^.T...a.B....WO...g)....u.....6w...F?N.Et+.ky.o.7..d....Q7...6.g.j.1.<..~q.s.^_.......+...v.......,.......__....(K.sJ".rq.*m...)..g..s..fx..N.0.v".P.....~.....C..`t.nx.;...9]..$:..T....h....l.C\8..na.S...4Jtor...r..h.<....?z.>..........A.Je(..Ml.'@.y..1C..........v..j.$..,.p'"v...P..].yu}.9.E'..Y.=...........s.ry.- ..L&....)...P.t. A.%

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 67 x 57, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2052
                                                                                                                                                                                                                                      Entropy (8bit):7.890065571351557
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CHjblGYXQQEZZyIOrNK6rC4lWVkOjKpgOojQ9dCe2LfmC:PYgNZKJKSC4YF+WjyOZ
                                                                                                                                                                                                                                      MD5:18344204EC04F1E95E086D3BC94FA0FD
                                                                                                                                                                                                                                      SHA1:87CA3ED8948774091B451F7CB2F95139E56D351B
                                                                                                                                                                                                                                      SHA-256:30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
                                                                                                                                                                                                                                      SHA-512:13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;|VO..{{{).`"...VAb....u.|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.|.K2..'.{.j..c.<.|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+.*...KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......*3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d|..?.8S.........}.|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafee_pc_install_icon2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7205
                                                                                                                                                                                                                                      Entropy (8bit):7.9471260512499375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:KS4Do1RyFyKSZ4pTSumpAO/Ap6CQU9Uw/JLO/xvifnL:F4E1RCFpWumX/Ap2UeMq/xGL
                                                                                                                                                                                                                                      MD5:F2E3045621ADE164E9DA40F294BEB00C
                                                                                                                                                                                                                                      SHA1:36E9D967C679FC898BED1FF6751A73BB863EAF79
                                                                                                                                                                                                                                      SHA-256:D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
                                                                                                                                                                                                                                      SHA-512:7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\mcafeeicon.ico

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):285478
                                                                                                                                                                                                                                      Entropy (8bit):2.4849077310090886
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:gtOQaZJ9Lhsvel7gsxdrTr8M4JnGirZTiAF9EOoRoQoPEgyY7oooxro:SOQaZJsvel7gaWNVx4AF9EOg5O7BAro
                                                                                                                                                                                                                                      MD5:F7D9142AC3C0C7228507E927D05F9727
                                                                                                                                                                                                                                      SHA1:7B8C9829534DF5B2BAAC806141F72B0AFDCB03A3
                                                                                                                                                                                                                                      SHA-256:F91461D2F81839CB58DA4A9FACA47C51352558BB636C522F9272519F7D910E61
                                                                                                                                                                                                                                      SHA-512:5C53D7B6496CFC4A855A7CA9F95D2F127139CCB812610F74790867F056EC48A4F3A6F2CB95574FCF0AE027B9B3497F0D80B1FF235828EA66C92D18603081E725
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:............ .h...F... .... .........00.... ..%..V......... .( ...:..(....... ..... ....................................................B......t...t:...........................................V..............u...t...t...tN..t........................j......................u...u...u...u...t...t`..t....................................h..tp..t...u...u...u...u...t............................T..............t...t^..t...u...u...t...................................................t...t...u...t.......................................................t...u...t.......................................................t...u...t.......................................................t...u...t...................................."..t...............t...u...t............................2..........t...t...t*......t...u...t.......................................u...u...t...t...t...u...t.......................................t...u...u...u...u...u...t................................z......t...t...t...u...u...u...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\minimize.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):195
                                                                                                                                                                                                                                      Entropy (8bit):6.068066723651005
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlJlawvlkV42/uDlhlp8Lts7CX9/Bxdzo1i9MsN2ocx1PmnCCj1vkxz:6v/lhP70wS7/6TsR/Dvo1oiPOnuMwkup
                                                                                                                                                                                                                                      MD5:DC1EB36132B94A110553E31FB69B06C3
                                                                                                                                                                                                                                      SHA1:B5E281F185E2A7159B4E1EE74C27FA31E00EDA03
                                                                                                                                                                                                                                      SHA-256:237B2E4C1D42366B7EC89852F5C43C7D12C961D2A8990A87FE5CAC827C6C2FC2
                                                                                                                                                                                                                                      SHA-512:3E51E41E82D903AC06A911CEB70861F49F682E6F22AB6EE07DE8FE4B351CF255F9D95FAAE7282C516C9226E56C6B7C8DF87135F0E7AC699F7179B4D176234E29
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............;.J....pHYs.................sRGB.........gAMA......a....XIDATx.....0.......A..9.....Y. .Kr..T..[W|@.]C>.q...bE.I.s..........TL*..V,.E.q......X......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\msac.ico

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):334740
                                                                                                                                                                                                                                      Entropy (8bit):5.49770045405099
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:vYW4/fFn7A4xnC0IzntmbG8B7doDbtYdLVYRWns6yC:vJCffC0Izntm6S7QbKDYInKC
                                                                                                                                                                                                                                      MD5:83923FAC3D4E58231B7527BDFACA2794
                                                                                                                                                                                                                                      SHA1:492C8D0F08203EB28A2999895B1B5994F51F630B
                                                                                                                                                                                                                                      SHA-256:B6E7BDFA89B2445E120C0583BF97EFA915DFD43BB02CB129C2D9267AAF3BA618
                                                                                                                                                                                                                                      SHA-512:A8A5B976417B19313C2939BD2BAFD9FB918A1F413713259C120A296BEA00B49D36CFFA1DE25A9C58D2987007FC9BBD4AE8D198C7D37448080C8E34D8EEDEFE54
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..``.... ............... .(............. .(R...#........ ......u..(....... ..... ........................................../C..0D.*@T7,AS..$-../<......................................-@......:Ri5Qk.=Yq.<Vm.:RgS5K^.(9F.3HZ......................-?.Gu..!<UT&D`.>]x.Ig..Jh..If..Gc|.C^u.>Wmd:Pd.;Rf..........#3.0Pn."=U@)Gc.,Li.Cb}.Rq..Rp..Qo..Rq..Qo..Kg..@YoeD^u.........%@X.$?V$2Oj./Nk.-Nk.Ji..i...j...e...^}..Xw..Om..B\rqHd}....._|..:Zx.Cc._Qs..Gg..1Qn.Uv..p...q...r...q...n...d..._{..........^...]~.,\...[~..^...Qq..Wu..n...v...x...v...t...o...j...m..v]...Yz.'\~..a...d...b...?O..&*..1;..CU..Vo..h...r...o...f...c..;d...Yz..^...f...g...GX..%%........R...P...i.."w.+;{.:Wx.Pr..i...`...Z|.D`...b...:Sr.,1..--..."a...0...1...D...x...j..,R.Op..^..Fd...a...f...<Yu..2Y./2..01...!U...4...7...:...~...w.Jh..a...`...\~.89Zz.:Z{.9Zy.9R.../..-....'...$....z...Q......!}.Vw..`...c...b...;\}.;\}#;\z.9O..#$..$$..&&..&'........s...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\open_sideloaded_ext_alert_guide.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 189, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20549
                                                                                                                                                                                                                                      Entropy (8bit):7.986108821429097
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:ekwMaIBryFTsB7sckuOrzdqL+0ZgDdNiC+Pjo0eiTGhXDEi0t+XKWDt:TwMaINyFQhLRizdy+06DOLjBemmzEFWh
                                                                                                                                                                                                                                      MD5:0050197C4E3C6801D783762609EF6226
                                                                                                                                                                                                                                      SHA1:5B1E4016652C53EE3729D3125EB3F231DD69A206
                                                                                                                                                                                                                                      SHA-256:F42ECF07D3EAD5B48C1125B19F101FA4B3C6271F4FB43196876003615C31F31C
                                                                                                                                                                                                                                      SHA-512:B527E6A611394798E8467D797251A094FD9E06686CFDD95C40545697E79308246C51C007D9EBCF8B6A5B56BF810A851A10DAED9AE1DE9995B757558DFDCE0F73
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............)......pHYs.................sRGB.........gAMA......a...O.IDATx..k.e.u.......0......`.....H..IP$ER.c1J"G.Rq.J?.r.........B....-+....T"..-3$%.,.!>.........<f...}..{...k.^.....pa.u..w?V...z....q?z...5m .D{..K.....hC..c.|\F]V..]u...O_.nK..*..N%~V.#oW..........5....".....D}.%_.....MHS}..._/.G......Z).c..J....>..zsz.6..z...*...^[...Xy.h...l2..IT...\..R=.}..0.P].8.N..6..V.i.|...O.ur.|..u=.....2.x..>...K...>.....GP.<.3...6.R..78..G)..x........6(. .3...Q......r.^.....x.......q..@...]/~......F.v.W...IJ.3}......n>....l.-_I.0.;u..j.B=.9.y.?.d.].lB.C.....xQ(..2..dr..'C...B.]._.(e.k..O....9..2..p...=...y2.".V..&.lk..P=.x..K....J4..%1R...&:.%ax........B.k.q)....p..$...B+..:Y.s|.B,hR...j.K......-...G.1....-x.(G..1....+5..?..#.......P_.....$/.>.e..l..c...... ......@.p...Z`I...5R..BV.8c.L#.\.... %..B....)AS.,.>..296...B...y.l.b.r0.O.D0...^e.iDL.5Xyb.RPf...a...MTL.4.x.t....\uf2).J.6@r.../....$gQ.X.r0hvrV.|J.%...d+..#o..._.....G..a....+,v@

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_0.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 173 x 174, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6169
                                                                                                                                                                                                                                      Entropy (8bit):7.9459194185380495
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:dSEVdqkq8aVCRBai6cYQLO0lGHhzrYvET:c+dqkq8aVCRnYTh4y
                                                                                                                                                                                                                                      MD5:779DFAA69A79BA66B20CAD0BD22F5EE6
                                                                                                                                                                                                                                      SHA1:98226967ECEFCA769E6B653A54E8AF969CC329F4
                                                                                                                                                                                                                                      SHA-256:34194DC7D094C4A0C5332A9688C938C83A31C8C37C4BD47A23E602997655A9F8
                                                                                                                                                                                                                                      SHA-512:8B4A01D1E101600E56CBB1422D92D255515F5A044C09D4E89FCDE71E658F790FA6594B14702025115B817C90B3908CE76B021F089F503845A877EB21C0E10F61
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............D;......pHYs.................sRGB.........gAMA......a.....IDATx..]...u..3\.......m...~(....o..V+.-.Br?`[.....5`K.S%;.kK~(R.~(PX....y.-.(..J7..OQ.j.;.J...Z.h%k...7.....rI........!.\.....s.....R.T(............5.82bo.....1.U.o....{.Xg......2`....j>g..Z.-.r.b.......6........emW... .`Z.0..8.A.V*....s`p.hQ...R..u.....)(d9[...Y.q&E{..g...u..5..:..d^.x...L.x..d....j...>..t.. .QX.dE..-Z..n...b..l.D.Z...T.1........I...Y...l)....b`D.Q.*.u:..5.y..T.\}o.....o.....U.q..R.:.f.V.F...,..~.F.R....v.?.i#........!E.J.f.........R!Z......7v.....p&.~7.\..K..{.......d.-CbE[*}>&A.3V.o.W...I.......I!.Q7Q.5.5....Py#)}.......v^......k.J...|].....z],..5/De.C..Q7.q.Cn$...r6..U.&......*..7"1v!..u...].....q......KW..6.J.M0.c....'.d....T..........lF...A....].Cn...T.&......V..[..O.M.nv.~....;..H...3I.O....a.Rj......hQ...B..+[. OK.3[...9E+a....Z..eA....G......~....:uW..Y..\.1<.......-V...#qG.l.....I.A|T.t.sk....db.nl..Gg...g.).....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_1.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 172 x 173, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5131
                                                                                                                                                                                                                                      Entropy (8bit):7.9309654446277476
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:lS5yoYOqOOEaiMp84+l5poeitPG7DHJwcx96N4W/BqKB:lS5y4qOOEaLiTHJj96N5
                                                                                                                                                                                                                                      MD5:44FC2B1768487E2F1F04F95F14B8C388
                                                                                                                                                                                                                                      SHA1:FFACC7F192C58F5B247A851984239D7C86304364
                                                                                                                                                                                                                                      SHA-256:2F22DFA6EC29824123DF3861B7C654C49B3A7935511E9138E26F800483FD24BA
                                                                                                                                                                                                                                      SHA-512:16B28760DB3B252B520397E1158862322B522B07E63BE85501269BA13DA88685C852580F72000C76C86F83DD078DEE7C32BF157D2739D247B1B73DF99F697ED0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............-m.}....pHYs.................sRGB.........gAMA......a.....IDATx..mR[........ef.e....<.@u..!u.0.@....1"....*....V 7U..G.\......*3P..9g.......Y..|.....@z..>....G.@pDbq.s.....s....KJ7.3.Yh4..{.p.....X.W3w..`.@-..{H.....P...'.N@u h..?#.:iU...S'..8.v.....%. ...Q.E....7.)..4....Z.m...e.L<.#PH3M..7.>>.........^........(."d.46BS.H....].........!R....#^..>.v.g.k....Y.|..H{`"/..c@o.h.r'X.Kg.6....^....t.{....@N.`.....h..<|Rt...V......d..f^.,..*...c y.nf..:9m...g....eN...E..)...no.2Y...(,....e.&dB..,OM.#..#..4.7......8.n.#..n.R+X.......O.NZ.m*.;...+.U.O+..h{.)!U......~j..H.).5.\..............= .X.H.....R#..?....SY..b4...>.S.T._/.C..Q...9{T-...........I...}H#...^mM.".B..G.w.].i....~.....?.&vI\..:s...gt..yN7%...5U.....U.a...7/.q....j..).....*.S#`.....ibl.B..a.c..S..m.B.d.U..HK........?2....i..Ho...i..f*...X...k.B.eE..X8.^'+.i....;...%..I.....R.7.KY.,....`J.@.6Q...>......+/.C... .LO..61.Z.".@R.H....p..m".MR..XG..E..m..n...]..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_1.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 416 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):942
                                                                                                                                                                                                                                      Entropy (8bit):7.531868737958494
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:9s/6Hwf01d5/znYDjqWy8Yi5x7fzO/eoTMO/0T3hQ:9s/6Hw81fzYHqWyyDzD2h
                                                                                                                                                                                                                                      MD5:50A8EBBBE54E38389C31C82D126B414D
                                                                                                                                                                                                                                      SHA1:C93D3B7CB702DE03C6AB2C8CF7C6520F45613FCE
                                                                                                                                                                                                                                      SHA-256:B5750D21ABAD17B37896862D5B6598FABEEC4B45EB1C327ECFE4056CC2E890D0
                                                                                                                                                                                                                                      SHA-512:E67712C56B2B5465BF9481DEFB814A98439EA9656A6F65A0F6A7355D30979C65093FA5325751F5753EC615E8EDD7BA604B9E3E7A5BD46F95179C6DA56012002A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....CIDATx...MN.@.......7.9A.B.r........i.u.m@..r..P.mo..u....]...:...i>....q.?..q...../D.........}...V...bzA".z....ZH.$...z................$^.HVi.Po.@......<.q+.N.>..o3...u;..:;zO.%.<..l.a..2.....$"A...Jd$..7....d.r....(RO..5.s.w....%d;.CCp...=.Z.<8~u...w.p.H.DN.............+..(."..W.t....$.;......pE6......Z.id`...Ob..O...C.yP..M.6o.......p.P..PB%..f........'...WT......%Jd...6...F....V(>N>#...P.....Y..Dw....&.Q._SN...G..?.../L.l.!Y?....:......d.g.]......c.8.O.l.B.1....Q.{,......|.=..,...-$..&L.6.~zL9m.>.F...(.0Y....$....!.M....A.uk.....X.....<..P..d..^...e.....Ku......#..8..<...%....\).(......F...eubo....<..........]..,..p.<.ZV....w.amk.V...%PT.Ff.<?9.2T.'.S..Z...$..!4.....t.g......"t....<@.....?I3`.\......p........?Hgj..>.?.....TQ.........<<.r.9...!..L..P....b).Q.......B.......f..#<a.\.X....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 416 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):936
                                                                                                                                                                                                                                      Entropy (8bit):7.559903053416362
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:9s/6BsT2qpwH99jdztSFrR1SZ5id3SBMKSb6b0oqqR:9s/6BsOjxQFr88SBTBYoq+
                                                                                                                                                                                                                                      MD5:1380B82254D9056AE17D2C9C333BCD5B
                                                                                                                                                                                                                                      SHA1:FD419D0EDF583E313F7F7F1BE565E7EB3F2519B8
                                                                                                                                                                                                                                      SHA-256:FEECF9909347B956549A39AB182F367F78E9C1306CA2DA146638CBDD3BFBA285
                                                                                                                                                                                                                                      SHA-512:9FC77FA74EA43F15ECC787FBC6299492196E8218FFCA1A6A4D750EBAF2A588FC14399D498FAD9B1DE5A3E0A316F3DD57350A1B2B0D67309CCA699BC96ACE89F5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....=IDATx...AN.@...7v.`...NP..h...z..9.,.v.d...J..$..n{...knP.........M...#.......v....L./".....X..^\n.f......kQ..7....=S......Z.%.#@..'.<.-@...WE......x.:..$#...W..A...v..z.G8.U..Xs.p....<.N.y.+@vG...T..0`...........~.....;c...{..P.......!5..x...J..DoN..!@........]n.Uj.....]{.5cd...V.n....r.E.3.~x17.. ....C<..;]..43...h.1.g.<x..=4l.Kk..........O.......Q....<K.W.T...S].......`..eDo.U....y(%NZ......J<\S.`...<....0..$.R$...J.8.....Q3/..,@....~U>d.@G.j0.\%.0vvy...5..|.>.@....]...........<.....z3l.<$.!.!..@E..P`...]_U$#....\.zSp..c...B+..B..l.ly.....(7......os.Y..u%..!5..Z.$....M.E..~.J@.A...I.AgC.z..g.?c.O.sh:....fQ.yh..h]..#..3 ........;..x..L.......9...wS.{2.M.N.5.&.y...y...-.{..._4..'%o]U........~.F.....|..@@.....3.........M.=7..yA/......<.N^y...8.F*........3.9../Zt..cA...<........V..c.iK4....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\progress_tooltip_3.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 416 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):664
                                                                                                                                                                                                                                      Entropy (8bit):7.3611901561562005
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/705s/6Ts/vZBGTY1vFn4D3brB0lG92JFFC/aE8Eq3b8jd7sNksCjz:9s/6EZBGV0A8A08WNksCn
                                                                                                                                                                                                                                      MD5:FF3D7C0157D5D1D9A28E91FB2A0E6662
                                                                                                                                                                                                                                      SHA1:F6B73B87D42B63F7BAA5A6CDE25961B6314CA913
                                                                                                                                                                                                                                      SHA-256:D55C2405879639524333F7262828C370B5331C8A39BE070CCDB888BFB4F715B5
                                                                                                                                                                                                                                      SHA-512:698830E86647EBA52042F0CCADA114B64C4462DDA153B563662AC6E91AE502A275B498649E3154C7A90CE1BE883C29DDC9AB8445F580562741A2E1C8DD4B309C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............).....pHYs.................sRGB.........gAMA......a....-IDATx...1R.Q.....Ha...x.z.3....0..h%....T...!.0v..b...VO@G.$.w.d_.. .Vg7.O..,..;....E.....U.......=....l#9U.....).e...^_.........hs.)..$[.rqr.!.....B......i.X.}...S.d........D...........{pr...P...x.{.2.6O.v.i.<......P@.......%8... Y.L?..Pz..x.{....t.|.!.+...Pb..xE... ..V .YC@......C......wgnC...'..v....; ........"....,..X...(Ym....B.X....d?......w.j.T..f/,..^.uT.c.A.(..=8..E.5].e.\yY...........!.@_.sM'm...P@.........F....NtOflC....+.....~.?.z.|......O.....P!..x.{........$W....`4i../..../T.K..{.B.h[nZ_.-!6..Igk...l}.X...x......w..F6y....5....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\spinner_large.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 100 x 100
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15416
                                                                                                                                                                                                                                      Entropy (8bit):7.756586242434715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:eK1L3Lk1UyxwO8tIZrkr+8t4vR8O8t4vWn2x8t4yLO8iDd3TCqM1oOiOvL:P1nkKO8+pT8amO8aenQ8auO8iDd3TVMD
                                                                                                                                                                                                                                      MD5:365D3E659634DF5D5289F14E1855E714
                                                                                                                                                                                                                                      SHA1:51010713312E23DD9ECBCA17A57FE944A678576F
                                                                                                                                                                                                                                      SHA-256:651598C518BC9F405F1DBDBACF89343D87B70DD2DFF93A01FD20F96C524E78CF
                                                                                                                                                                                                                                      SHA-512:2243FEFAC77C3CDC1CAA5E17BB01057A6A343D1852B58B48F7F34610814CE8BFDD47E9E2D3D3D12C8ABA543786E1CEF8E22E42D6159F222F49534C03845F4D06
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89ad.d..?....)))............................................www...................eee...XXX.............................................DDD....................................................!..NETSCAPE2.0.....!.....?.,....d.d......pH,...r.l:..tJ.Z..v..:Y..x<..(.....r..@{...DL8...=..t[.....6JzhaG5#.....W....kI...E......V........C8...&.U....z.B,..$.T67..;H..?*.)>.T....F....T<.'.F!....G.J...G.F...K.t8..9J"..............c.....x.8..!Z..CV.r.CI..),........t.H...?x.....%L."..0..J.$.2E.7.&5Q.H".qS..1<{.4.a..aD0.h...:#Ls..8..X.G......F..j....E..g...0...!g....a...E..@...\h...em..=...x1..\.By.z,....X... ....U3Y.+D....+...y..H..<9.!....Ac.=lw..?.E@......h\[....c...q..Dpx..M...=..^.;...J...K....P.@......s......)Q...!@T..........Hr..w].0B..|P..,l..mK08....G...`...8.`....w....u..6.v.."LHD...1..C..X.l...T....'.GD.#d.I..*...l........h..X.".)....W..T.d...0...uc.Tn..BV.@.w...b%.e..v^T.U.).h...f.....8..........'&..X&......P.bC...`...$.f:.zi..&.,......B[.V...l.l........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_ext_on_guide.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 176 x 134, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15075
                                                                                                                                                                                                                                      Entropy (8bit):7.979399641440617
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:B80mK0kjvC93yIZ97t991dRVGJyjz4poyVIor28Z2ci:TmRkjkRr7z9lwJyOoyVIuy
                                                                                                                                                                                                                                      MD5:2B183B9A55E2A55A566E6DF71751FBE8
                                                                                                                                                                                                                                      SHA1:F5EDBACF9DEF16D0DF52888EA7C398BF51601AD9
                                                                                                                                                                                                                                      SHA-256:6965355533AA0487DAC22F5D44CBD72BCA2C2ED2A75558DE725CCF5B8D1156D1
                                                                                                                                                                                                                                      SHA-512:47FB4AE6DCE69854D78190797DA2536C21C04E34F47CC4CADDF4746CA6B86EC522A6ABD2BCB01D2EF26E378513AB49E97AD470EB2503B345A15A80475768DC86
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}.......pHYs.................sRGB.........gAMA......a...:xIDATx..}i.].u..o..`..X.....I.+H.H*.Hj1Iy..E......e;q.8.r*..8.b.J.J~D.....r..Zh.2m.&ER....H,\.....`......>.t.}o@,#.g.......>}.t...s/.N..!c...sY..EgR.s..-^.#JK.3!s..Rt6."...zn:...f6%..:6.....g.jU=Z../. 0..,...L.."..K.W..9..:.|...j3.&.........Q....^<g3$.i.<..S..`.Z..?VA(..*-...__.0R.9..|..`$......$.5).T.....7.l ..>.i.x...|t...wMx.w:]..@:i(Hw...N[.l.K...4...8]...7..Ho/..@....T..x.o'.+.....Q|..2....&..u....P.......uC;......,..kh..mHDI......l.....^..C.OH...Hh.$..ei.C..3d...U...S\..V:.t..qH.d...2..A.&X...._\.P?/.......C} ...M.e3..3B >..v..0.._@R.4&.GB.(.<.%....P.y...I.'.T.].%..4..4....ZW.<. g.......H..H.........(...k$o...]...9.d..]7bna.....0= }=....4..NQ..$2../...y....XS.^..l...O.].:.)...E.iKH..S.....%...&"5.4..@M".N...X.(~-g......&..l.......Q[.....*.3.....M.....h.Q..r...0..G.M%.Z._...S.4F...x%4CLJ.d.y.........).V.(.<t.a.J..&=hSi..'.Q.d.l[.).. G:M...)N....l............

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 49 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1210
                                                                                                                                                                                                                                      Entropy (8bit):7.765526156253972
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:E/6VTSxUkuCt85lv4ufWEzeHjWbbUTIOg88TZ3YA6KvyJykQ:E/6wOHD5lNfLz9bba0v6z03
                                                                                                                                                                                                                                      MD5:1B45AA1C87C95F01CD701E67021C8EE8
                                                                                                                                                                                                                                      SHA1:C5F46E430683FAD4D9C8D97EB07FEB4B0AB05000
                                                                                                                                                                                                                                      SHA-256:8AFAC0EF4E2A13909896CC2B0BCAD6A2D0C5890A0EE801A7F9F95ED3E788F65D
                                                                                                                                                                                                                                      SHA-512:99042A14C120ADFFEECDED7FB9DEE60B0081DC586EE44D87BA47B7C1EEB0976CFC2ADE61E0AA7B90F30A69EEC1C30D95235C82E7743576F5CEE4B52BD57968A9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...1..........f......pHYs.................sRGB.........gAMA......a....OIDATx...O.G.../{.1..E...9.!..,R.UP9..^8F.R/M.=..zk.. ..!U/U.JT=TJ...+.......cm....;..$5...*...eg.....3..;......=...'.._.....E....6}.....v..T..Q..)...b:nR..x.....a...."........L(.....h$..4`..L.RC..].V.........{.......Z...3..."x.......bV.v.b2..t../.....w...f.....*...X[......uG.D.....R3q.=...8..."r.......9..8.E..&Z[....H.... .B.)........{..ah8....pv...h6.F..:>.'..i.H.D.J3Z h..'B.>..x.a .. `.r..!...l.*.......6.&.UO....k.C..9,.. 9.A...o...F..'!.......bg..N..`H.u'.9.T.../J.*x.S.....E......bum...|'.mODy...<?.k....N.N......[..U..q..-.z.W.qq..I.....A.J....Y.GR...N.LF<.Y.BQ.Bne.3s.8)S...$G...........?.......@.4M.x..w.l{.^....LL....#..........!.M...'.<.18........a.....)..H.i%.}....f1K........$..D..m....}[.>.1==M.S..w.....4.^.....[..........^.{....=^....(....C......QU.o.l.C.$.}ahhH......X{*u.B_../[Z..Y.p,...3.. {>jY..b$.g.h..*.\&..j.MZ29`q^jeLM$..s...^9...Q......._!Ko..!..P..E..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_on.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 49 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1298
                                                                                                                                                                                                                                      Entropy (8bit):7.791073489480044
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:E/6mSAjeB9G+FMjdZy1nnvp3jRLalTO/c/PvJaHydaD6DYwlociHVLw24/QhH:E/6PAje5FMcvmvRaHydauBlol8IH
                                                                                                                                                                                                                                      MD5:2CB18A9BA461F4EA1A627AC4457F310E
                                                                                                                                                                                                                                      SHA1:2A482CE4421739A75EA57905F6C9417D67B0599F
                                                                                                                                                                                                                                      SHA-256:3630AD753F65CB8FFE2592AA4DA02DBC54AD46F5E6BC14C9111E82235A739CD6
                                                                                                                                                                                                                                      SHA-512:1EB92F13806C98324B7ACAA5F636D2E31CF94A330642B8378DC0DA88EF22D5B9D40F6660A74C719B9EDB9196258212D6214A079F9887A96243E74E292101E521
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...1..........f......pHYs.................sRGB.........gAMA......a.....IDATx..oL.e......Y....H.Hf$Ct{.....^L...H.{a|...E}.&..l..........BH&N....l...:.2."..^[.^{.......A[.b............w.= ...;Z...y..' >.....dP:H).T'.qeO.....|.A.`&~....{_.....E.~.Z....t#.l....2..+....[....x\..q..eL!S.m.'...R".:..2...@c..xg...................y.Fc.......[w.....!J...N4VT......x..........3"x.PA.d...W..x.j.n.:.F..w...Bd........,\7...G.....V?....=.f.2.n.,<.9aU"....G^.$.J...l..MDT...+1=.R[.....j.p\v.9.G...."X2?.<.X^.lQ..Y;.. ....o.........Y"(.yB.[..l.eaI...' O..f.j.i...W.K..t..sad...)....).......8...?.-&b3V8Qz..'.|.\.&...7d./F.....)B*..#.t.~@$..j...+4`..I.}......6A.....M...<..1..C.'..`.._.p.e....i./d..~C.......... V..NZ^ ..N).....b..l.#..N...]....85.2u.z7....2..O..J...........?..j..s..~>.....1.tSL......Q...\.(..g.>......[.io.......}...X....f..3O...B2.1....da<Q...m...U..r..O..&.?q.]C......r..w...R.`.#.}....O.Z.....%.J..E.Qu../!.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_1_3.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3245
                                                                                                                                                                                                                                      Entropy (8bit):7.9134385325834735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5Sxtw6uF4h1IoiShJRcX3/okKqShNmdXXs8oG0S6Fc:5S3w6X+0XZcsFNS6Fc
                                                                                                                                                                                                                                      MD5:42B15F32E9F2B2FE7874BC8B5CEC3FD9
                                                                                                                                                                                                                                      SHA1:0095AEB7A50DAD717D5C831DA04FB692ADCED9F9
                                                                                                                                                                                                                                      SHA-256:0AA2F6F56226AA14901D0FC02DCC9FE7B45A86F49725C1B638252F90117181B5
                                                                                                                                                                                                                                      SHA-512:2113BDE6D0E5F0D96F55C1DC07A1351A697B0C1193FDCA41C5E452DFAE38B96E53D717C74A840793E53696D0C3503D8693B403639C30D56955B47DA0787C7866
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....BIDATx..._l.G......;.v.Z.%.I.(U+..mihCs..@....T...P....."......H..!!.#Q.}JC.<..VT....RKJsvZ..N.R......;g..8N......}$.......o~;.3..B.!..B.!..B.!..B...YQ>;.\.S$..g.3Q.r,...F..Kf/..h.@O$.-R.$$.>..>...e....{.).q...D.-.5...0.Z.R{.a`......$\.rV.FLS.....%6.. B..|v2eD.G...M.V.r`2-Lq.0..m. .B....DOK..#..k.....)N..]C....k>;......).N.G.BV..K..t.T.T.t..BuZ+...Y=...c..V.....0).......8s..41..@-.P..7D.&X...s~..Gw.c..5..cA.......~..}hx,#.9...H_.k>{..<r.Q...Z><......h.1....X/..k..{Q'.>T.R....')T..T.8o.VS,..@R.....0.uPs..SS......E......Y........;_?5.i.g_}.....>.z.U.*.L.^.g..A.C.9.[...\$..>.`Y....!..j76?.....#.^.F.....h.U?%.....{.<...>*.3W.Eu.X..'P'u.T.^2:T..@l......hR.TU*..._.y1.:.[...w.K...U..q.k.k.|../..y.uR...BU..........1%..L.G..%X.L.q...TCu.....kU..0....L|J..........?.x..X-.......Gx...._..B.'.-..l.. .z...~3.f.V.>E_.^.=shk.k.^.@....[.y.(.dU.k.Rajm-......Tk.H.d....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\tooltip_img_2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4647
                                                                                                                                                                                                                                      Entropy (8bit):7.934941782690532
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5SrHsLRJGNY3SJ7+U/I+TWVdFP8FFYTq3+Nas4YCiuSuWozqB1phz:5SrHaZ3k+UDiV7P8FFY6o4S/oO1x
                                                                                                                                                                                                                                      MD5:06438B94B66EEB804C86F363C62BFBC6
                                                                                                                                                                                                                                      SHA1:CF3D09AC9D952D6FF0A85D0AC9BEEBDA22CE0EDA
                                                                                                                                                                                                                                      SHA-256:C879FAFA5892DA6841E0EA09F2EFC9F68762E5A4752D62ACA8C9B95828B6FEAA
                                                                                                                                                                                                                                      SHA-512:38328E330AE12BC31EDEABAD908C86A1C486CEB0D14E9FF946E459D0E88243F3DE0EB603CDB6E31B4CA2EF6BF70428DB5EC54B3C705E3043C9FB0A649E11FDA5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a.....IDATx...l[.y...^.zX..Fvl..:Mj.[`...m..y...Yn.>....(..N.n..`..tK..v.4.....k..c$..Hj.(..nk.A.;.`Z.dG.P.eQ"y....EG.. /....`..i>t.....w.s..P(...B.P(...B.P(...B.P(.#..YI%..r?.b...l...#.~...7.h.......i.@K(.....8k.wE....,......1.~F......./.."e..+'..6].]BD.....F....w._:..ub.P..J%.[...sSksGH..F.x.i...C.me.eJ..k,1.R...&..>...c.4..pU..C(3.FX...6.c..hE.r4!...rq.@...l.nO..P....9...c..V9.j&.0...U`..Vzlx.7..\.5..../D.FX4..4....;.a.;hd.O.E`......^{...X...i...0....&..A.u,..W(3..]....0.t.k.Z.E..h......X...>.M?.Du#...i..Tb...7.......A.aXSS......8h0.g.U8..h8.I..........._.......^.+........5A..i.}.s.n.E7.G.FX..0pH........-..o....m(.E.N..7..P..o.vY.:c#....l.z.ZD.^...4.$=......n....a..\*...?..b'<.3.D.....-P,..q.K........k8...$.R.*..a.{..........C.....KT.;...#/...::.[R.cI\.j]....'.'.l..j`(.1..r%.{..E......2..XTR.....r.t.O.........i...8.7..=.5......k.E..JT..[.Eu5.....0.J..LS@<.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-checklist.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (33246), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):37458
                                                                                                                                                                                                                                      Entropy (8bit):6.111529411681731
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:h9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZQ+:h9DDI6thXjez1jtnz+
                                                                                                                                                                                                                                      MD5:A0C174F392DA4A589A64A76FEADB56CA
                                                                                                                                                                                                                                      SHA1:18D782269341CB2989816CF22E301AF6B5A8EEBB
                                                                                                                                                                                                                                      SHA-256:8A3B50F8B69B53CBA43ED8DF37B03B6E97125A9D4BA5CB417ECB5CCE0FE6FD15
                                                                                                                                                                                                                                      SHA-512:0788ECF185131F87E21A50255394B29615F54C25530F40617975CDB3F9FC512425FDFCCAD7AD663FB8C48ED295EE0704CD62BB9B7329188BED48C8BC091C1C5A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Open Sans Regular */..@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXhv4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-common.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (33246), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):34216
                                                                                                                                                                                                                                      Entropy (8bit):6.048849970432671
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZZ:E9DDI6thXjez1jtnS
                                                                                                                                                                                                                                      MD5:4021C294CC744AFE4F1B3C1B44EAAC52
                                                                                                                                                                                                                                      SHA1:75274EC5918A435BF236802469DBCCA5F4E49C8A
                                                                                                                                                                                                                                      SHA-256:5BC0BAF664DB184890C317ACCFD880E91E89D9FD73BB113CA98F1CBC0DF026A1
                                                                                                                                                                                                                                      SHA-512:4C91404D7F573E944BEA5716301A6E35F74E1A52F26023035BB6F92E8628374B31BBA9CD8EDD134AC9011E08EBB73ED717DD9CCE097DE4F2C185B1BE6049D7CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-core.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26073
                                                                                                                                                                                                                                      Entropy (8bit):4.774925833703451
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:J+6T4vNmgN8t0+yycVCI6z0jG7RMDX4WUMRmvm/f:IDIyH
                                                                                                                                                                                                                                      MD5:484A1F6A1EEAABB502E663A56F86EEE5
                                                                                                                                                                                                                                      SHA1:36DEDA47425DDB9993B9FC7D5AC5BEFCA4D45FE3
                                                                                                                                                                                                                                      SHA-256:D620F0CF97CD571F5C93752CB8E358EBF638B10735FA27D542AE1CE2D8639676
                                                                                                                                                                                                                                      SHA-512:5426804CBF0F5E4356CF8BF3B74071CE090AAC045E34E818C08A762532DB1C9EEFDA502D78092203AAA5A46775CEE2F788DD19F99F9EF460CB172FC6297E2F55
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Core */..(function (wa) {.. var core = wa.Core = wa.Core || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key || this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step1.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 162 x 163, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6397
                                                                                                                                                                                                                                      Entropy (8bit):7.947947094706784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:GSzkZH+IG8+1lqPrujYGCbSDp98cti4FSwgfYf3:poZHw1lNj9f98trfS3
                                                                                                                                                                                                                                      MD5:4538CF17F5E72D4AB6748D921AAF47C3
                                                                                                                                                                                                                                      SHA1:0721FB317398B3F389FC85B57D7BBBB5A5C8EAFA
                                                                                                                                                                                                                                      SHA-256:CD03355615D11022E11EE57F35A0E994F42F60A03CF9063FFA7AC0321276129C
                                                                                                                                                                                                                                      SHA-512:D9DC3ADB291EEC7CFCD317DB6D9BE5C662BB25DE22AC8056CEE7B16F710F119392A46CCE4250900DFF59DB4313A6B23FEBDE30240DB9A3244C3B008A49ACC422
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................pHYs.................sRGB.........gAMA......a.....IDATx...tT......I2I.....B..-..[.GKJ...+.+.(.j[{..t......O...n..Zc=.........Z8TA..=U."2...7I..w..M.'3o...wf.{.>.h..L2.......K.....V.....S..N...9ts.>B.....Z.G::..e..\.....c.i ..`.....k.J...[.*v.v>.D<.?}..C..p./.@k::.@.S.B..No./.\...PZ/.X....7.[...?.....x.-..U..]PF...Qx:..Bts..\.It.............l.).I....LY..P.D.....G8.....#....th..JE\..^.:1.t..Q|^Mk...ek.2Q.}V.o;..E.IR.#........u..`..!.....n......`=.)..N..2..ex?.. ~......y.......`M.0..a...m].J..k,ik...W.....Q.......O..0.m'H[..X.LP../.z.......y.F.6.E..l....`......K.H..1.6.......o.....9W...-,"&!..[9.....w.......=.f.......(......2Jy.l.F..7.U?.......>.u...WY.][V.F..j7.:`.X..g6.[.Z.Z|E.....)kk._..X.....nx2.2.....6v..V....b...\.Fn....W....[.::.%.?H.5.H.C.....X..h..1.d..3...gPb,#D......I....K....#~..*.....>\..=R.9~l..D......w..2P[..%..B4\1..+.... ..@..c.9@.....iG!........d..'}..F.D....m.(.....=v.lz.:..N...F....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-step2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 162 x 163, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5418
                                                                                                                                                                                                                                      Entropy (8bit):7.941310197666969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:GSscx0y/nkoEVlqHdvygby9KULounF17qTN/Sxgn7ylwgwIMyce:GSscKy/koGlCdv29hLJqxiEybYyv
                                                                                                                                                                                                                                      MD5:A1373F9C03567C27AF0DE96E770E45B7
                                                                                                                                                                                                                                      SHA1:A97E90B04460E4AF1D8425A9D9716782739C79B5
                                                                                                                                                                                                                                      SHA-256:EE56D3790702A7A91CF1BBD73326E6852CDF648C77249876D8D4410D5E1DD52E
                                                                                                                                                                                                                                      SHA-512:D65BA6F131F7EBAD0267FEF9BD555121429852DDB58F1D51CF3CBC800114C93BD8BC50CB06437BA999B7B585E943930CF7AB8A65632C1B9BBACBE5627027BE3C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................pHYs.................sRGB.........gAMA......a.....IDATx...S.Y..3.........A...6,.{...{",..a.=Ll.,.....8b.....=..r.eo....o{..........U..R.T.{U.*.O.m\.!.2_.x..4#.._Z8......C...U.M(.4=....St...S..<!, ."".....-..6.#P..j@X..*.QG....sU-V....+:h.../....F~8.."..NU....|......L..'D...t.....Wt..V.&...@.v..$.s".8w..d.E.{....A.p.G6..2.Bt.....O.h.F....4..f)3%D.d.7..,...d.a)..r....r2!...El:....)...wMi@9.V2.Bl...L....r....c+m.L.....#..J...*!j.....\%.L..9.iNSYT%..fh.k.$.5.....5QZ+Mb........D.X!zIhsWX.E.(..:]y^...8!j7..I...$......k.F...s..*<O..@b,bZ....u._.M...k=+.M4..i...D...t..o..$......E5Q6.....3].i..o...}.3...3...1......;.(..|./.U#.b.h.......Jy..XT..0f.....Sm87..?l|..Y._.k../....?.AY.,.x....q...=Bc...X.... .2/...pQ3.j.........N.n.C..E.s..e.O......Tr.'. . f.(-":..&J.n.]..........K.h....$./...B.E!.".H.).X.8..Q.?.c.....|.h.-d...?.5........K...1....<..:_...d..d....h... ..c.BlUJ.c)........... .T..1Q.1R!.'.l..ai...Q.1R!.&..R...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-oem-ss-toast-variants-woman.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 261 x 265, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):32309
                                                                                                                                                                                                                                      Entropy (8bit):7.9804976554334655
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:7NFP/8lSUsE2h18x4Su69ZU+VJpszMXneyg5PTg:fP/8lSkLd9jpszGneyg5U
                                                                                                                                                                                                                                      MD5:FFEBD5099333A2223979DDC7AD6E75E4
                                                                                                                                                                                                                                      SHA1:5BE640F0A871C4B1C9B2858ACDB8795B96F44586
                                                                                                                                                                                                                                      SHA-256:4F80FA15BA8934B3E4612BAF88F1DD2A633A1368A18F4F592D17FBBFCB635851
                                                                                                                                                                                                                                      SHA-512:359A50BDF3CAC8AA7B4D8CE42CB83F52CFB61AA969EB8B258F09B9BF1311C0B7FB3B974CEDEA72A0B94FDB0055CDF1F7489390E492F07547DEBE75B2EE5FC728
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............T2.....pHYs.................sRGB.........gAMA......a...}.IDATx....\e.6~.[.^.g%...t ..H*.#::iFG.uh..7..3.gQ.HG....F...g.q!......."J.i...v.$.....{..9oUu.;.Iw...._..[.}....lD...0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.......0`.!..9.e..."O.B'..6M.."(.rQ8..E..9.....\.*.........:.$.Q...C...{C!2p.. .9.....o.I..D!(.k.A.L;....&.s..).Q.-.}+....B.....m!.s..).1..A.;.o....T..)b.a5.M.....\.fKA......Z..M../X..?/p..H..%...R.#`w...3\.G....t.L...Kkz..!20'`....[....U;M?.p'.....{.....T=.R.rp.....!......07`..U....)}.F........k.j(d.j.LR.l".."..d..aX.U..6.z'.B..Bu....&...,. }#..Z..B....D..f/"..X..0......P....N..~....@U. ...>u)..!.J2P.0H.....c({.q.......A.U.].z....z.202.R.>....).A.U..0..L1.R.:..2``.a.B...9h......)T.2...:|.........t.&.U........H. .._....7.........3.6\&..[.^;.....d.*a&..FA%!0V_.,].x<q....w..[7..%3S!Py.9c....0H....m.#.....v!......xa....... ..z!..@Z........F......w.&.....K$Q.U......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-bg.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 300 x 584, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):32345
                                                                                                                                                                                                                                      Entropy (8bit):7.970403798736529
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:b4L2222222222gBS2222jbjKQiIlGtteBfKZiPb6++0SqnQcI:bybjbBlGzCCI0qnDI
                                                                                                                                                                                                                                      MD5:EBE97C44DDCD9F77F1BBA3B2438385D5
                                                                                                                                                                                                                                      SHA1:42648E15E7B62FCEE58CA5EAAF0CBD81A63E35C2
                                                                                                                                                                                                                                      SHA-256:26EF082565402F86EB018C87E41473F4FB2D52EEAC73B9CFD8FE81D51931AFE6
                                                                                                                                                                                                                                      SHA-512:552D36347A3943830B04A4DE2D0E4E2032A9A108203E824ABBF16595781A2A19CAF36FC813422AA6F4FE74F4B219ED376305D424E0CF17332397969E26DFC5D2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...,...H............pHYs...%...%.IR$.....sRGB.........gAMA......a...}.IDATx....-.f..k.c.........l................RO...x.@..A.R.......Q....\.*......j>.HYVdCuv.1.#;.y..W.zg......De....|.gE.,+..:-.......<g.e...>..._._a...V...+.@F...6hJD..+.H......m..+.H......m..+.H......m..+.H......m..+.H......m..a...U......l..6fW..~.T.J...zy.]zX..(...!.*.g./ _.9#......GPH.#.....(?#..c...k.6o.-..e._tO.Mk...'.B..W...V+.. ].N5xW![.y...~.vx$....U^K.....~.I..GQ&.w.{ye.l.6.hug.ff<V.HD&....e..r..Y..L.F.j.....I..9..+u..@...._..lGWN..l..J.H$.F>%L$..A:.D"q...J$..A:.D"q...J$V.O......wbm7...g..\..5............a...QS...*..k..4....3Y.:..ioq...VN./K.b.S.../...r.o.]Z.(f........(.........p.#...E'...J......j.&.......AG+....X.}%,_.t5.......T_.C.<...!...C<.>! .._..#....3./K...#.Q.@.b.iz@..U...h....&.5nD..UEFQn<.nu..qVz....k.-......)q..+..0..V.E.....h/.....w..+.xu...t.D.Y...5.(._f..Jg.......;.8..".....C.j.f.U$...tw........0.H......m..+.H......m..+.H......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 200 x 40, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3472
                                                                                                                                                                                                                                      Entropy (8bit):7.914294719380596
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:0BOO0xiRfpQu8pTvaIyE0E+y2Y5NTIMDBoY9I6ZDS9vH8C9SHZ/R0Jjnjc7xa0Dx:CryTvkE75NTLOY9IuS9vcCnU/DW2
                                                                                                                                                                                                                                      MD5:DAB5B1667C76E51B013C1C4AD2F7D532
                                                                                                                                                                                                                                      SHA1:49375ECB91B075E06624BFB5FEDB3A0DC4F1935A
                                                                                                                                                                                                                                      SHA-256:A4B95F7D7A776BBC6A84997A601993D3D4E0EC66B48F7D1DBB816497A248A24E
                                                                                                                                                                                                                                      SHA-512:843E8852408E5962C9FE62EE2441E3A41622CC929CC22AC9C692B5B9C8CA9D912AB143BBAF274899C59132A429B9032BDFADA51392E221F6F98E25C3DF0119B0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......(.............pHYs...%...%.IR$.....sRGB.........gAMA......a....%IDATx..]Mo...~g).,..]... . ..(P;..T/..R..z.....Ut.n*..\b.?.q......-P.P..P...X{..@.AW.Lq..;;kQ..~S.e>......pv.y?g......^...=.Gc#%..v{.>...pbb.n4V.{{{.E...2gl...iA...I..Z3L..O\.|....9..^..Y..ax.....'o.g....1........-0$...-..i.e!......6....u.u.I}."..A.....xI.......~5...~....|......L......y..iBB...w.^...]R(.y.q..T...}.3.4.pf.Q.A.)...../..kmp..$9.Bg.?....."...=....G..W_..?.._M....;H........g5....r..g..... .....jA.($.o.y...7*)......c..)..T7.h....W I.{.5#I...|. .].p....Op...\.q.,.@.@.r7.Q>......5{....O....."...#.L....]..-.U..\,iZC...|.......i.s..-d.R.....4...(B."51.MB."..g*.'.<....e....8..'...!Ks,....i",A\.D.............{.U.0......:..x........~.P3.x....x..o...,..-....3-.{..Q.+y..+m..!...m.$..|..U...H...O@...8..rQ'.J......@....^..P.vvJ.....L.......m_..s.$[...dK.}...L...~8...../^|..U...x.De........>..jk.r.saK..\.:..".....3......S. &:...}....T(..?......k....Q".....^.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-window.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 227 x 301, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6759
                                                                                                                                                                                                                                      Entropy (8bit):7.889394285207192
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ZgNNLlmxVJnzXmgYshy0/MMA+SJ3zjaVDRL3Y9M8jX10ZYUQhyG:Zg/lmrVXnPVkzJ38dL30M8X14G
                                                                                                                                                                                                                                      MD5:F17683FB6249E0FD8188AB2844EBA5D2
                                                                                                                                                                                                                                      SHA1:A084098F96F87604F96737B202935BB1AD023F71
                                                                                                                                                                                                                                      SHA-256:A0977CF048480EC62B8CF0BE174466A31612C21CD57C20A28DF69EC7A465E8B2
                                                                                                                                                                                                                                      SHA-512:3E2406EE7F4BC41059D4F5ECEDAEBDD0377906EDBA31423AFF86163C217DE47181201272641688AF52FCD00F10BC3F0D90A819D5F48868F598941A4B8BED32DD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......-........<....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx...{.T.....~.L......pI"B...M...j.+HRV...T6Q....M%Z...U1.....q.&fAQ.a)...DA....0.# ....=.......3w.=..{...p...L.t.4...9..;.^"....:u.Ot...D...[Hy.\..<.!...R.~.#...;wP.j........P.....Cy#.#..m...y..o..F....w..]..uS..u-.,.Fs:.;.|~=..].R>w...g=Z..%....4.....x..9y2.....sC....q<.......P6.Ea...k. .4.:...r|..._..~.0..`..@3.y......,..u.#.O|].....ty7.7.SU.^......... ._....~!B...S.p...].~...y.^.s..$D.......O.g..z%]...............~.n.t.^:0Ju.X..n....sd....0H..:6../.q........?T!. ..8s.~..HM?.......)?.....dB...xt..i..;. ....A.d.|...........)A.^..?.1G.j.R..&.........w|..0.O...._...8..9..0....x.(.:..^=.....3.5|..B./..`......@..vT:F.k...!..}..... X.P.<6,......S...t.d..P..J.;..W...|.."P.....S........~k.........._..W..T.fr ..z.=...^T...T.u.}.qEu...=.}.w..~.&.x..jm.VD=A,..V!.G..g..".~..}^R#.Su..S...8.z'..0.....@...@....8.. ..6..@...@.^..r.....Um...~2.....1M...a...a...a...a...a

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9632
                                                                                                                                                                                                                                      Entropy (8bit):4.044650677147693
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:jUSSVnGzSsn2hwPYeTZK+GzoulH8OJo6Jbtyxo9+jRusFRLLDeWn4bOP:ASSVGzSoJweTZb6JbwkEukZ5P
                                                                                                                                                                                                                                      MD5:775FD5DCD8E0CD4D8009C07228D075F0
                                                                                                                                                                                                                                      SHA1:19192F5CE908451C4E06168B79C3D7B652E40332
                                                                                                                                                                                                                                      SHA-256:83381874CEBCDF7D54FD6B05B0E5AA090D768965043D321E5EAD68E43DD68F3C
                                                                                                                                                                                                                                      SHA-512:F9FCD868E5243E3068A4173F360D10EB4A23C2DB41047EE4F64DD65133F0D30922B74DA49BA0BB6EECC488C3DA016DFA3B0494FECA7E6ACA37F1E7B924B9ADDB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* CheckList UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.... ui.closeDelayTimer;.. ui.CheckList = function (options) {.. var el = {.. $checkListWrapper: $("#wa-checklist-wrapper"),.. $checkList: $("#wa-checklist"),.. $messageWrapper: $("#wa-message-wrapper"),.. $message: $("#wa-message"),.. $messageImage: $("#wa-message-img"),.. $closeWrapper: $("#wa-column-four"),.. $close: $("#wa-close"),.. $logo: $("#wa-column-one"),.. $state: $("#wa-column-three").. },.. checkDomLoadedInterval,.. animateDurationInMs = 400,.. self = this,.... setState = function (options) {.. el.$state.. .html(options.state.template).. .addClass(options.state.css);.. },.... setMessage = function (options) {.. el.$message.. .html(op

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ui-dialog.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4238
                                                                                                                                                                                                                                      Entropy (8bit):3.7815083801911604
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:kZ2B5nzQw2n95lN1i1BMHiKHzReZDeVBvwCi:kZEe0fIpHNeZDQBwCi
                                                                                                                                                                                                                                      MD5:DD69B540B8A24B7A867F90FEBADDE188
                                                                                                                                                                                                                                      SHA1:01989194CFC4A4FCAD0F475081944374C7CEF4A9
                                                                                                                                                                                                                                      SHA-256:364881CE564CCA36D76FDFA21B9C18F44991DFAFF629585E7B94A82B1B16C365
                                                                                                                                                                                                                                      SHA-512:F20D2F70753106ACB07D911624D2403BFEA0D0A09E908BF4BDBB77CE003631EE6729F574459D56DC81007E3CE070FD29FAAAC5CC3B767B329F8406014002AA92
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Dialog UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.... ui.CheckListDialog = function (options) {.. var animateDuration = 400,.. el = {.. $dialog: $("#wa-dialog").. },.... create = function () {.. clearDialog();.. createHeader();.. createContent();.. createButtons();.. },.... createHeader = function () {.. if (options.header) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-header",.. html: options.header.html.. }).addClass(options.header.css));.. }.. },.... createContent = function () {.. if (options.content) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-content"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-uninstall-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3395
                                                                                                                                                                                                                                      Entropy (8bit):7.880811480479431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:WS0DKX8AWw5a9tRVEGCtbiHX+VGIGW09iYl1Avo:WS0DnAH5YRVItSLjIYDco
                                                                                                                                                                                                                                      MD5:E423607709409638253C24C3688A88D9
                                                                                                                                                                                                                                      SHA1:8ABC653F71614F6B707B01862449FC800D27EC61
                                                                                                                                                                                                                                      SHA-256:3B7849200BA0C2EAF22C3D111DAB6A630A00EA4A6EA968344EFB900E79084E4C
                                                                                                                                                                                                                                      SHA-512:BF70D4EE71BB441C7C36D0AADBB73C68B089D7E431694E54FC1606FB5CEEB8A30FB50F28FB5BDF5815EEC600364B0AEF98F57C23C8C160FCC704728918886259
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs.................sRGB.........gAMA......a.....IDATx...r.G..O.H.!..6..@Y.[..[./r..\lQ[......x..'`.....r...T..\d..m....X....56..K..9c..}.4.fF..U.I3...........B...b...3..%....c1.<.....x.7r..s...`./..<...WK&.......0v>?.2.%..4..y.....9. S..{y].9s&..#...>|.......\.Ry.4.G.3..9.=66....F........c)..Y.o.......b.....w@..-....q.....]....`,.bH...A.&.)....\7....79]...b..(....5.W.u}v4....!........:*....."..]c.*(`.)..u2F...).m.+x.f@BF..67.&&&4....@..;mn..+'...."..~.....T....[.......5.._.@u}o4..,..Ao.!.?.Gl...,f.......[..Uo$...'.{KO=.............,x.'...~p`.&...I.Psqcss.V...0..H$.O.A.......@.{...\..4.O.,.W. ..3...m.H.w..D.H..T*..6LQj.....UE...w..|f]..Z.q].Q3...rN>.....J]RU.F....q...~......./p...c3......{......L.+..............9v._..:..h..@o_....p..9.3......p...?....G..F=z.X.....#.1..A.?Rz}..I:....T}7..V.?.R.....X...Z.....H.C..OU...Fl.....a..?.......n<.VWA-.~....x.......{$..I..V..X.AU...^.|Ys....T...c.`...hg.......vy...{.v.......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-utils.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15448
                                                                                                                                                                                                                                      Entropy (8bit):4.445278286827052
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:BZwBjyfDzRj5csy4h11lidEaCaNz46UcEm7dO2qSFZC9OQ/K:Wefpj5csy4DIE3oU6Um8y
                                                                                                                                                                                                                                      MD5:01D345EA7E7FEFCC2A0D9CB61601229E
                                                                                                                                                                                                                                      SHA1:764D861B2617603BE11506C7D422B6239A0DBC33
                                                                                                                                                                                                                                      SHA-256:69A6D0AE75D82D8F820853D030E704407876465AEB94409EF51433C1132B9765
                                                                                                                                                                                                                                      SHA-512:499B11574D54F3E73F0842C9C0B239A550E07E70FFC404B09F29AF6FAB88D3989473648789C762B8BBE208B357A6C330BBAC9EF3A2846E0D92481073F8BD1126
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):558
                                                                                                                                                                                                                                      Entropy (8bit):7.494810764492959
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7iIHftwTmWkW3O+xbR/GfmNFycqV7o5jNiXrj0IGDfjo/1:zT5+aVefmORm8bnGD09
                                                                                                                                                                                                                                      MD5:F8AF1796D709A69C3FBDD16822596FD6
                                                                                                                                                                                                                                      SHA1:D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
                                                                                                                                                                                                                                      SHA-256:055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
                                                                                                                                                                                                                                      SHA-512:FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_check2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):785
                                                                                                                                                                                                                                      Entropy (8bit):6.380231936591206
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:nmwBSRPy8iSvgv+aYS0NFVO/6cgDHNUPZ7SCOr2zhxNoEMBxNB:mwBSRVL4v+/jNFVO/6cgDHWhbOKHCEIj
                                                                                                                                                                                                                                      MD5:5367B11C1B0484E2B64AFFF761DB5B69
                                                                                                                                                                                                                                      SHA1:CA05EC2A55FAB6A4035920C38B6FF198044DA594
                                                                                                                                                                                                                                      SHA-256:1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
                                                                                                                                                                                                                                      SHA-512:322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):327
                                                                                                                                                                                                                                      Entropy (8bit):7.1140535970703365
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPIcWn2ofLbzmoGGaKdwjXI76l4AXT8ctmzXxNuJpTqAp:6v/7DWn3btahecDAuJp1
                                                                                                                                                                                                                                      MD5:C0708D1E58F1EF1BAB621620F3B09130
                                                                                                                                                                                                                                      SHA1:0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
                                                                                                                                                                                                                                      SHA-256:834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
                                                                                                                                                                                                                                      SHA-512:241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_close2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                                      Entropy (8bit):6.591404605834916
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPIcE/6TsR/nQV32e46OIoiMr6FRK7MhtCxllbp:6v/7DE/6Ts/nnPIcr6+ozCjz
                                                                                                                                                                                                                                      MD5:F79A1953A8E6CC342847B4B00DDBD736
                                                                                                                                                                                                                                      SHA1:9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
                                                                                                                                                                                                                                      SHA-256:4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
                                                                                                                                                                                                                                      SHA-512:DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_install_error.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):428
                                                                                                                                                                                                                                      Entropy (8bit):7.367179920202989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7iIHbGI9XbxzlcdqzUCOXC5pC38WWn9:eGIrzlcdL4CZW9
                                                                                                                                                                                                                                      MD5:0EF65600F5A2D01876B6F9EC668C9D2E
                                                                                                                                                                                                                                      SHA1:31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
                                                                                                                                                                                                                                      SHA-256:17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
                                                                                                                                                                                                                                      SHA-512:7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 233 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5361
                                                                                                                                                                                                                                      Entropy (8bit):7.956335361585333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:tXYxwio7C2guemm5poLpMmjxiN4f7DsCk7RkuxKBaKeVfGJiQmiMQ2qileA2I:toxpo9gKmsMmjwSXgyLBepQblA2I
                                                                                                                                                                                                                                      MD5:0D8F8EFEB474FC9B2C825D7F2A875471
                                                                                                                                                                                                                                      SHA1:ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
                                                                                                                                                                                                                                      SHA-256:ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
                                                                                                                                                                                                                                      SHA-512:90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z*#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3.*.9+... ].4.Y.2.....r>hM....}..-..|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 232 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2938
                                                                                                                                                                                                                                      Entropy (8bit):7.909981061900822
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:nv/69bTJ0Ji4hnEhRHzXJH3ndGzDr9zHUeqr7zpiT7efEgo3cRE0+U9sLBCYv2ZG:vSdJN7HziDr3S9i/efLQcRZ9sowGdK
                                                                                                                                                                                                                                      MD5:65938FC9439B2307513A95D515BCA1F7
                                                                                                                                                                                                                                      SHA1:DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
                                                                                                                                                                                                                                      SHA-256:B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
                                                                                                                                                                                                                                      SHA-512:93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe*.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...|.|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C*..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 175 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2517
                                                                                                                                                                                                                                      Entropy (8bit):7.899112131446941
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:/O/6MOvIltQSb2EVW6+mjuOR6aPFUCJou7qDnUa+oNWsYFKaUCBmb:2SrOtQFglR6a9U2f7qDMoEh7UCU
                                                                                                                                                                                                                                      MD5:C5FFDD4032AA96D998DF4BBE0DFD49D3
                                                                                                                                                                                                                                      SHA1:46BACEE7C5C587024EE25C2E900C7580B1F12FF9
                                                                                                                                                                                                                                      SHA-256:010AF7BF170A9355D191C042768D37E4E8559EC4384F27EEA39A79C4BD1C3AE1
                                                                                                                                                                                                                                      SHA-512:BD89D324B107FC6B7806B3E5C098ED19C7D19DE47430D68C903F632A4471DE2C00B4290F306366C51EE71819AB8E4C9897C4827846EEE604F7F6539DCC38B6EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............`./.....pHYs.................sRGB.........gAMA......a....jIDATx..Z.o....YJ"...[$r.(P#Fc.\."...^E.....=.:....@.9.....d.^...S4.6.@..D,."Ll.....Y..!.T. z...3o.y.W.....O.yrq....b.l......u.z............O*....uZo.]..A.xu1....M..c.+!6.N{,n.P..{B.<.....9....~.W..z-..#.1..q.7p5.._%ja....w..\.W..H..........By.%.?....CQ.Z...j......bV.f.....c.](..6..d...|)..hTe6.O....X.\.:q....^.I..fZ.y..q......}!.....v........U..x....].e..o...P.]...u&A._........c.<...P..3..cO]...z...:bFh.~....`......1V..&.......4<..{.*..t....S..j.S.s..Q........'../..b.PRn..P......`p.......@...8T.P.Q.R{..A.\.).N.i0...+.=<9...k+K..vz.DL.M.^.7......O.. .o...@... ...wU...m.3....x....l.|u-...2.M.N{^i.d.......s...R.H.`.09.;.....U:..c(.D$.N.(G.P.2.....T......r.W)...@h..1<..CI...<........M...X......$....[S..#.r..C3..y.R.P$z..).n....Gy.W......d..H{.3.q}....q....H..T._~...@..5....U......n.......1.)..'.M.x...Ab...x..=.<...&.x...k.q_.4#...l.6.i9.;.C.9

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo_upsell2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 175 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2146
                                                                                                                                                                                                                                      Entropy (8bit):7.878767198815235
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:X/6uYit83CnCOqfU1paiFTeUpKJX9+E+orrs30ocDx4/OcrG1:XSXi6SnChfypRFTBpu+E38kNxKOcrQ
                                                                                                                                                                                                                                      MD5:39D8F472934136936FF3FEE841245A9C
                                                                                                                                                                                                                                      SHA1:812281447AAE48A891F8A5FA9CA63C117E5E9ED1
                                                                                                                                                                                                                                      SHA-256:DA9F72BF2AF97A5A1D5C8884F8D5BFB2CF232A7026CF9123E02F5909AAAD2F70
                                                                                                                                                                                                                                      SHA-512:7C3791E59F161A31486E36F6FB6A23E0589286342FE4A11D9DCBE975194ED0EC0EF223478072B2360E3CA276D6BA5BE0C4E2FE64FC82BC646945965E03556447
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............-......pHYs.................sRGB.........gAMA......a.....IDATx..Z.Q.J.m-.....G`9...?..".C.^"."@D.D..........8..........>==.HH.k1..v..y..zN?.d.?..nA.?.......L.M.o#...f.GOK|m..O...........KW_.P%...*.k.X.........;.v...|.|..KH.,.@4.....d#+{(WcN....... ......C..).CG~.g..M..*.jQ.y-S.u.}FA....4........b..9.&\.../)=&.3MY6Mc.5.SS.r.rI..NX."Q. .;PH.@..$....3l.(.1.x..|=...CE...*......Q~.J.......r....d.$.9...\\D.x/..;.%>,.p|.EO..].4"r..i......D..Z..%.-..bQ....m .~...k.a..n..lR...>p./(.f:-.k..lU.!.7..]Ut...~\9.....@...L...|...h.W..R..e..PV..vt.x_..I.h.4...]<...G..K.T.V.)...w.....,fv...^..)........)..........Y....@.8.....[..|x.wYYW.9.X..C...p..nP......p+|.-.q.F......>%........FL..s..?.J.%NH....;....b.dy.HN.13^.y.3`.zM.0.....u[-.....A.|e...4..P.3o1r>.y.`.gM}...H.R..;..F...<.zT..T..[.+.P..Q.>QS.Y..aN .>.....vc}.?u}].c6}..y...y[._....Z.@....P..o.S...^...yg......h....>.jB...+.1?.&V..V....<.O.......|uX...m...::..9...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1627
                                                                                                                                                                                                                                      Entropy (8bit):7.826159192497283
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3F/6TZYDTDiZweTZamTAaTJ6r/OIQz5URWkUX:3FSCXi6elamQ/Eb
                                                                                                                                                                                                                                      MD5:E6797831954D0AEADF1E7CD268F4BE8D
                                                                                                                                                                                                                                      SHA1:8CDEAC8420271C46DB443A03C58AA2E039EBDE50
                                                                                                                                                                                                                                      SHA-256:9EE5FC5E12400AE65711B9B664E75EEB3273C051E29FADF4FE2104B59C89437A
                                                                                                                                                                                                                                      SHA-512:EB53492D4B7BF87E09D049006E8759A87C4062950A9F88A636E7B7469AA5937DAB463DCA22294FE64A09DFDA19BDA711A6160E7762F147E5D2F5A95E3EEDE984
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d.........{.......pHYs.................sRGB.........gAMA......a.....IDATx..X]n.F..%.@F.V)b[z.OP...O`...O`.H.j..h..>A..X9....A....E.Kv..H....7.%..(J.%...@.........n..DGN.sH......B...w[Y..R.....]..'......3.#...+........q|..).*.....$e.M.d.;..w...*.^C1.Z..h....O.o.X||.,.&A.....>).vF...p..S)e......./.y.pW.Ph.Z_Hy*.h..LG.{..,.b*..4.."~].qg.Q....(dx,..5...sFh/.n.0. ../....y....K*.......\F.R.....R.. 8z+....7 ....[b..dS.^.vQ.X.+.B....W=n.b.m.,..q.?...<....l.H3..V.a....r.V.|?XP..t.E$._?..k..[.x.].E....5....^y...b..6.9.u......e:....<@iV..-C%W.....8..C&M.o....!?KY.\o.6gr.j....../......@p......r&C....D.v:....[k}.X.l.u:..vv...Ve.....:.....J.@.~G...^4.M...4-W%....p.z....[.D.J....0....K.K.Lm...K....@J..vvgd*..Iyf........O''...%....MS....V..2.\2-..O.y.iLe..x....k~~.Z..6.H1.h.@:...;PF...l|...}.|v..)3..q....nw...6{...i3iM......}pe4..\..... ....d.]....D.`.a.C....FD.!/...s.4%.I....|S....-...nK...D....&Ov....a:H..V.&..."|.......:#.S...|..u....H.:..../...a4j

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_increase_bg_left.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 276 x 283, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):46909
                                                                                                                                                                                                                                      Entropy (8bit):7.985537981297596
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:QMJyYB6qa5O8KgieNFdjfsA8dh5+7xOBkgZuC02S11anRxHsogCdCsf6NL4EqapH:QPp5LXieN7Qdz+7gygZuC0B11+RhiQCp
                                                                                                                                                                                                                                      MD5:B3DD8F8E04608CC298018AF91FC7A0AB
                                                                                                                                                                                                                                      SHA1:6EEF374ED0D7A0E6AD13531186D896276370B943
                                                                                                                                                                                                                                      SHA-256:E056F875F8782046646E871CBA23BD89BD7926D2397CCBDCDADE5E75D5891148
                                                                                                                                                                                                                                      SHA-512:128D618645427B816C6C68D0B72C6EA0815771E3058C14A37782F1E6EDE9C6E0000727B4E8F54913A516746D9E17BDE62289D9A8BAFBED1F6A5421BBC475FD0C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............&{.....pHYs.................sRGB.........gAMA......a.....IDATx...[.-I.....s.s.S..3....4....A$ H..(.A&..7.z..h..IF.... .^.LOwWWwW.s..p......AT.2##..._xD...._..../.#.?5......S..G.{.....]..-.....:.......>y..Be.I..F?..E..]........<.zmM?n;_[...8...)...?.O.%/....39;.b...@?]...DWpL..d.Ua9.|.yoq....Wu:....5.;Qt.4...9.0..Zt".fPw....Rxg..I...R2.U.C....fN.i.H....L..J$.v....3.bnoe,..g01Y.K..._'.dA......*o.{.!t]..G..2...R.j.hF.Y.;ig.Q.....R>.1..P..\.#.G...9..L..........Su..4?..&...0..U=.....*.Y..$.T..F..'Eb-.X.Z%......g.....Nv.]M.......|j.f..}..!.<.....Q.{?R.O.&.e..h.Q..)9.&}..:~Vd......h....3..,...%.o%....4..0..]...S.~v.....&9...r.hi,...p..U..<..jq...8..T-5....{.......IE8.c..nV...^.....0f..%..1cG.....s...j....eo@...d.W...j.|L.......I....m.2M...*.`*.&8.i.a..L..j.........j..F#=...-.@...C#.aM.......b..<.<..a`3IP......ee.r...jU..&.d.;.P.P>3;u'SI.6.....C..86n'.7>.....a{...s..y.>.z....e...\).G;..S_.D..._.|...'..2...@..JD*

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 572 x 565, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):69604
                                                                                                                                                                                                                                      Entropy (8bit):7.978415362384725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:QXPNryf1U/w2kW7qSIxd1+2yfystvuxnkyWkCE6w:wxyf1ewf2N2SydkwCk
                                                                                                                                                                                                                                      MD5:241BC522B02EF7A35A2CE7E1185265AB
                                                                                                                                                                                                                                      SHA1:B4DE10905ADCBE62C1ACFCE168F91B614CF21183
                                                                                                                                                                                                                                      SHA-256:5C7B6C5A87A3DCAD175D9C0DFE0D885BABF22227B5BC161E7C478779AAF2AC30
                                                                                                                                                                                                                                      SHA-512:4DA6920BCB0A57CEEC14F68058912A1785E434A1487EC8B7DD6FD6EEFDCB50A7E17EA25995CD3844D7964851068D3C22F56E8AFBF737ADB0AA32D3AAD11184AC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...5....... R....pHYs.................sRGB.........gAMA......a....yIDATx...,.q.x........9.G9....h.(..Y@....@r`.Z@..$...t@.X.p.`....U...Df.7....y...2##..*N...........p~7...o....M~.m.:O..m......K..eg..^./...A.g.{../u..1..F.v.u.w..l......o.........p...K0[|......5.y...e3.........e.-[..r.3......4...H.~.S.te.H.^..!....=....b....O..M....v....e5........a....hR...._a....o....%.).F..0..<f.F.c.....Oi.$q..:...."......-[.l..+".}?SUgq....f~.%..@........cF..0J...r..,Q....7H.#T4..g....:N...l%...Q..y.1.Ro... ...I)v...6n..4%l.....c..G,..9}.q...g..-?......e.-[..b..;..w`...#...u2.0..).........P.......I.5?.....i:f5M.m.S...2"i...!......E.......`....f.;..i4.di..|C+I..Q.z...'...|..W.e.-[.D9<..oS).sJ. F....A....a...I.]."..7.*.1.1..&.S....U9., ..(........b..J..erz...q.b"......3.e.`0. ..25w.L.U...#..L.38z.c.....~.z.c...l.e./Y.....L..og.1..kR../.......X.b.X/..bf^A....|}..N..[..l%...'G.4.).~U|..Mb.-.cL......N.M..8.h.x:|.>..j.2......#..'

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_bg_v2.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 572 x 565, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):84857
                                                                                                                                                                                                                                      Entropy (8bit):7.9803219968216474
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:CaRkLhrM2oTVEtv9ES5L6+t1QLtb3v9hPi4Aumb5AVU4QtOWjal9U9GZnf1eT:8Lh/oTV09ES5e+tAtb3jPIumNA1H97Tq
                                                                                                                                                                                                                                      MD5:F038158CCF02E238051E916E68C43F53
                                                                                                                                                                                                                                      SHA1:81A63F396EC4593E1BD0CBEF520C1A40F4D35D50
                                                                                                                                                                                                                                      SHA-256:4AB364638C2771DB7C9EBBD40E8EBCD1AC7C92A9D4D08E616391831426B01C21
                                                                                                                                                                                                                                      SHA-512:98DD7A5C127FA1D00DFC84EDE548E4D4CDCEDA3F7C97A2815DAA24858DBCDB230E6FC6DB82DDC31E8F96467B141ABE402FBDF0BE86F9602444D0A4790C20EE9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...5....... R....pHYs.................sRGB.........gAMA......a...K.IDATx.....u.q..UM......'..Y...09 u..o ..... 7...B..9......H....!.$#.#...(..H*[...$.......T.......?]{..Zk..S.s..OU...........QU..{......c....CY.c.S...N.9=2.]p.;....}...>.^...+.)]..u..(5..W....$.{.@u~|.T.....(.].OK....&{;n.....b...... \#e......|.i.e........._|3..9r......e...mx.b@&....e.[Id..y....O...|.R..Z..R.r.p..).........@M.[.q.W.x....a._i.B.....~..........'AF.......V:..p..>Bm.6........Q}:..C.X.y.&.j..Q..*m&..:.....#G..9.."..w..6U..,pR.$.=.\#.A...:.......`Up.V...5..,N....)..V:.2....Z.b.>.....3...s...#.n&....(-`..4f\.. .....r.i.......%.a0i.UXjAMN.._@....y..a+~...G.....#G..........g.m......qK.Y....h..r.ELP#...%P..,.%.o..7.!i..I..nt...4..N..k7..:48..B...T...z.~p....l.d.}.JP.Iy....AF.x...w..R..2.Zt..!H...32/..L{.8>....7...8r..#G>a....1-.r81..........E%c.d..$..+m.7...A.0.{f.....@.P..@..J.T..=i..X.'..X..d....(..5....@Z..v....>o@$...BK.)... .b....:.....J@..:.@.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_good.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9327
                                                                                                                                                                                                                                      Entropy (8bit):7.970469640393894
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:5SAlgBGtPGIcDO3cUWjPvAiL8zG3vRG+e40rH9qlGIKZSA:gAlUrs2VP3vRGcUHwoUA
                                                                                                                                                                                                                                      MD5:F88AF81EA6E8672EDB7044DCF877EA91
                                                                                                                                                                                                                                      SHA1:7B51E57EE82590B5B22F03D0E88A10A7B0DF4993
                                                                                                                                                                                                                                      SHA-256:CE6BE399C30F141E790638A21721D0040C415375C1E2E79BAB0D3A5E5895D2FA
                                                                                                                                                                                                                                      SHA-512:C52923E9563FEA752297AEB14E66246CA1DE3240D4F7F659177EE03295698E32BD38D76F5F7A95416727A12B29D0154F03E98C6EF91FD7B0F0D32DDBA53CFF5D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a...$.IDATx...x....3...5q.8N"C..p......r9.&.n.1.eK).dwK...;...t..P..9t.8.v...$t..e.@i(.8.$%....cG.J......dK.l.F#.N..3.n...........<y..-H.s.r{..RD.Q$y%..c.+.... .{$...^.E....].I....)kZv.8dS."I.H QA.pdw..$C...$.k.!...d.$e..E.x...3JXJ.J..L....nvQ...t...-...$..7mE...Wk...Z......6.....S.....w.....w..p...I|.8...e..&.V. ..K.0&;N$.<...kwN...#,.F.R.@....z........w.....'!l."..BM..R.l.%..-.U].m...&.{.....yFjE.Q.O.B.;.;....u.dnq.......U."..ZX...~...m..z.o..3....%.5>.Rz.....k2..&...Sj.?>D.R.(.I.$:1.......^..3.bc....O.9...:.%0......`].J..Z`I-..b.a.y..|W......v.6..M8>.E.zaQQc../...Y..b......S.6caE.UOBr...4z.f4m."%..{.UjdY..j.,.....FL..rM......jQA.Zp...F.p....|.h..z;......!..q..e..nz..Y ...?Gv7...%..._.-,vu$.....|R..........X<$.....A.2r..T1Y.......z...eWIb../.l&..%*.]..d.}......V..l..A.....:.x.K`.`{........]...puz.4...$......b..:....B....oX:...q..[...39..&1Q.B...Q1O<!5......&.m..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_red.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5806
                                                                                                                                                                                                                                      Entropy (8bit):7.947492621878631
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5SJ+1CjtZfXEe5cDU4mBmhX1HNx6EkdEQ1Qqx49JrywZAtwRygSHGkJWWPTupdgw:5SJf/sUMhlHNx6EULExytHRgdgZ+
                                                                                                                                                                                                                                      MD5:3988A50B6D996F6455E9229A53E1DE2A
                                                                                                                                                                                                                                      SHA1:094BE688DD8DF4CB8D355501EB11A4FD335C11B3
                                                                                                                                                                                                                                      SHA-256:1B081F386B0FC37D1415F9D38E71C43F60E2FF493688048DF9CA4ABE65683782
                                                                                                                                                                                                                                      SHA-512:CC9ED3FCDF6D0A48999B32871D9360F68176ACA3E7C0CE0F4C37B1362DBE6E1BA6E5CF0706AB6CA8CF756AE740D5C65BCCC26457CCDB549CC3B17AB0FF0609CC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....CIDATx...l..y..w..d}Q.,.#.i)..G......t.vp..N.tM..v.......t)..2.bC[....[.$..,.....4H.M..n='..'...m.-Y.......</E..(.w<R$.....#)........;@".H$..D".H$..D".H$..D"..E.H.#}...l....5.....(......4.C....(>..A..c.T,.A".s.....(....v..F....&......S.....B..Co-..n..$....b.7.auk.2GDl!M?D....bA+..y),...J..#m.ux.U(^.Z+..W.Ydy#,....[m6l.>1MEDdA-./.Bf...........5y..@.@.....UT7#..Ya..]..l..q.dQ.......E^.(9'...T<.WU..(...$g.%.;[..j m.".`.."sBX..{w.z..:,..\..Y-,.{......S....^-.....Jaq..........$..+.#..`Y',......:...L..*M..g.....;u.Ms;.2Jv.^*.....=...2..VUg..."f.D>e+=..}...M.qV.....m..l...K.*}pK.YZ..f.Y...U.Q.4;.v`.....2.l.+...J......zI1P\<..gI\.....9...A=v...*_.O._...^W........B...>#..3.........8$..,,.........}....2"..@.......P...t.!A.........~..a<\PQu.. ..Ly. ...u..?..G........]...G.31..Va....B...dfXTO......d....3.6*..i=.6mc...C..df..SY,*......r....Q{x..L.e.9...$q<..e./.,...FE...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_score_toast_main_yellow.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6192
                                                                                                                                                                                                                                      Entropy (8bit):7.953945165570691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:5SzpWPgS9/QQi/AZsf5G9qTxAS58Eb9hXXHS0gg:gzpIQQVsRG9epGEb3HS0gg
                                                                                                                                                                                                                                      MD5:B034C9F982264AFFC7A81122732ADAF2
                                                                                                                                                                                                                                      SHA1:0DA8E840BCC6CEDB79E2D54697ED25A3BA8147C5
                                                                                                                                                                                                                                      SHA-256:D124043692362003A48C4DC875B7014ED3AACCAC452522B32C5BD98E253354E7
                                                                                                                                                                                                                                      SHA-512:48239CF4BFA708B7BC7A46EEE4F692828C54D4E0B887D2C38BEE60A513007363EE4B54BE409B59EF72EEBC76398BD3FDED6AB493958D1E660BCB048859E0928B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a.....IDATx...p..y...w..tB....d...#.U.9<.....L..uSd..t.I03..t.E..g.4.q2.4....$...Wl.d.....;...... .I:}...y...t.n.vo..7...j.........}.]@".H$..D".H$..D".H$..D".\.(.@....Oi.bX.U.A.........%}....oA...=...T.KZ!.....C8.'.]E/W.!.E..ZZ....VDB.Jec...y/,..\...RWSt..W..3.......lq...V<.y...]...m.4JB...*...........d..&C.Y8..R.......N..Md....+e....;....9N..+..5...b...rNX...f.;9,...V^G...A...)W.m..+/...b.ZXZ.gu.!.Zy..._m.R..1d1Y+,m...D...K{...q8.&[...,.......D..RTS.....X..nB..U.K....n...U...,"k.%S_.dYj.T..}.E..4.(O.^D.,.qa.?u).;3..z....8...xR)Ai..z\J.R|..8.#..Utw.6(..gV~..x.n..8....2....(r...K.?)..A."'..T(.:.0$..5f.B..E,QR..r.%....D,......<$."......b...%.......u.oFNp[....G}....M.Gl.....<.-.C9....1x.Fl.X....L...~..%|....n%i..[..F..B.G....a.R....@....@U..F..a5..5.......>.$5..kq..)8..K.p......fl.c.B.~.z.F..bb.L.Y..^o..x.i.A..H...O-.X....[.^......u........yr....iC.F7..~..a...=...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_check.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 18 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2902
                                                                                                                                                                                                                                      Entropy (8bit):7.8683772202551845
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:i/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODW3O1:iSDZ/I09Da01l+gmkyTt6Hk8nTb1
                                                                                                                                                                                                                                      MD5:E4C0EC02D11F61DA1A702B0EFA2EC744
                                                                                                                                                                                                                                      SHA1:F4E64300F14D0BEA27129A72BE91A668A9B9FB9E
                                                                                                                                                                                                                                      SHA-256:2AC30B35B0BC163BC18B3B4B2982A6EE4095202FCF2EF8E35BCD415D8FFE04A8
                                                                                                                                                                                                                                      SHA-512:6E659358DC715D700E4FB9BED2B8054408D3BD79AF8B492D6197D53038990AA12558957CA9C4BD436D83C2507DF165C55F2F0FB4E93C13480DF932E58E16EED1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............".L.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_downchevron.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 5 x 6, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2816
                                                                                                                                                                                                                                      Entropy (8bit):7.867254837776759
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:/h/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODM:/hSDZ/I09Da01l+gmkyTt6Hk8nTM
                                                                                                                                                                                                                                      MD5:59934A5C534B8372CC2ACAD83B1F55E6
                                                                                                                                                                                                                                      SHA1:8285F5654E3A077445E73685ABFD638BE7F1F4C6
                                                                                                                                                                                                                                      SHA-256:130541A07A3D9E2050A6AC15D659E29A21F080F6CB1D7DB2800255FF94FD8310
                                                                                                                                                                                                                                      SHA-512:37D1BA15D460F33B62FEF40B32DB95F136C268727AEF5ECFDFD3ADA471D26C78FE89438D0BF13FD966E19FBB7A9E06BD3FA27DFC326AA42699330145AD634BCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............TK....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_exclamation.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 4 x 18
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):376
                                                                                                                                                                                                                                      Entropy (8bit):5.513362384873133
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:772Q1kVEn88d0e6FEVU5drwF0cVe6FEVU5drwF0cVe6FEVU5drwF0c4e6FEVU5dH:772LVEnl6FEC5drwns6FEC5drwns6FEM
                                                                                                                                                                                                                                      MD5:BFE2AF9C7C0433C86314783E61A437BA
                                                                                                                                                                                                                                      SHA1:4CB221B2CC8ECDE82AA813C3E136DB749BFCE3A1
                                                                                                                                                                                                                                      SHA-256:0DD3C3D9570BCA1ABC663C5E301B9CC8025F92EC0C12B6781A8A521663A8DB75
                                                                                                                                                                                                                                      SHA-512:22E3EBE60BCBBFE6B728885CAE1B16BDB8D980B1AA80F931DDAC4020EC13CB7F3AE80CCD0A1A7465FB513D1AC70AEB59B12FB5E88CF6EC809EB178CCA2DB5405
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a........2^.q..Aj."Q.a.....Qw................E...!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!...2...,..........#p..$.u24.K2)....0..d<..0.....h;.3..!.......,.............I..8.m#.!.......,..........#p..$.u24.K2)....0..d<..0.....h;.3..;

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_questionmark.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 13 x 17, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                                      Entropy (8bit):6.968282594262006
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7Y4njM9CusK7SWlR4oPfMrjbi7voD7:0njM94QSWlR4oP0XbVD7
                                                                                                                                                                                                                                      MD5:A85D5FA023FD935DDA508A42B9DFECC4
                                                                                                                                                                                                                                      SHA1:2EE82A16CE7120CB2B211A3502E63023DD011C4B
                                                                                                                                                                                                                                      SHA-256:A47F084F275C50D52E4E74E44E554E4810210029337B13DCE3E98EF29FDDD35E
                                                                                                                                                                                                                                      SHA-512:1E07CC1A5CB220AE4C3FFE1860DA715C2C9E569B79A61818B4FCC2EDD4C9C6D05EA597DDAAB20B37950A005B642CBBF995AE809C0774D2D8584D87D2C366BADB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............&.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.10/1/14........IDAT(....DA..._.V.%D.h.(x....(6^.+(<..3H4:...S*..M&...2.w.f.w.sNf"...s....0..6...8.~.`....u..(.0pU.~..X.&Nq_xn".6:..a.......SJ.6("V.u...H..]....\..X....k5z...Z.q..X.NhR..X,f.....Y+0...jhXC)..`0X*..}~..&-..J..>.:@..;.......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\white_timer.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):449
                                                                                                                                                                                                                                      Entropy (8bit):7.31532155890383
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/74/6Ts/MYcGVkHcafQ2ueaTxpJz8mbEYST43v9u:x/6C3VkHnQ2vcxputYST43v9u
                                                                                                                                                                                                                                      MD5:DE0508D8669FC70B4D92B58076D288DF
                                                                                                                                                                                                                                      SHA1:AE206B763654EEEB4457853BDBD46A510A693ACA
                                                                                                                                                                                                                                      SHA-256:2ABBD585797B5DCF4CFE7908B5325E51CB5A0A5EEA117723A78444D484C1B269
                                                                                                                                                                                                                                      SHA-512:212BC0318562BED2CEE66C6BA4855F9F4A6A69125B869859AEE7BDC3F08A02EBAD9C6F5C432E6DDB3C091E4D8796FCF56AE6F2253A0C40DC2DDE7F97F49B3413
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....VIDATx..U=N.0..R.....J`.1...%6...#p....M.'ho.#.7..ea0...*M..8.*..>9...s...=..~....+..1.....R.-...t`$.si=....W2...E..,...$gh..{.j....<.T[..O!A<.?..&<'G...!.M..T..|.@H....N..S...K.8.Z.p@....|M~...(Lc.........).......E.....#....C..]sxlS.}6=....~.._.?.;.K..5..)r7h..nV.E.).=.F5.u3.2i..)`......*.....$@.}..] .9W.7......8w...y?....r.OW../c;.v.^.....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop-features.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 276 x 278, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):35407
                                                                                                                                                                                                                                      Entropy (8bit):7.981941276020834
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:EpdvcuDHkWJh2y4Aw9aT1hHkXQmyDyrXl+diVnF62TdD:CJx07ihcQml1kilD
                                                                                                                                                                                                                                      MD5:60A3D8470E34C3481A68B76078BA192A
                                                                                                                                                                                                                                      SHA1:8789F29DB3FE5FD262B2B68D8B98FF9BF153C19B
                                                                                                                                                                                                                                      SHA-256:1D23EFAC84950F046E1D0A7E9D1F483BDB73655023832071EC98314A690E651B
                                                                                                                                                                                                                                      SHA-512:A5EAEA04EAB134EE4722A2F5C756FCE51B4897598BE1152958E6530FB5C952AEE0A7D4FC34590EBB9480A7EABB73D640D41B695FF2F5110476C19B9312533762
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............hr....pHYs.................sRGB.........gAMA......a.....IDATx...`T.y..~..i.K..16`..68vj..nv..'...i..M.t..z..l."N..v....mZ......8.n....v.....Kl...s..y.....@...y.y.3+.{..}....&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a...&L.0a......L...+o.5@9K....0B...Y'.01.LB1A....... ..w.\.)L*.F.8.2.}..!2a.LB...r..A!..B.M8..4y..2..... .W4LB....%."-r....)...!sb...n2qE.$.+.......l..E{"+......P...l...U....G....[f...Z..`....vq."._.N2)....b.k.;......LT4f.L..i.8.>R.`)...;@&*.&.T0..c.O....C..4I..a.J......Ds.L*5....{.?C&*....Hh..F`...t.m.h...H..R.XyS..n.F...;,.t..M...(O.a....I.B..Xf.T.L....Ms.L.~.%.J&*.&.T....4/ .d..`.J....y`.( .LT.LB. ..D..~.s.DE.$..A.B....zx...;..q..$..A........g?.....$...AZ...4#. ....P*...;..D..$......... 3...`.J.@JZF..R.&.T.LB11%X..j2a.$....&.o}...K.q,.n2QQ0...eaAs...i..~W..Ky*.R...0..R).4L3..L.L.^..}..q)O..........,PI3..d..........Qw.<...V...i..l!..(....R

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\women-on-laptop.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 113 x 113, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7099
                                                                                                                                                                                                                                      Entropy (8bit):7.958625906013775
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:hScXQ1iy1L6kmI8NAtleZD+tr63hju2FxmXQv:IcA1iyIAtle9gr6I23mXm
                                                                                                                                                                                                                                      MD5:9E8923E6EE072C4457C0CACDFFE05D46
                                                                                                                                                                                                                                      SHA1:511DA86AF72017DBBBB1E327DC0998CA5A777616
                                                                                                                                                                                                                                      SHA-256:AF6C1FCF4F7FAD2F7599D3E1243A726EE02FD3F9EA2718537ABDE91A7D3AC8A6
                                                                                                                                                                                                                                      SHA-512:1A28C928788A0F5F8A499154817981EB5936C6A1C4A0D3B27F6C84380DFB335A6B0D23303ED1B9201BF1C0B0FF74AB998FE3A4AF192A0D17FEDF384114A1D0E2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...q...q......~L.....pHYs.................sRGB.........gAMA......a....PIDATx..]...........{.a.......;v0...;...c'...+.....gW......D..5d.l...(..v.Y.|l........1f....................=U.......6n.6n.6J..nR.}7<<..D.q-{8...e.p......2.^Zs.x%I....x.6...\..p.cQI...Ou.S}.$...._P....$...S...1.7P..g...S......P!..x...+..!..vW.A...($2..v....,{.?.M..k.V........ ....a?T8.J.n.T.......s.._."8.UPF...*..J......U....h..C. 2.........hO.]vW.>. .Nb..w...(...HBE.....L.KI axx.~...."........@.7........{.1.....>.EF..7<.H0V.9n..........i..OM.z.Z0.....)%...U...v......s1..8I.mP V./..l....T.......Y.-P ..\..qvv.*.L*..>..I.CH|.+_~.+0-.b...s..[.RW....dl..b....$F..}.{....6...jk...T..?...n...K.....y.z}.H".(!.@L$..}.ep...l{xd.C..l.H...........$..........>..sMH...d....#.......m...A.I.....j.B.Q2.....H...=<2.Y..F..........k........EF.I.?.b.DH..!$..O"Q...i...uv....I..-L._...7...".g.7...j...$$&$.Ee.....7.~.^.....&.`...~.;X.6OQ..~...R..?.._.......3.......\._......Khk....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\edge_search\edge_search_events.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2903
                                                                                                                                                                                                                                      Entropy (8bit):5.662194865121631
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:WKu+pGOk0nlP5OVkfJ8ZcS0JtSTXNgP8XoXy4XKGm3kqZQuoS02bQouqePCZT:VXpBkkPcVAc8yTXNgkYXymm3kqA2bQsb
                                                                                                                                                                                                                                      MD5:94239623C0D96EAB6755AD75BF896094
                                                                                                                                                                                                                                      SHA1:4579D824E6313CCD780DC5E81141703264F265CE
                                                                                                                                                                                                                                      SHA-256:A98467A77C8D7737E44BDFC3696E8B0F444035E5563C5BC33C91F08297FAE414
                                                                                                                                                                                                                                      SHA-512:FDB86CC91FB086D82B3E18E447B8B334344888DE44B576A57864307D2BEA270EB1D5249822AC4B7EAFEB103962EC56F73AA92F96CDC59DDE5850BB967586B09E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...7...7...>.......T...4...7.......7...%...>...'...H...4.......7...)...+...'...>...H......GetOption.settingsPpackages.edge_search.search_ext_popup: web view is not enabled or installed.info.log!is_web_view_installed_and_on.common_utils.utils.corev.......4...7.......7...%...>.../...G.....Cpackages.edge_search.on_search_ext_popup_coachmark_exit called.info.log.core........S+.......T...4...7.......7...%...>...G...+...>...4.......7...)...%...)...>.......T...'.......T...'.......T...4...7...>...7...%...>...7...%...>...7...>...4.......7.......>...4.......7...)...%...)...>.......T.......T...4...7.......7...%...>...G...4...7...7...7...>.......T...4...7.......7...%...>...G...3...:...4.......3...>.../...G...........tooltip...balloon_type!edge_search_enablement_guide.ShowUi.EventData....onExit<packages.edge_search.on_search_ext_popup_coachmark_exit.UiTemplate..UiType.overlay_ui.web_view2_ui_templatecfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\edge_search\edge_search_ext_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\mwbhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2174
                                                                                                                                                                                                                                      Entropy (8bit):5.879639004160988
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KEaWZxvG0vSdK0buxf58X0NyzG5hRCQRETK0xxPUwkLr:LaW3d6dTbuxfM0KGHRHaK0xSN
                                                                                                                                                                                                                                      MD5:751F431EED69732C5001AE06809001B1
                                                                                                                                                                                                                                      SHA1:7ADE8C647942A70E7B06B017F8EBDF976A81AECC
                                                                                                                                                                                                                                      SHA-256:4F0877EE9793285CCEE77C23110D12F05DE3027343018446AC239B67F8C961EE
                                                                                                                                                                                                                                      SHA-512:1F1A52A00BF2030C39D987A77017FE86914FFF3D5237A6F1098CF83CEE26F4A7362B4638E78983A353D5553213BB9A7C583BF8A2216DD72B82627A2F7ABB8554
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..:.......4...7...)...:...G....checklist_showing.mwb.packages.........3...:...4.......3...:...>...4...7...)...:...G....checklist_showing.mwb.packages.checklisttype....ShowUi.EventData....onExit#packages.mwb.update_mwb_status.UiTemplate2wacore:mfw\packages\mwb\wa-mwb-checklist.html.UiType.mwbChecklist.web_view2_ui_templateGfile:///[WA_FILES]/mfw\packages_web_view\mwb\wa-mwb-checklist.html......$...7...4...7...4...7...7.......7.......>...=...4...7...7.......T...)...)...F.......T...7.......T...4...7.......7...%...>...)...)...F.......T.......T...)...)...F...4...7...7.......7...)...%...)...>.......T...)...)...F...%.......T...%.......$...4...7...7.......7...)...%.......$...)...>.......T...)...)...F.......T.-.4.......7.......>...+...6.......T...4...7.......7...%.......$...>...)...)...F.......T...4...7...........'...)...>.......T...4...7...7.......7...)...%.......$...)...>...)...)...F...4...4.......7...)...%.......$...%...>...=.......T...)...+...7. .F...(...4.!.7.".>...........T...)...)...F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\stop-video-alert-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 95 x 72, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4147
                                                                                                                                                                                                                                      Entropy (8bit):7.943867399456676
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:rwd191zRv2ElL3+eYGSRCvWC7P4cHALED9gqwptnaO6:rwdXjv2Yz+mbuuZ09qwnaO6
                                                                                                                                                                                                                                      MD5:96E5352C228F18132282903C3CA79F35
                                                                                                                                                                                                                                      SHA1:9D7D72FB9134B222D7FFE36811FCC82FAB5FE0B1
                                                                                                                                                                                                                                      SHA-256:64BDF768575AFA7B3ECB4786F55F67983F5EFA2A8882D1F0131F8C28F646F5EA
                                                                                                                                                                                                                                      SHA-512:992F49CFAEE0692705D769F906CBCF7479FD87D2506D95DACF198E3457D6AC5A91776C710312405A7B5FF651B8C97CB10DD54B5D86DA202B8A1E9CEFC7D53955
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..._...H.......).....sRGB.........IDATx..\.p.......n...G....D$.b.H).2.tl.Vgj.....L[.N;c.T.vZ:.b[;..C<PK....$*.p.B ....{.....mv..Hv...!.?.....{........i.g....~..hnu:...l.B#....4........6t..........$^..|..l.M1u7$....8u...hYy....#..Z...|.u.N.?$..#...n....<..O..j....d*&......*...^x.?.9}...=..^.... ''...J.;.8....]...Lo.\tvtb....gW.k<....._.c.........2.k....NG.....F...FBBB@A._$se@.?}.c...._{......o.l.5%.F....@..:<......._.'.[...$o.....X.x>./X.}.......M......;.a%zzzQtCA..P.<}....B.#..C.7....*|...a...L.-m8..)....V...|..sf*q.j..RPp.r_s.<..:.am.tZ./.7"7;.{..Bcc..-..7.O......^....Y.i>q#.I.>.[.nG]]..'.I..i.............&..o...uy.::....r.8q..a....1.............y4._C\.nZ..{..7.|..u:-.W.Sz...2...[..G...e.7q...\......]{QT...w.q...q.....<.}..QTT..^..?..If#..{..ErR"j....^..9..9.=..x%.lCFZJDeH...d.....9........p....>.C.......q[i).>:...7....#!.=.....V..N...;.........O...C........W....y.ts..x..188.GC%..q..G..-PDSV.....E...47.lhh..5e..+....N.|..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-controller-mwb-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (315), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10945
                                                                                                                                                                                                                                      Entropy (8bit):4.489053914140562
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:b4H4SSJczePaYszA15HyXnTMAFdOSVwqA1zHS73j1S4UBH:MYSSJesvyXnTDqSV4BS75S40
                                                                                                                                                                                                                                      MD5:6163499118B76997FBA6E3F442299913
                                                                                                                                                                                                                                      SHA1:E8A45ECF6BB34934E7669E71C772D11C32A50B3E
                                                                                                                                                                                                                                      SHA-256:3081AB1715ED65F1966B9FD6DD9804052FB355391FF0A367707F1B3BE968898C
                                                                                                                                                                                                                                      SHA-512:244CF5725F4CF90A39AA1C4744782CE4228D18E924FE6FBDAA6D4A047EF82BC1924FD19738F9BE201913889D1DD8BC076A8461A2C1CDFBD51D1DADD1D0452E8D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* MWB CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.WEBBOOST).get,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.. var browser = _window.getBrowserType();.. var wbShown = "WBShown";.. var wbLastShown = "WBLastShownDate";.. var installDir = _external.getInstallDir();.. if (browser === "FF") {.. wbShown = wbShown + "_" + browser.toLowerCase();.. wbLastShown = wbLastShown + "_" + browser.toLowerCase();.. }.. this.update = function () {.. _window.ready(function () {.. var args = JSON.parse(_external.get

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wa-mwb-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2500
                                                                                                                                                                                                                                      Entropy (8bit):4.948428041546053
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3OTFbMv26ITWDE5g2CFqOcqehQORDVtEr:EaE6qOcqiQqByr
                                                                                                                                                                                                                                      MD5:2DEE7215DA12D80D92596D8E299ED39D
                                                                                                                                                                                                                                      SHA1:603B0F6B97D1E0AC6B7F2166BE234CB270FF2DD5
                                                                                                                                                                                                                                      SHA-256:5F2D71BBDBF2BD09E1E3C8B17BB17D9EA0CD79BAAAE1DA9B58CA5EC7E905C0EC
                                                                                                                                                                                                                                      SHA-512:CE796EDE8C6F9937E1582E3ABCF8A0101DAB2445BB44F4C57E5FE8A81DFFA7C74F92087B4862FE38697ECA62E755347DD3CDA96E47A5A5710FEAD5C8A5AE2CC8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-webboost-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:m

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\mwb\wb-rocket-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 19, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):435
                                                                                                                                                                                                                                      Entropy (8bit):7.339595422017506
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7op8DZNN+N/mjoPou/d3mFiRWpK2NV9V6/v7CFmP1:lwwN/fPouV3mkWvn9VSmMP1
                                                                                                                                                                                                                                      MD5:17F00098D9F726B994583103F81EB7AC
                                                                                                                                                                                                                                      SHA1:18DF2437F9019ED8A7E111EEE48E1CA17F3BB19A
                                                                                                                                                                                                                                      SHA-256:71983847EA4F7014741BD89DDF4A33AF884A7636414E55912077CC00959199B9
                                                                                                                                                                                                                                      SHA-512:2BD4C0C36B43B61E1544C99E4B8B7C46789EDF91206929EF7EB1F7E5E5B810439D2A673E3EDC200BAC295003D544B9B9B94275AA29D3DDE9F5585E550553E6E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...............-.....sRGB........mIDAT8...=K.A.E.1...&....X..(.....V..h.O.....J.l,l..t.je.."..Z....B.DD..d.f...f/.f.{sov.%.T..a...p....R..6X.O0..;.w....7...,K=V .n..'*C....D[..ds.N.4...W..C..]..}0uM1.. .^...C6..O{.3....8....\...t.#.Fc..eks...x...K.....W..o.}@.N.pH.l..H.E.....ix.....z.1....=....P.SG.y..]CL.p....=.@..`..^..~/.8.,k..5(B.........di.IZWi..t6........&..n.c...4.'..e ...]3..........[....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\clipboard.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 70 x 69, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3947
                                                                                                                                                                                                                                      Entropy (8bit):7.943205117846418
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:XpIVSotMeomWtuupLHgHzDJhbpmV3G4fNjirxU:mSCJodtwTDJhFu3G4fNWq
                                                                                                                                                                                                                                      MD5:744E7ECE73DE770613033AF4C28735FE
                                                                                                                                                                                                                                      SHA1:F7598A712AB76AFBFC8B880FAFA9C307D0942952
                                                                                                                                                                                                                                      SHA-256:7D324265349E5DF77B3A3A56112E5D13B7A1C9827C4B886205DAB99C279B19E5
                                                                                                                                                                                                                                      SHA-512:2BB6285603F134BFC6B3B0AA9B4F97B4156D354558AC3B73CE5661988D3A6516528D79DBCA1F82996BC395FE780F41AF7CF144ABAA3CAFC951C0D3FE0A08B165
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...F...E........*....gAMA......a...."IDATx..\.l\.....zw...^{.qpBB...........KA..Q.P.Am.......j..E .r........P..BI...hP.;.......|....}o.y.g.1.d.y....7.....f....C}........f..gE.Y"t......I....d.>d..O,r.&.d3+.x%..G.J...$...P8.....FC.4!..0A`.fk.a.n4....A|..~.@,..'....7tF...Q..C........d....Y.&2..29.HR"..Fs..L.J........<sZ..0..f..[M.A........?w..FcIJ...l..A..l.H.h.L.Fj...+...L.g.....)..x.f..M]mQ&^.Q........-^..v.....n...Y.-.pN`..j!..N.#..?4*g_.`>.s.h.?I^. W..E.K$ a..M.Dc.....{..z8.."...40..v.+.f.......C..Hb?.H*9..1+.\N./_K...082A...(.%...;H........".....n...=.#%+.&.b`...wP...e.t.......X.......:;..+......../.N.............>o.*Jb.#v...>..].j9g5_.....;8(f.).....V..V....J.Q.g.........>.?.p8J...v8..,.$.>.n..aE..;.m#.t.J.t....wkKY>...\Q.e.Rg.....1.....Dc..&EQ4.....t..."......'.?.&.c.I.....I..:.i...:...9..UUg...z..kw9....7;.O..xVq[...s~{..`.SO..E.....n]..gv..w.ib:.F.>...Uhi...z..p:r.].+]...U.m....ZB...P..1mm{....9.a.c...:..l.....=v.g..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):301
                                                                                                                                                                                                                                      Entropy (8bit):7.008936185757553
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPfAlD5bn3S1bu/6BIMYE00yLbOxD/WeahrkSiuBZ4dp:6v/7HAthII3MYEJ41lBiuBiz
                                                                                                                                                                                                                                      MD5:B437E1CC057558224FEBE4A96FE66CB7
                                                                                                                                                                                                                                      SHA1:DECA512775F0FF42BB1B6F734BDDD07DBCFA0AA6
                                                                                                                                                                                                                                      SHA-256:5F233229050143BA35B24A5DA5E1DB5F2ADCFB0E0F2B78707FFEAF39DAA19249
                                                                                                                                                                                                                                      SHA-512:EDACD7B9B7674FABB02BA5CB3B2BB5156C992C95715A71D6415353F9B62E9936335F490D2AE4CE7D58DBA68AAFC583AAEAD482D25DFAC459879CF289E2EBDB0A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....IDAT8....JCA..?.[...$..+.........|....BD.....i.*..V..h..+.>....*...X.s...f ..U..X}..B.U.s~SX.}..2..=.........0Q...D]U{.M.?../..}....... .eu.x..~.6..3`% ....y....+..BP../..8.)pm..\..M.h..Q.....-..Y.....u...T....S..0..e..%....u.8].^.........1....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\npshandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5999
                                                                                                                                                                                                                                      Entropy (8bit):5.756922019320659
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:7QqFHpklH6mmFbtk/LDTOrKeVDL4feMR8RhDV/BOOTCuYeHHXExCDI:7Xf+cJVfKeMRku1eHHXExGI
                                                                                                                                                                                                                                      MD5:0AFF0DEC4273481F2D0231212135AFE1
                                                                                                                                                                                                                                      SHA1:AB75F3D552D257FAB4BF9ED4A786381E46DC6B1E
                                                                                                                                                                                                                                      SHA-256:1D50F00A5FA9B6808326A246731AD7DA0E3BB9C0B13D7770F8E2DE39C87E686B
                                                                                                                                                                                                                                      SHA-512:F94190880F9639A9E2D1E7E982737817FA0618E585C477EB11413E6150D0A49D143C9E1F049B28A6C65A4AEBA2568DBA374B32F3FDC6BDE4DD1807FE7DCAABDD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...)...:...4...7.......7...%...4...4...7...7...>...$...>...G....tostring*[NPS] packages.nps.isSurveyShowing = .info.log.core.isSurveyShowing.nps.packages........#4...7.......7...%...>...4...7...)...:...3...:...4.......3...:...:...>...4...7...)...:...4...7.......7...%...4...4...7...7...>...$...>...G....tostring*[NPS] packages.nps.isSurveyShowing = .isSurveyShowing.triggerType.shownTimes....commandName.showNPSSurvey.ShowUi.EventData....onExit$packages.nps.UpdateSurveyStatus.UiTemplate2wacore:mfw\packages\nps\wa-nps-checklist.html.UiType.npsSurvey.web_view2_ui_templateGfile:///[WA_FILES]/mfw\packages_web_view\nps\wa-nps-checklist.html.nextSurveyCheckTime.nps.packages![NPS] TriggerNPSSurvey start.info.log.core..........4...7.......7...%...>...(...4...7...7.......7...)...%...)...>.......T...4...7...4...7...>.......:...4...7.......7...%...>...G...4...7...7.......7...)...%...)...>.......T...4...7...)...:...4...7...4...7...>.......:...4...7.......7...%...>...G...4...4...7...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-controller-nps-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (458), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27277
                                                                                                                                                                                                                                      Entropy (8bit):4.105662248972763
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:toM7vbmeEzk/beyLkwi1y42ykBkbae2vxDqkDd:+GbmSil1a
                                                                                                                                                                                                                                      MD5:A6730922F020B8FD2993A248853ADF39
                                                                                                                                                                                                                                      SHA1:BC811EBC4CB7299DBDAC37B756260BCB526C0BF7
                                                                                                                                                                                                                                      SHA-256:863DC17C079133F1B5054894C6FC2B5AB0C38471F07D3750C2E8E7EC87419498
                                                                                                                                                                                                                                      SHA-512:AF1EF5082182545C1B469B40871F834051EE34A266363D102D7CBA6FDC8F5ECF601520BA1618527EED8EB73C4136F4BA7983E6FBEC8CCFD5D15E0A77A96EECAB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* NPS CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.... this.update = function () {.. _window.ready(function () {.. var args = JSON.parse(_external.getArgument("template_args"));.. if ($(window).height() >= 630) {.. self[args.commandName]();.. } else {.. _window.close();.. }.. });.. };.... this.showNPSSurvey = function () {.. var html = "";.. html += " <table style=\"border-collapse:collapse;width:450px; height: auto;font-family:Open Sans; color:#53565A;border

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\wa-nps-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2495
                                                                                                                                                                                                                                      Entropy (8bit):4.949159025637677
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3XTFMv26ITWVMgZgAFqOcqehQORDAudGm:LcqOcqiQqt
                                                                                                                                                                                                                                      MD5:5F980A075503A74502F4B5B94F1C4B09
                                                                                                                                                                                                                                      SHA1:DCC3FBB974E51B139706040598770917E8B7EC54
                                                                                                                                                                                                                                      SHA-256:89D58BA9880BA965CEC5CCAC221A54FF011FE84FB471F7FF1187E217307A70EC
                                                                                                                                                                                                                                      SHA-512:10B20806F1D5C4A9013C733BB169C2117399E21C97AE11323AF7EAFEB4468804F64CB2033F0B31C79E3B2F996A4E904C50110351F44CE076617FC1A69E229263
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-ui-dialog.js"></script>.. <script type="text/javascript" src="wa

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_horizontal_header.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 300 x 378, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23888
                                                                                                                                                                                                                                      Entropy (8bit):7.972575063100117
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:EUB3ty3llPPn9q8h2pUKKvldY0LnnP4iNn95BbbYaEyuIrHkMwx0knasAJ1gZ6IS:EUFty33E8h2Onvv3LnQyTBAaJzrHkMhT
                                                                                                                                                                                                                                      MD5:C3BFA93D5C7DB61C39EE0964408A9652
                                                                                                                                                                                                                                      SHA1:0BF196BA363A55386E34EC578FB998434DFFA76E
                                                                                                                                                                                                                                      SHA-256:A2DA83CD9A0EE76F8030EA0A98A132062D3715D314120FFBF15E7E5CF6C07C5F
                                                                                                                                                                                                                                      SHA-512:262713F8063DE027CAB620F5752B3BB7A9C52F55643644570BFF84E877B7EE292257B32F34515FAEE6D00707368480F0039668F649979F2E07F1D2F68CDA33E4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...,...z.......e.....pHYs...%...%.IR$.....sRGB.........gAMA......a...\.IDATx....$U...".2+k_..z...fiD.E...u..Ft...WgFt.....qFg...gQ...Qy#....* ...6...M...k.......yo,..Kd.o..32...._.s.7...%......~..e..Y.z.u.........<.R.V......~S....Q.......G-......;..r.i.............o.X.0......a..".0...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aBCm.:i3..H..b.&4.`1...X.....,X....,.aB....0.....sLg.w.e............u:..r..H..{=.cr.Fu.N...w.a+..9.=...s.Z....i....t...D..&....9>..G.uD......p8n..n..2......k.......2...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X...Z.w8..uh..aG5..}.S..w......8.}.^.>./...P}'.....a..nu...@u.t.<..7..s:....t....t.N.[pz..i.....2....q./.l......._.+..@Ue.l.k.n....t.;m...|.y]..>......).{...>..'....w.r.~.%.....r..9fr)[...]B.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4.`1...X.....,X....,.aB....0....a.....0Lh`.b.&4..z.E.qz...<.p...7.k.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_mcafee_logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 230 x 46, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3442
                                                                                                                                                                                                                                      Entropy (8bit):7.917211786885695
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:1/6S6av9TkhLdTA7EQcAQWgDDJMB4bcpdQA7xSxygZAW1swGfru650YOydA5Yv3z:1SSdlx7EhAQLJbcp4tzf65xA5ef7gC
                                                                                                                                                                                                                                      MD5:857F7BDFB5EB00AAA643F1288B5A391A
                                                                                                                                                                                                                                      SHA1:7D58AD880ED35E794A5D3EB6AFF43B25986E348D
                                                                                                                                                                                                                                      SHA-256:E62646B24CE91D1A91D423A9579F67674124CDE0E76CEF490614588D0859EA2C
                                                                                                                                                                                                                                      SHA-512:910A14E7EF21901A6159403F98DB37866AEA7DEA6386484691C688AD1D5BFDFD7E43D1DF88D419E951511683E00FA28A6B50A335DE9D3EB51FE45F90E616FAC3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.eb....pHYs.................sRGB.........gAMA......a.....IDATx..]]n.H....[.&..`..O.O....C. ......0;......,.....@.........5O.q......=foU...2....l...Xj.Mv.W]U].d.f.m...`..........}<....<..m@......|...a.....f....B.|..o<........AF.z.....~.......r..O.k.....8?........C..Baq.c....z.q....N..N....Y@8... h.q....=....gO..a}`......?..l...@.&.;.r.fs.8.U.8.Ji3l.6[Z:.~..m..RT,......{.......W. ...15"L.H.v......:...i6...quuO.$..4..\.IxE.h...M..ip0.p...|.....i..%........._...e.r......Fd'.s..A......_AA R..Lq....s..P....w....xs.w...a.Y.E..Bu..-..(P.|P....Z.9...l=%).U.}.s...A.T....AZ."!...}.wO..."T[...)]x.@'.......r...Q..AZ...-1#..9.,.*.:..>!B.....`.j..<.Ic.5..0..}.........O{.ybQu....kp......K-.....K.3..(.q..|wvft4H.....,....*.@9.N<]!...py.!/.\[%..G.\.{%..H...A0..Y!.Z.t.y..!"...>.+.~9....6..8..UI......!..'....q.ps3l}.t..B.d..a.x,.[..,..c=..A._.N3......L..^p}=.F...h;...:.K..J2.y....H`.G..bF.IB..z......j..'.u8.*...<4#9.2.`...s@..(../

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\pscore_vertical_header.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 350 x 200, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12414
                                                                                                                                                                                                                                      Entropy (8bit):7.971836009107372
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mSwhyWo8nM3LYKcNcMEt2VHCk4pH4KjJBOh16ExrZLYTicctW1MUwPk1:JwW8M3LYVbA274pzNBS16E7ET31twPw
                                                                                                                                                                                                                                      MD5:401311D74B22F9A58BBB4567A9035C62
                                                                                                                                                                                                                                      SHA1:3C3AD0696E506D1D51B823CD0FA3E13CD2F605C3
                                                                                                                                                                                                                                      SHA-256:79D6B5369F72EABBB18D444363CC5A345F91538696238CDF03952975E51162C2
                                                                                                                                                                                                                                      SHA-512:791E332576282688F9F74041DCD7A27DC8C81046FB04869D2F08C0E88325BCCADED9346F696E6F4D8BCD4AC5EA1F8DD18488B1CAF9DEE1E6CEDBBD28940E7254
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...^..........c......pHYs.................sRGB.........gAMA......a...0.IDATx...x\.y.....W[....66`v.....p.m..4I..$i.....i.$.mC.K..i.%-$i.CY.....,......*.,i$.....F..f.3G.....f.....{...}...@2..a.F3.`..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2..h...a.FcX...0...e...../.0..x..a4...0..1,^.a..a.2...>0L!X...2.......c.3ya.2L.."Ss.....$..`.\...$S`..(..?.....v.T.....N...q.r.T...#h~.k.....+.e5.F..u.....cL.`...up..;`..80$.O.8.v:....S.K...z..C0..;.....8z. .....n..[......h..F-.x.EH7.3.G.".\..r.......>..1!....G.6"...."..L..Q.A9&....p....DBMI.v....~n$.......u&.?..J............J\N..6.....y{....+.Z.0....oB- .v.J.&.;.....G).Q*.G....".....-........+..}.{.#...)..m(....1`.....K/.....RX.v.hK.:......E\y.e)Q.c.x.......2].V....7.......[.]tG..8.h.}.HIO.v.....E........w(..#..}X.$.|.2I.....ar.W.....A.H..K...u%I.~..E.7lO.I.q#../..!..w>..5.|sAr...2[...E.T....]vya..$,..).....DV...}....[y.. .x

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\score_ui_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                                                      Entropy (8bit):5.668282672980567
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:vLFlllOmDXC1DgW3Wejgq+Tu5zIRcgYS2DZRQAb2X+0SJI55gH+Lkk+ZpYR86:RlllOMC18W3Wejb+IzIRkSQ12X+0XOA7
                                                                                                                                                                                                                                      MD5:C661D30E85956665C33E220221DEEAF2
                                                                                                                                                                                                                                      SHA1:EF10DE4F818C7564399A144F9F5E93921507887F
                                                                                                                                                                                                                                      SHA-256:34B82F206E615EC16C68600781BB8B1C37D9542EBFCEC025C4C1269556F7CB1B
                                                                                                                                                                                                                                      SHA-512:4453BDC0F7DE3D6A3DB0CD68E7AE422F117853658976DAAE8EE1F97F7ABB22DC3D9DC5C7E4F6C1509EEA4DF5C342932128AC6A0D36EB3A59CC0F4CB32A0F7262
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........3...:...2...%...:...(...:...7...:...4...........>...G....ShowUi.template.UiTemplate.transparent_color_key.upsell_toast.UiType.EventData....UiTemplate............$4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...1...4...7...7...>...7...%...%...'...>...4...7.......7...%...'...%.......>...G....Builtin_ShowScoreToast!EVENT_SERVICE_ShowScoreToast.register.handlers.ssToast.upsell_toast.RegisterUiType.GetInstance.UiArbitratorHelper.core..builtin.packages._G...//249BEF837026BE076FF489E245B9CC0B4F28CB2B02D0C4B26CDB2EB4BF0ABAC2F63D7A5C943BDBC3C9C503A76A3A59CA589B0663ACF6990F10F32C24CCA7E54E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-h.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2598
                                                                                                                                                                                                                                      Entropy (8bit):5.041489344653342
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UQXxoNKNv4spv4aj0MuoZv48Nv42EkGxvyxs0M0oLpxMIcoPP2u0pq2uD:xExd4847hk4a42Eyxs0VExkoPOvw3D
                                                                                                                                                                                                                                      MD5:C1BA351DCCD82433C6C43D67BF4B26C0
                                                                                                                                                                                                                                      SHA1:CB0382255255C55B10A397E20CDAADA160DF7D38
                                                                                                                                                                                                                                      SHA-256:4F4A1183F9B19BF5173E34B0473600650D20B7FB0CEB79FAD010B9C72F83AF76
                                                                                                                                                                                                                                      SHA-512:2DF9A456AB796FC3D6027D8F38605A94D647113F27905B119254106D8AA5491D60E66E2A92B24CE4DDBED6679339D3993DE0511333DC83FBDB010D626A51B1B0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}.....main{.. position: relative;.. width: 525px;.. height: 189px;.. background: #FFFFFF;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;..}.....header {.. position: absolute;.. width: 150px;.. height: 292px;.. left: 0px;.. top: 0px;..}.....header-image {.. position: absolute;.. width: 150px;.. left: 0px;.. top: 0px;..}.....content{.. position: absolute;.. width: 375px;.. height: 188px;.. left: 150px;.. top: 1px;..}.....content-middle{.. /* Middle */.. position: absolute;.. width: 327px;.. height: 134px;.. left: 24px;.. top: 30px;..}.....description{.. display: flex;.. flex-direction: column;.. align-items: flex-start;.. padding: 0px;.. position: absolute;.. width: 327px;.. left: 0px;.. top: 0px;..}.....description-heading{.. /* Heading */.. position: static;.. width:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-h.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2121
                                                                                                                                                                                                                                      Entropy (8bit):5.114460372689897
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:fgn2sYswbZbMGNVMz7/VMz7EVMz7VMz/VMzEVMzkLVMCqGJKY0Zf+PGQ4xrzTHwR:YabMuv26zgiCgFFm4xrzTHwaM
                                                                                                                                                                                                                                      MD5:8F9FA9686249C702BAB360FFEAA19E8E
                                                                                                                                                                                                                                      SHA1:EBD4761032A32E3868AB27CEDEEC91BC4732DE03
                                                                                                                                                                                                                                      SHA-256:21F33807C6CFC69EF35A2D412B65851E1F1050C58F85D6103D0183EB73E2D989
                                                                                                                                                                                                                                      SHA-512:FA98B795F79A0295EF2FDAA7225B5F6B925170F9666A67D6E840527FCBB0E5D0858E26F00061DBD6CFFE670724CCF29FD67B81E4D866088447D3E4685C584805
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Horizontal Pscore Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&family=Poppins:wght@600&display=swap" rel="stylesheet">.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\tests\\score\\wa-score-toast-h.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-pscore-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\tests\\score\\w

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-v.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2850
                                                                                                                                                                                                                                      Entropy (8bit):5.091946426041461
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UQXxxxvmyI2Muoyv4yoEkMVGvgQ+L/MjoWEOM5RchYubipqT/MIM9m+2oHy:xExxZjhF4r8wdU0xz6iFiwT/0EVoHy
                                                                                                                                                                                                                                      MD5:9B6CF471B268F3785466CA6889880B67
                                                                                                                                                                                                                                      SHA1:FFE049A5B7373A8074C3D2D09059FBCABD1388B5
                                                                                                                                                                                                                                      SHA-256:66B5C4B40BE9D1590ECC6B56A8E82DDA4073AAB95817C310F7C10179CB54D020
                                                                                                                                                                                                                                      SHA-512:9708511E0B957839713B2D0864D6E1D2E88B84A6C224DA20F9B1BC4C24413C9391D7E1F1E54EC1A3BB388E35DF2278A64A88C4F4BDEE0E96727462212CADCCDD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;.. border-radius: 24px;..}.....toast-container{.. /* Score intro toast - Vertical */.. position: fixed;.. width: 350px;.. height: 486px;.. background: #FFFFFF;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. left:0;.. top:0;..}.....header-image {.. /* Image */.. position: absolute;.. width: 350px;.. height: 200px;.. left: calc(50% - 350px/2);.. top: 0px;..}.....logo-image {.. /* McAfee/Landscape */.. position: absolute;.. width: 100px;.. height: 19.63px;.. left: calc(50% - 100px/2 - 103px);.. bottom: 245.37px;..}.....main-description-container {.. /* Auto layout */.. display: flex;.. flex-direction: column;.. align-items: flex-start;.. padding: 0px;.. position: absolute;.. width: 309px;.. left: 22px;.. top: 253px;..}.....description-header {.. /* Description */.. position:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast-v.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2176
                                                                                                                                                                                                                                      Entropy (8bit):5.183650115675611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:PKn2sYswbZb2GNVMz7/VMz7EVMz7VMz/VMzEVMzkLVMCqz0y5kAEaAPHRHheSfV+:qabOuv26zgiCU15+lBRfV+
                                                                                                                                                                                                                                      MD5:6F0D34D207FC45B9BF3B273EBDAB57A7
                                                                                                                                                                                                                                      SHA1:4B7A32847CC0485D657960AEE37B61A7A2A9985F
                                                                                                                                                                                                                                      SHA-256:4B8BAD13FA6CE19049D9EC2E1E0C5F52727DB922C98141EF15706A23552BDD2B
                                                                                                                                                                                                                                      SHA-512:3F5CB535171C85A5A522DEF14F1537BF652458E534F33D062AE670ACA6CE831D31EBAE8A6AC63C07DC6CF7D5100A31BAC1A8597CB9DE45599F3F6AD25B3D5805
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Vertical PScore Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600&family=Poppins:wght@600&display=swap" rel="stylesheet">.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\tests\\score\\wa-score-toast-v.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-pscore-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\tests\\score\\wa-

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\tests\score\wa-score-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:assembler source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3537
                                                                                                                                                                                                                                      Entropy (8bit):4.941587827298674
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:T4dKKNAuahTxUATiX3JGJuCEsyU4Im2OmZiK:UKKNAuaNPaZGJupvIm2OfK
                                                                                                                                                                                                                                      MD5:B7770CD5996EB35DC3E728671EA67CB3
                                                                                                                                                                                                                                      SHA1:028FC16A24A9B6D20EA1533419A24C87318A87A4
                                                                                                                                                                                                                                      SHA-256:E85CF4E09A0547FBDF7D1E570E13945935DA3351B684BCB39815AE653A703912
                                                                                                                                                                                                                                      SHA-512:A08C4D1A5E3E317967C755A363874D2DFCDC2030FEA67160B36A31277FD40ED3234931B3D81EC456CB3FA7FE38B267570ED51C6DE44A5A235E6B6B26CBD8E9A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Protection Score Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... ui.pscore_toast = function () {.. var $el = {.. description1: $("#description-1"),.. description2: $("#description-2"),.. acceptBtn: $("#accept-button"),.. ignoreBtn: $("#ignore-button").. },.... show = function () {.. _window.ready(function () {.... // Get protection score cohort value then set size toast window size based on that.. var protection_score_cohort = _settings.getSettingScopedWithDefault(1, "1", "protection_score_cohort");.. setSize({ width: "364", height: "500" });.. if (protection_score_cohort === 2){.. setSize({ width: "539", height: "203" }).. }.... // Get settings data.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.PSCORE_TOAS

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon-selected.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):477
                                                                                                                                                                                                                                      Entropy (8bit):7.351051330229087
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7y2VDhNOYjroguA84jleUzz0BDdbNSp42duo1:wVlYq7kC02yNSp5Qo1
                                                                                                                                                                                                                                      MD5:8DD33EC0D498CB6C2FAA490D5FFCAB72
                                                                                                                                                                                                                                      SHA1:E278EF1E92293D41820D83E115A7195E30509BAA
                                                                                                                                                                                                                                      SHA-256:C43CDCDA1172EA4E55CD6725B5FB3B0F2ED9F8AC2C3DFAB3CB5A927550C00492
                                                                                                                                                                                                                                      SHA-512:20257C6B39D94376C69118E91480F101B96E168E0C1AE599E505E76C4785A08C7CEC0297B84B8FB99EC690C16FEBE8985C8558AFEE13A7503D053760FB52B242
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.19..d...ZIDAT8O..1(.a......QJ1... ....2.3..`R2.u...*.h1. ..,.1...=..9}.........y.._....E..M...%;j....}|.Z....m5........;..,.v.l6...X....^].F./{.q.-V.0.sGaf...\.S.*WV..7.3f{U.A......Q.....L..%.Q..\.'....M.Q.lOn~.;.p]s...j.....5G...c.QV|a..(....1.+..W:.2l;....b....)7.3`;.....Z...Y.....KY.V...Jx.V.G~..V......+.!..U,.........|.O|.s.`...'I...-Ps4m."....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\about-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):621
                                                                                                                                                                                                                                      Entropy (8bit):7.440301212402691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7y2VcCkoWVpXHvC+N3Pei2PrEyBvatOrED0uapdvoXP:wVZk/9/ei2D6d07m
                                                                                                                                                                                                                                      MD5:CAE22AF422FC994E24E8CCAE7ECDFCD2
                                                                                                                                                                                                                                      SHA1:E237654EE11A51773BBC840A27F79D6EB2DB0000
                                                                                                                                                                                                                                      SHA-256:48B34A024F5B925DFB6B8973876708BDD49B363712E74981078661D638E8440B
                                                                                                                                                                                                                                      SHA-512:8A818292FB67F81A7339DC2866EE5884DBF5DD97707F6567F4B1A6DA7CDD8FE8ED8BBEAB04CA610FFF2C1B80C36A1873ED331187FD9A8BA8734DBAA401076379
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.19..d....IDAT8O..1H.A../!Q....@@kI.H...AmR......w.'.W(j..UHa%H..b.(....R^.B,...!M .I.B....x'..`.._.....y....U.e.D.4.D..Z..Z...I.+...B...i~.R.=.2.Ci...3.zw.c...;...n.ju...(.G.e..(}..<w...Y.R.b..v}.='0.V.^.tQy..,rf"T.B.Ry..&..._sQvw...%g$p....8.8...,...R.I..........'......g..m..^F.7N..Q.i.....<..O.8....y..<"..I}...,...*...<R&...s..;\..J.'8.G....f..o...l .^...(e^..;..t.._.....F%...k$.......:.'..u.n..g....@..N...E.....m....4M.\Do...H.b^?...t....}.......}Ahl.G....~..>.@..3g..U(\.Q....L......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\badge_unsafe.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 52 x 52, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):957
                                                                                                                                                                                                                                      Entropy (8bit):7.697613181319463
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:A/6SFlM82TeEtptDqNrmcMg+nv5eYIIHUVcIFOuIvEvKZiSGtvml:A/6TRnONav7he5FBIvESQSGAl
                                                                                                                                                                                                                                      MD5:BCF5ED81D209242E53EF15C8F0CE28F9
                                                                                                                                                                                                                                      SHA1:DA551082C031F0F532E61953479EA7BEED4E1068
                                                                                                                                                                                                                                      SHA-256:D7BBC3068A4447D0B6AB734C9CD0AE5E13393152FFDD51E6CC6117637F9063A6
                                                                                                                                                                                                                                      SHA-512:0B51D2BBFA103E53E7C7E204DD815160B0AD679218099AF9C8BDBCFBA83A6FB1FF480651D2B28DE690C222B2A8B74D44823BC5E16CC46AAE1E725E9694390B37
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...4...4......x......pHYs.................sRGB.........gAMA......a....RIDATx..OR.@..npeie.%:q.F\."s....`.....8.s.9.a....eJ,.Ci.....I......$...$$..z._w.n..Q.....R....E.v.&.k=....xyy@F......T..T.K..T.B"..J{Uq..i!@...,a...~#.K.2&$."...9....2.%..,....5....Rm||..`0Hr{"Ajo.F.r.k..b.k-..D..i.|v.H..(h.y?......t.b.....:.a....t.G....T..6.Y>.....o.~.....@>.l...tu]'.[.C..2p....c..O..U.O(....;.I.B..e...P...... .j.F\........9....1..BB.wH.-..@.".....2.Rh..(:<'.H....O0!.....Y..Z$......I.g.,Pr...9.E!-.R.,I@.!-.%......>..!.B..A.........x....2...4P^.\.....:(.Jut.D....^.....&.7YG<?....-Lqu5.).9\..-.O_]d.g|....8Qb.RJ.Qz..-..\...7...b.`|,.D.p.onF.|lB....0.9..8.. k....b.`..N...0..1.j4..:..A.-..FQ..W...Y...*.....w..[[...1A........r...t]'.:c..{...+X........../.7.N.n3X...||..O..X/......oC..m.4*..X....7.'Q.G..J.l#!......a...>k.TZ.7..<.~{....<^..:.."....7..v.,..fNj..}.-=.'..._!C.8.kha.....h.t.....j...5...A.S.......IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2269
                                                                                                                                                                                                                                      Entropy (8bit):5.231778970674772
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UoZJx7MdDjTPWfx9gczwPpCRulmR+VPeKz:xArx7M5TPWfx9lzws+1eKz
                                                                                                                                                                                                                                      MD5:AF28F4D0EC0F1BF3AE024C0C78D3B468
                                                                                                                                                                                                                                      SHA1:9D44E422F0F26CDC56EE0A2656C4155A8DC9B158
                                                                                                                                                                                                                                      SHA-256:A2763FEAC3A5EB5E9DFE26A88CCA1E3ED9A221FE6D5C5DBFE4D08F63066C907D
                                                                                                                                                                                                                                      SHA-512:7D8591A44973A44F223393DF04F7BE8DC6CB407A12100AB8E8E7E1035BCCFE951D1A6D22573C184F1E7990332AB2D6DFFF0FC180AA22940AB9F8ED380FC56CDF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; /* Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 16px;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 16px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. paddin

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2337
                                                                                                                                                                                                                                      Entropy (8bit):5.204519131162209
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:AswDjY49GNVMr71rAVMr7EVMr7VMr/VMrlqVMrkbAVMCrmglBkkEEvURFWS4CicV:DOjllTneCPIHCT4QSFWSO7QmqPOdE
                                                                                                                                                                                                                                      MD5:9C0748B7C60CF9D637F7B21960981FBD
                                                                                                                                                                                                                                      SHA1:7BA486136C58F111A6302AF1CD86B2CEBB9EC981
                                                                                                                                                                                                                                      SHA-256:1B798281A4DF16E549AC8C4A0C06652EBBC01E98D600A0885E6CDAF1C6612979
                                                                                                                                                                                                                                      SHA-512:9EF091FD3DED626EDB6277DE6DC70FABD3E7BA01CEF38629B0FB1C800E18D30F5341DCF609DE3A994D258AE5A93D1FD4BFBD9F820132FD64F153426BA281A67E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>....<head>.. <title>SS Toast Variant</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-checkbox.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ss-toast-variants-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-checkbox.js"></script>.. <scr

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-checkbox.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4550
                                                                                                                                                                                                                                      Entropy (8bit):5.052302310512664
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CAATI313XsdWNR8jEcYw1TwVVXK+0OG1rAVXX0fFFXs1:lAGJsA78jEcYwFCVXuOGuVXkffX4
                                                                                                                                                                                                                                      MD5:1489AF8CC75A33BDDE32FC2FA2974206
                                                                                                                                                                                                                                      SHA1:1543A86BD9F9D2DF2079E777E27F31EAB9A5DFFA
                                                                                                                                                                                                                                      SHA-256:816B368F1272C3C9052FCFEABC32068C037C1986EBF05582CEC111DF7868A3EF
                                                                                                                                                                                                                                      SHA-512:E889C48FE019EB705D02C2CB3D12718FA010F713CE43ED293A27E70D394AE5F7997B774C3511A5E9B744C6B4FB2C9CB7F906A0CA97CD0A9504B596CE95357405
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. };.... function fillButtonText(btnText).. {.. if (!btnText).. {.. return;.. }.... if (btnText.length > 8).. {.. $el.doneButton.attr("class", "button__unfixed__width");.. }.. else.. {.. $el.doneButton.attr("class", "button__fixed__width");..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7069
                                                                                                                                                                                                                                      Entropy (8bit):5.114929053169035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:OWZxXMHRMroWa7b6xEgPGquAED+YhAAA8b89Y/5Pbqx51E5hh565/M7buH0eFDeL:OW0H28Fguf+y89K2kCdMunbK
                                                                                                                                                                                                                                      MD5:9D573A8B481942D094BEEDC60749B60C
                                                                                                                                                                                                                                      SHA1:DAB289919E0445695EFE5611A7D5E6D274568801
                                                                                                                                                                                                                                      SHA-256:6C027DC8F2928C0B0CCFB0C50095E9C2CBF34E3897F72A324F3B16D6B0EBC973
                                                                                                                                                                                                                                      SHA-512:496818CD811DC4461556AADCF6046FF38E6FF012CC891B609DB1399FCBCCF5C5BB6389BF5BB613E3664A24A6AB82FD8EAFB184CB9336B3DD03B00A4718F8D408
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* version 2 3 */..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */../* version 2 3 */...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../* version 1 */...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../* version 2 3 */...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;.. width:fit-content;..}..../* version 1 */...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../* v

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3755
                                                                                                                                                                                                                                      Entropy (8bit):5.082899657840597
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:jMsaeRv26XbWgHZNG50ybUYoA1gPeaNS6cD2QXIan75NMlr:jDbLNw1AYomgPeaspDfXIandNMlr
                                                                                                                                                                                                                                      MD5:4CBB1BE0AC333369E33FC50D9EBEC4DC
                                                                                                                                                                                                                                      SHA1:393FEE09211EC329575974F33BE6935136B239BD
                                                                                                                                                                                                                                      SHA-256:576E6DC9F4400FC723D2CA46BD3F9DA1FED37E5AFAAED232828A240832CD0161
                                                                                                                                                                                                                                      SHA-512:6302C5B6DA2AFA66EFCD7DC8B82045358352F471A0F3485A174E9223FA049B4FB96C8DDBD1FFD5345125A36353F55FAD4272BD8CF5056EA3CDFCF87B3FDA7A90
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>.... <head>.. <title>WA SS Toggle Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\aj_toasts\\wa-aj-toast-toggle.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\pa

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8089
                                                                                                                                                                                                                                      Entropy (8bit):5.1197479924618285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lAvUEJU5h6wFCVXuVdDE6hYkBaWPwT0JrrvG10qAvlGuVXkfldXt7:mvhJYDCV+fEGIj1sVUdt9
                                                                                                                                                                                                                                      MD5:5A31A78F0F3F9306FF37812DD9B8A9CA
                                                                                                                                                                                                                                      SHA1:F1BCCB3A762C6DAF44CAC4EF61C9CDD9F1F956CD
                                                                                                                                                                                                                                      SHA-256:E63990E32728C39F413FE9EEE5E297C462834CA47F72C272252C680C78A8B57E
                                                                                                                                                                                                                                      SHA-512:67D454A6B1E382D1ECBEABD4E9E18137109C85EFC9DBFE7AA575ACD135A46A0270D8D1A67D91BA667F834B73C412699DB5679FB126063E689EC301D3B5D3C5DD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. version1: $(".version1"),.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. feature1Label: $("#feature-1-label"),.. feature1Name: $("#feature-1-name"),.. freeLabel1: $("#free-label-1"),.. feature1Desc: $("#feature-1-desc"),.. feature2Name: $("#feature-2-name"),.. freeLabel2: $("#free-label-2"),.. feature2Desc: $("#feature-2-desc"),.. checkboxContainer: $("#switch-se

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\amazon_upsell_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1238
                                                                                                                                                                                                                                      Entropy (8bit):5.6916067450305725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:ytKnKkHvUTkKUY94bXSx7ngIdMKWF8gGX5pb+IzIRZCUTm2X+0XLGGjj2:ytKnKkHvUBUNXEngJKWqgy0CUTvxXL6
                                                                                                                                                                                                                                      MD5:3EA2071874713D503BFE15FD05D6B5E0
                                                                                                                                                                                                                                      SHA1:FB3F23A70B2A89363F8A52F91779F6E9BEE5DDEE
                                                                                                                                                                                                                                      SHA-256:D2F0F76C8ADA689A203598B8B3DECFD7BC470E1497D639C5EC79355AE4B6C963
                                                                                                                                                                                                                                      SHA-512:80ADC2A00D9FA01CA1764EE794D821DB27AF0643C70B18867F8A06F5049119C42AF4CD64C16C2A4641686E36225BEFF1B2ED75F6B64A5E30BB6A628344F9FEF1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........J7...4...7...7...7...7.......T...4...7.......7...%...>...G...4...7...7.......7...)...%...'...>...'.......T...'.......T...4...7.......7...%.......$...>...G...2...2...7.......T...7.......T...7.......T...4...7.......7...%...>...G...7...:...:...7...:...7...:...%...:...:...%...:...4...........>...G....ShowUi9wacore:mfw\packages\webadvisor\wa-amazon-upsell.html.UiTemplate.EventData.amazon_upsell_toast.UiType.toast_cohort`amazon_upsell_handler: amazon upsell requires toast_count, amazon_extension_status, and url.err.url.amazon_extension_status.toast_countEamazon_upsell_handler: amazon toast upsell is disabled, cohort: .amazon_extn_toast_cohort.GetOption.SettingsDB9amazon_upsell_handler: amazon upsell only for Chrome.info.log.ch.BrowserType.BrowserUtils.utils.core.Browser........$4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...1...4...7...7...>...7...%...%...'...>...4...7.......7...%...'...%.......>...G....upsell_amazon_toast.event_amazon_upsell.register.handlers.a

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\checklisthandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5495
                                                                                                                                                                                                                                      Entropy (8bit):5.7918712287312095
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:OBVUGptMZMVHwyeMKfH+ge8PplOIrfjBdnGtY3XAquLbWQY6guNx6EzO:OBNGGHwn/+gz+IrfjBdnGteAnXPYduN2
                                                                                                                                                                                                                                      MD5:90C8D812D17E803514D04AF0D322CD53
                                                                                                                                                                                                                                      SHA1:86A143CF3D0C0763F5565D6987AD0D861EB0E3A5
                                                                                                                                                                                                                                      SHA-256:CFBF67319BECCF51105A140435358EDC7863CF7A1DDBB3224D9CCB716C1E839C
                                                                                                                                                                                                                                      SHA-512:85FFADBE511D09689F00ADB0E2BBC576C818B8C3B9182A05B7694F5A83B75F447DCB165E880101098723CBE7DDF72BAE563FD90FBEA3F277F92695ADFCC0091D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........3...:...:...4...........>...G....ShowUi.EventData.UiType....UiTemplate5wacore:mfw\packages\webadvisor\wa-checklist.html.web_view2_ui_templateJfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-checklist.html.........3...:...4...........>...G....ShowUi.EventData....UiType.downloadWarningToast.UiTemplate3wacore:mfw\packages\webadvisor\wa-dwtoast.html.web_view2_ui_templateHfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-dwtoast.html........U4...7.......7...%...4...7...>...$...>...7.......T...7.......T...4...7.......7...%...>...G...2...4...7...7.......7...)...%...)...>.......T...%...:...T.).4...7...7.......7...)...%...)...>.......T...4...7...7.......7...)...%...)...>.......T...%...:...T...4...7...7.......7...)...%...)...>.......T...%...:...T...%...:...+...%...........>...G......checklist.showChecklist.showUpgradedUserWelcome *DisableUpgradedUserWelcome.showCryptoLearnWelcome.*DisableCryptoLearnWelcome.CryptojackingDisabled.showNewUserWelcome.commandName.*DisableNew

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\chrome_extension_push_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1651
                                                                                                                                                                                                                                      Entropy (8bit):5.581763094422424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:2b44px4rgAij/pL4eMQIhzLRCziQGePQ6NNL9B+Izdg++U/h4t:ypWiiQGzAtGaHtjj/hm
                                                                                                                                                                                                                                      MD5:E3BFCD80D24E6C3442D4B9868649C1D4
                                                                                                                                                                                                                                      SHA1:5FD488AF5BB6EBE0C169D2374E7D1BB4F335EF88
                                                                                                                                                                                                                                      SHA-256:B3F5D82E554B072B0FF00EFBA18150A233147F1C0F202D8ABAB68047727571BE
                                                                                                                                                                                                                                      SHA-512:AE998F522FA9740AA3D54416E56DF7A9CD2A71B589321ADE719BF29B7FA6872667B9FD5D1026FD5384B9DEF45C1438676C4FD47A8DE4792B6A6F3ED091075E8B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........&...4...7.......7...%...>...4...7...7...7...7...7.......T...4...7.......7...%...>...4.......7...%...%...>.......T...4...7.......7...%...>...G...4...7...7.......7...)...%...)...>.......T...4...7.......7...%...>...G...4...7...7...7...7...7.......T...4...7.......7...%...4...7...>...%...$...>...G...4.......7...7...4...7...7...7...>...4...7...7...7...7.......T...4...7...7...7...7.......T...4...7.......7...%...4.......>...%...$...>...G...3. .7...:...4...7.!.....7.".....>...4.......7...%.#.....>.......T...4...7.......7...%.$.>...G...4...7.......7...%.%.>...G...!chrome_ext_push_handler: endRchrome_ext_push_handler: Failed to trigger LogicMsg browser start on browser.OnBrowserStart.encode.json....IsExtPushTriggered.., no need to engage1chrome_ext_push_handler: extension state is .ext_no_entry.ext_enabled.ExtensionState.ch_wa_ext_id.get_extension_state.browserSettings. is not supported.tostring&chrome_ext_push_handler: browser .ch<chrome_ext_push_handler: chrome extension push disabl

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\cryptojack-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 170 x 167, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5286
                                                                                                                                                                                                                                      Entropy (8bit):7.918352410896778
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:VadOXrG7NapBuqn5EVYrylb7le57jdIt5X/pu660z4GKbAkhYaPQGflW1:B7smri6ryhGGX/JNzoAkhjYGfe
                                                                                                                                                                                                                                      MD5:992B99090456FAE196C91BFCA1630D5B
                                                                                                                                                                                                                                      SHA1:5079D7427DB7384162CFD4917A87D1B9C3235A55
                                                                                                                                                                                                                                      SHA-256:F86960D443E848E83A2BA3B27B68EE488623A6E6E80E74594E69802FC472AC8C
                                                                                                                                                                                                                                      SHA-512:80A8DACF479B444979889F0D9B5DDE429AA794D8D7E1430B4555571513FB3FB5F6F950B2FD989A7DF9B4EBAB7ADE271B5C8A635C4B247FD9D3D97EA96FEA0AFF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR................\....pHYs...%...%.IR$.....sRGB.........gAMA......a....;IDATx..{.T....{.a......GO6...*E..`.n!<$+L$.ML...X1.qe..V........M\.2C.v.'....uf...$.Vx..0.. P............}o?.....3}ow&...;...HA.ljYLzj..:Q.........(."I.LOj........Q4q..)-2....\..>_.^."K.|.f))H..F.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF.XTF...'.V5..b.G...4.Qv.a._..21...4...=...g...WD.....\.......d;.....6......D..N$2........3J..2J..2J..2J..2J..2J..D.r.t.-T*..n..OS.......C. .....r*..^5...E...n..%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%`Q.%.[..fc.....:.g.0..Su.%^...kkg'.Z]K[...).?H...N|z...[..v.z..........x.>|8UVV\y.....X..xf..g.....5v.r..?_@..K..N.(g..?....o...cFSuu.F...kcE..V.....o.LRY..9j<...i.>...>S=.n.i.x.....k.......VB#.ow.b.X[...^.3..w'.#......P....}.....<.T.F.b./U;.n.{B.8.v..t....rA.W.....[......h..5T...<U.Pg.Pk..5.~v...J'.B.5;.ijv..vB.Q.?.-.3u...R.S..kj!].....H.T..o<Pr..PE.eO=).H.I5 l{..I7.d../V....N.Q.P..E...u..E

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\ext_install_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1228
                                                                                                                                                                                                                                      Entropy (8bit):5.769756694162712
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:WnJZ2cCsJdPObNlpwgMT9CFbzW3Nhb+IzIRQs2X+0Xlt63UV0K:WJ8czdPCFM4ba9xdNxXlYkV0K
                                                                                                                                                                                                                                      MD5:C7CC6D53BD51DF951F397FC99D62E1C3
                                                                                                                                                                                                                                      SHA1:831BD7BEC40ADF0027C517C7471F615CBB09C099
                                                                                                                                                                                                                                      SHA-256:6A38EC3EDDFA2E17FD6F6A7C1C868069619AB849D5B5628DDAADBA39C5C0D200
                                                                                                                                                                                                                                      SHA-512:FED60776DAE1A87F18714CF76B358783E30796A8801AF95FE0AA4BEBE64A394C4D135409C1B3626EA042BDE0767871D0D100FB6F6898D5EC42DD7A0FE73678AD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........<3...:...%...2...%...:...7.......T...7...:...4...7.......7...%...4...7...>...$...>...T...%...:...7.......T...7...:...4...7.......7...%...4...7...>...$...>...T...%...:...7.......T...4...7.......7...%...7...$...>...7...:...4...........>...G....ShowUiEshow_ff_extension_install_toast: got implicit close event name: .implicit_close_event_nameRfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-ext-install-toast.htmlCshow_ff_extension_install_toast: got custom WebView2 template .web_view2_ui_template.web_view2_template=wacore:mfw\packages\webadvisor\wa-ext-install-toast.html.tostring=show_ff_extension_install_toast: got custom IE template .info.log.core.UiTemplate.template.extension_install_toast.UiType..EventData....UiTemplate.........$4...7.......T...4...2...:...4...7...7.......T...4...7...2...:...1...4...7...7...>...7...%...%...'...>...4...7.......7...%...'...%.......>...G...$Builtin_InstallFFExtentionToast*EVENT_SERVICE_InstallFFExtentionToast.register.handlers.ssToast.ex

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\facebook.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):407
                                                                                                                                                                                                                                      Entropy (8bit):7.1407976551071055
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/74/6Ts/+smsfwZQlyCzDSkG+ZlfDN+y9X:x/6afkRChDZ1DEy9X
                                                                                                                                                                                                                                      MD5:52488EF2BAA65366C96F39947B5CEC32
                                                                                                                                                                                                                                      SHA1:580C1612E3D607EA8C3C83B03285ED6B5E5AFC23
                                                                                                                                                                                                                                      SHA-256:C0E9102EF0C19E55052516B7B11F95E96A13A93A19DA66328DE5B66740CE4A4E
                                                                                                                                                                                                                                      SHA-512:0D54D10933E441EB624CCE78C293162AF8150134199D7C2AA54554476CDB70983A3CC069B23D3C93D736612C80EF6C31CA1842EB72385FA4BE359A40F36A5B67
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....,IDATx..k.P..H.....;.P:..Z....[.QG.I\..]}L...... 8..........1W1\|../8.....|9.;.r.@>. ..(HZ.%'p.Y..;...[..r..m...Z..&.l^.....k-B...Pk...~?.....{.....b...f...}...ty..C..`...@<..,.]..R<u~.{@f=.w.<..x|.zsjq V.......I.KC<.}.....V{.l].Lg2..v..m!c....@g..-.>...@v ....L..l.y.>.)....."....%....P*........IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-noxup.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 148 x 50
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1686
                                                                                                                                                                                                                                      Entropy (8bit):7.777921392960299
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:I/sUg09pp/qKHlZpbkXt8K7n5bTh5lTdAiwy9QntZ9C:onJpp/qKXpbU2g5DlT+i9QnY
                                                                                                                                                                                                                                      MD5:DFD80EC6F7EE421AEAF3F785922438EF
                                                                                                                                                                                                                                      SHA1:DD3FCFB2BF921A6C67933093B1AE64CA23E1AF26
                                                                                                                                                                                                                                      SHA-256:FF31AC8E9802988BE162D31CD350711F460E8AB292CC45950C202ECD1A8FEEAF
                                                                                                                                                                                                                                      SHA-512:8391CD280487F73F7FDF5529BB6677696BC815DC99ADD5AA229EBE1B569B94C1D8C5370A86C0665F5F20CF918325B23338EAAE347FE441550C0758A687297C06
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a..2......'.....-..&..,.."..,..(.....-..!..&..+..(..5..)..(..2..$.....!..2..&..*..+..1..&..... ..%..0..6..*..&..+..0..-..:..5..+..0..2..-..5..5..;..@..6..7..=..?.#<..>..E. C. >.#@..<.'H.$E./K..N.*S.,J.6I.,O.1K.+@.+N.1N.)W.4W.>J.9R.;P.6W.=Q.:V.DW.A[.GW.>].HS.E^.J].Bc.EX.Mh.Nc.J[.Re.Pg.Mg.If.Pb.[h.Ls.Mm.^o.^u.]p.gt.dt.jy.g}.qz.u|.{{..~.x..{........{.............................................................................................................................................................................................................................................................................................................................................................................................................!.......,......2........H. 7Z[<DX......#J.H....3j...a...B..)O.?~.....J..........8s.....@..MP...HM..._.. 4x....X.j.:..Q."..S........a.*.p..I.(.....O^...6..Pu...}............A...3kF.x.g.'..........`.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 27 x 50
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):369
                                                                                                                                                                                                                                      Entropy (8bit):7.019028949718389
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:aPd7Wm9a7S6xP+rDzujMhsACN1brSF+dmz0fmBDbf92buPamIPW19mW:aPd7Wm9a7zGDu91Ppdmzka/f8bQasX
                                                                                                                                                                                                                                      MD5:3D32D5CBF24BDCC2C74E876AAD4C19A0
                                                                                                                                                                                                                                      SHA1:E4F405F07DC0D870A2CF4E5EEF48C91393676290
                                                                                                                                                                                                                                      SHA-256:7456A5B53B0E7BAD980926BA86EF437ABB19F5C2D397031C83B27198DEA3C5D0
                                                                                                                                                                                                                                      SHA-512:DB97E6E8E062B75FE46D49558BDA19674AA574476F85458A22A536FD07384618524007342098E5FA095532A2D8CFC2612CAD0AD77AC406E5C12029E48F112830
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a..2....................................................................................................!.......,......2.....".di.Y..l.bp,.tm.x..W...`.B,...r.l:...tJ.Z.X,e..z..xL....tZ.n..pxdN.....^.........................................'..#..................................................................................................&.....#J.H....C..;

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-warningbackground.gif

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 2 x 70
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):361
                                                                                                                                                                                                                                      Entropy (8bit):6.510176350874939
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:DvjkRhk/NruDE9Q0QVlMjlFGCyzVwFECgVp/R5i9pNoj3f31XoB/fNfkc/:zjkRiFrFQ0QELV8VwFELjZ5ii3f3No1z
                                                                                                                                                                                                                                      MD5:2D1CCF8BB4F2013151F9BEC12542D9A5
                                                                                                                                                                                                                                      SHA1:9AFEE504C285A2FD7B09BA3AA745B3CD4AEA3ECE
                                                                                                                                                                                                                                      SHA-256:8CE5E1DE817FCEF6618DC2279753936423A975ECBA3C28732FE0CF0DAA52E1D3
                                                                                                                                                                                                                                      SHA-512:C640B6921D144E76417CCB433CD7B0359FCB8298E546454AA31067FF70D4356DB86A223C83E70F2C43F46420CC4D6554834D3998150DD2D6257F65F8F7708942
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:GIF89a..F..2...$..$..$..$..%..%..%..%..&..&..&..&..&..&..'..'..'..'..'. (. (.!(.!(.&&."(."(."(.#).#).''.$).%).%).%*.%*.&*.'*.)).'*.'*.(+.(+.)+.**.)+.*+.*,.++.+,.+,..........................................!..Created with GIMP.!.....?.,......F...q...).V..+...0....XX.j.J.P...d2.H..H$..@...C.p8..F..`.........................................................A.;

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1059
                                                                                                                                                                                                                                      Entropy (8bit):5.24710843903647
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZR3xQiD3RJMZcUhiLKyFc43bZd6zO:xmp5UoZJxBTM3Q3SsKO
                                                                                                                                                                                                                                      MD5:4EBFA698055250AD70A0D01B6567BD9A
                                                                                                                                                                                                                                      SHA1:582AE5C5DC0BA9FE23A0FB07590FA59444DA95D7
                                                                                                                                                                                                                                      SHA-256:AB574A980B59756A01718E36CD9E059F1F8B585EEA0D9EB84AE011060986784A
                                                                                                                                                                                                                                      SHA-512:CDE9E10889EFE7DBF2DFD7D88455E339A662CED82C976E818F43E245E2DBDC9DA4C24A2A7303C3838A49E0CB1DEFFF334241C06B95B7109C58A8A556E1B1F818
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}.....balloon-chevron {.. height: 20px;.. width: 20px;.. border-top: 2px solid #E6E9F0;.. border-left: 2px solid #E6E9F0;.. position: relative;.. top: 10px;.. transform: rotate(45deg);.. background-color: white;.. z-index: -100;..}.....chevron--centered {.. margin: 0 auto;..}.....chevron--right {.. left: 337px;..}.......balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//F8203F1B480FD23E30F9EF9C8143E0441CDFE8A7C67E342386A05F6AAC515E97242CF2B

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1687
                                                                                                                                                                                                                                      Entropy (8bit):5.267092910222507
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:LswDjYlGNVMr7xnVMr7EVMr7VMr/VMrlpVMrkANVMCrNM/QogXORMoBK0w7jP:oOjmxuneCKIJCEQxyG0GT
                                                                                                                                                                                                                                      MD5:1DD634B3D908E091797E11EA7757598E
                                                                                                                                                                                                                                      SHA1:D639148A0069ACA3DCF6E63023796DF530BE876C
                                                                                                                                                                                                                                      SHA-256:974ECB6A7AF171CC03DF8B183114AAD0E40930BE37915FFD2E391B99068C6B3D
                                                                                                                                                                                                                                      SHA-512:8516E056CF395382057FF4817A5F6D0B84137B971C1A6430B5A046EF31A5DA0707C5CB7749CA44B5E624E759F0B5591D979BA2A8D15635AC235E594C5A9EAD4E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\new-tab-overlay.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\new-tab-overlay.js"></script>.. <script type="text/javascript" src="wacore:tel

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-overlay.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4438
                                                                                                                                                                                                                                      Entropy (8bit):5.059293842931067
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:T0AmdonK4uoNDsVgV1PixEeB0NufP9SdaQbXkhrZq:AATK4bNDAg/jeCQS9bX4rZq
                                                                                                                                                                                                                                      MD5:9DDB8BF9200F2F164DE64736E4937518
                                                                                                                                                                                                                                      SHA1:2EE1D0C1FDB084DB19EF31299D102CD2C74FE08D
                                                                                                                                                                                                                                      SHA-256:D56F84BCBF12115359961C54E174AC8B66132DD7063CF036C01E13E837C63DAD
                                                                                                                                                                                                                                      SHA-512:8AA502A5A6F8D6022F58E698613B5788A0D91D586D5D75CD2AAF90057744B21A2E9581AC1CC5137A0A14B6CF67AC2FFFD0908C804343FD40057D9EC1DD1432C4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {}),.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $(".balloon-chevron"),.. },.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.. var overlayType = Number(settings["overlay_type"]);.. var extensionType = Number(settings["extension_type"]);.. .. // Polyfill of isNaN for IE version < 12;.. Number.isNaN = Number.isNaN || function isNaN(input) {.. return typeof input === "number" && input !== input;.. };.... // Validate toastCount is valid;.. if (Number.isNaN(overlayType) || Number.isNaN(extensionType)) {.. _window.clo

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1660
                                                                                                                                                                                                                                      Entropy (8bit):5.240808975100474
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZR3xQpx4yViOolwM4ZRVcWlX2KPuxvX/bIbZjwvpslYrctLCiIw0d35bFO:xmp5UoZJxwqqZlmlXMwWlYAlCiIp4
                                                                                                                                                                                                                                      MD5:D2401F66D63DED61A50664CB438089C2
                                                                                                                                                                                                                                      SHA1:D1C6971AFEE75BE6AABD65AC701A15D9260B5E2E
                                                                                                                                                                                                                                      SHA-256:8A3A1738A85D5946180104AC006D285F1F5354B955D7769FDA0322ECC944AE3F
                                                                                                                                                                                                                                      SHA-512:CB17B5D1A96C549997C249FEEE3B68856ABAC4AD63D262053BD4F28D0ABB128E6D795933358E180E877766F47404FE8AF661C3398BCE5BE1B61A6179608791D1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;.. height: 255px;.. width: 505px;.. border: 2px solid #E6E9F0;.. border-radius: 24px;..}.....balloon__card {.. background-color: #FFF;.. height: 100%;..}.....card__content {.. height: 100%;.. padding: 24px 20px 24px 24px;;.. ..}.....content__images #wa-logo {.. height: 17px;.. position: relative;.. margin-bottom: 10px;..}.....content__text {.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. padding-left: 24px;..}.....content__text > h1 {.. font-weight: bold;..font-size: 24px;..line-height: 32px;..margin-bottom: 16px;..}.......card__image {.. float: left;.. height: 100%;.. margin-right: 24px;..}.....ca

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2132
                                                                                                                                                                                                                                      Entropy (8bit):5.1833388289802675
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:oOjIxneC4WCInHCFy26qAqIMImqIu1ZO+z2L:XmE6JJmz2Z+
                                                                                                                                                                                                                                      MD5:DC04991A8EC7B94577449A18E6BFDA03
                                                                                                                                                                                                                                      SHA1:C62D40B0CA534C53F2435DEDA9BB5F650B7D6491
                                                                                                                                                                                                                                      SHA-256:275E7B777958EB91B331989E0D657D92B095DDBFCBCF4C14D421B97CF11117E2
                                                                                                                                                                                                                                      SHA-512:E66F6672759EA6BDF8C21E5A31A77EAEE31B98EA5E8449FF68F6493D18BAC7850CF97403CC619DC5E616A87C6F71ED5EEA28D54A477126574F75182956B3369A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\new-tab-toasts.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\new-tab-res-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\new-tab-toasts.js"></script>.. <script type="text/javascript" src="wacore:te

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new-tab-toasts.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4066
                                                                                                                                                                                                                                      Entropy (8bit):5.129675491970433
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:n3AXKffHguIKz1hauWSu0RVflDh84bXkYRN:3AogosHiVfVh84bXR
                                                                                                                                                                                                                                      MD5:70946D65EF40959C8CCE060EB65C9FB0
                                                                                                                                                                                                                                      SHA1:EB7C9CD3B302A363A8205D3EEF514F84E9AAAE46
                                                                                                                                                                                                                                      SHA-256:D5A9C65624D31C152741D61701D2509024CC870193BBF9EAD8251F0220E60BAC
                                                                                                                                                                                                                                      SHA-512:E58EBD2EBCD2200062A2CF35CE8F4726AF1C458307EF064D1F92ECAE9B34136EF085A2EC90A9AD06A3589C725555DDD43FB95EE6ED03BA662133C5523E0827C5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. };.... show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("overlay_data"));.. init(payload);.... _window.show();.. });.. },.... init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.NEW_TAB_TOAST).get;.. var toastCount = Number(payload["toast_count"]);.... // Polyfill of isNaN for

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\new_tab_main_logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 155 x 252, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9836
                                                                                                                                                                                                                                      Entropy (8bit):7.914414293589123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4SzlM0MAc3Z+8WM/h/Cl3oKSo5i1TL999zhgwfnt1ztUOTGgz7dEM:/zYcc/Cl3nSoIxL9XuwVhtUOTGy7dN
                                                                                                                                                                                                                                      MD5:89FC18BBBA9A69CFEEBFB5ACC4E9089C
                                                                                                                                                                                                                                      SHA1:1FC704BA2ED65674BC9DD7B7D882D8F588C1F898
                                                                                                                                                                                                                                      SHA-256:DDC5EB8EEBD2874C5774A4266EBF0A064FCFBF94A34686839B3FDF7E73235F62
                                                                                                                                                                                                                                      SHA-512:12099A1DA49A4AEA5A5BEA2E41C94E8151743191B48AD6B0F099B43A3532FA57ED7D335C9A2748BAC7F43C11212C04CA63D42E38B0D278C20A3A0D2DBB49A632
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............`..n....pHYs.................sRGB.........gAMA......a...&.IDATx..Y...y..........")..J",J.ER..(mh......a....~X.F...v..z..#|...."%..D..i.4...%..@..qc....g.3.*.2....{.s03.lTu.=S...jr..9..b.. .!Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1Pl.1R.....Jp...{.S....c0.~.V.(.ef..4<.....k'l...y.v....jDG..=G.Y...~.7.........|........m..+4.........`..b[&..#4.7..YX.........Z....m.8v.| ......J..f...'.."..J.lX.0....?z....n'..}...dPl]...S.....`%.n..p+.).........../o.l*d.;...>4...._.".tPl]D....3{...<.....eVA...f......{.C..Z.nO?.*.tPl]......F.....IB\^|.......n%Pl].$4n.U.lb...,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\overlay_ui_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8640
                                                                                                                                                                                                                                      Entropy (8bit):5.66679634912789
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:S99vW2voaBQcfxGtMOA+kyahqBvJariCSuQzf25c3cOtxo:WvWQrflBIYiTuwo
                                                                                                                                                                                                                                      MD5:FB5DB39050C93843DFAF2013605E5A25
                                                                                                                                                                                                                                      SHA1:97B437714FC5C8F0A3BC1123060A4EE18A68EFE7
                                                                                                                                                                                                                                      SHA-256:954A7F581C3E6149EEFB20C2DA14F2C735331D9FD3EC84C1FA2B3D1C9FAF756A
                                                                                                                                                                                                                                      SHA-512:FE004A26F0BDAC99F2B8746F15867FFA3A80C910CAEFC68980A209BD71D3DE679225928169DDC23EAD8A9D4E73403825338D56B16E86434E81FEF6959E1F90D4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........+...6.......T...4...7.......7...%.......$...>...)...)...F...4...7...7.......7...............$.......>...).......F......GetOption.SettingsDB.utils3overlay_ui_handler: Not a valid browser type: .err.log.core........64...7...7...7...7.......T...4...7.......7...%...>...)...H...4.......7...>.......7...>.......T...4...7.......7...%...>...)...H...4...7...7.......7...)...%...'...>.......T...4...7.......7...%...>...)...H...).......F...Doverlay_ui_handler: edge onboarding from process start disabled.edge_onboarding_option.GetOption.SettingsDB,overlay_ui_handler: Locale is not en_us.en_us.lower.GetLocale.utility,overlay_ui_handler: Browser is not edge.info.log.edge.BrowserType.BrowserUtils.utils.core.t.......4...7.......7...%...>.../...G.....Apackages.builtin.on_search_ext_warning_coachmark_exit called.info.log.core...... .v7.......T...7.......T...4...7.......7...%...4...7...>...%...4...7...>...$...>...)...H...+.......T...4...7.......7...%...>...)...H...4...7...7...7...>.......T...4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\securesearchhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6119
                                                                                                                                                                                                                                      Entropy (8bit):5.813476328214718
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:NfZOYoxSEF5scqC3scUO9YdEVe1iT/zAbWmxqWFc3ilg9gN0dKrUfIvhKxfaYanS:NfXmSEjPN1zXmxqWFo9gN0dK4fIvhKxF
                                                                                                                                                                                                                                      MD5:3B4D5B6CBC468442247B75F171C930C7
                                                                                                                                                                                                                                      SHA1:A8A29C015BA6D9EEFF733C662380D56152407A2A
                                                                                                                                                                                                                                      SHA-256:BDDA44DAE7D108E04F494BD8F85012653515FBA0D5D002B030A796426E8B7376
                                                                                                                                                                                                                                      SHA-512:F166AAB2D9DE362AE7AEE93E62CCC3B3883D605C330153F9E61E029CD3470CED64491E34B89FFB25DE7358FDD396FCF474F16518B273CBB1356A4742B554BEF2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........!4...7.......7...%...4.......>...$...>...4...+...>...D.......T...+...)...9...4...7.......7...%...4.......>...%...$...>...B...N...G...... removed=packages.builtin.updateSSToastStatus: toast for browser .pairs.tostring6packages.builtin.updateSSToastStatus called with .info.log.core-.......3...6...H......._ie._ff._ch._msb._edge.........3...6...H......2Global\{8DB68CEC-1C6B-46B8-8808-90838C14CA3F}2Global\{F84F0E05-209D-427A-A977-A5AEAA90EEBA}2Global\{64C7DD73-FBD5-4B1B-8A82-B49950F36A97}.........3...:...4...7.......7.......>...4.......7...%.......>.......T...4...7.......7...%...4.......>...$...>...G....tostring:Failed to trigger LogicMsg browser start on browser: .err.log.OnBrowserStart.TriggerLogicEvent.utility.encode.json.core.Browser...........H+.......>.......T...4...7.......7...%...>...G...%.......$...4...7...7.......7...).......'...>.......4...7...7.......7...)...........>...%.......$.......T...4...7...7.......7...).......'...>...T...4...7...7.......7...).......'...>....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):379
                                                                                                                                                                                                                                      Entropy (8bit):7.24199845007647
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPW/E8kQoywGZy2QuloYCnWnXmYFOwrMFOfzs9fOPrmi/MsTjWnDU4p:6v/7uMpQoji+YCnWn2lwAAfz/jmiU8SP
                                                                                                                                                                                                                                      MD5:0D006D29C298D5D75780C5514DFD7E02
                                                                                                                                                                                                                                      SHA1:47231ADF89D53E452EEBA1A7A4F6F51697B93C4D
                                                                                                                                                                                                                                      SHA-256:CC72D82ECF19CB08D92F5EA6A612A12FD54B86D8E6AD1019D3516CAC0E90353A
                                                                                                                                                                                                                                      SHA-512:B35A08D6FB781DFEEAE99CA78F70C85517DCEC702E59A920967AD146C38B06442C95FDE021EEBB47901CA9D8B4B3DE3E2192DCA910C68497D5D4F5E721B5F35A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............V.W....gAMA......a....2IDAT8....N.A..GLL.....U.....Di.....k.m.S.<..`.&.....M.u.c.......~.........N....\.x....|.....z.X.......)(..?vDzF...q.h.B..r..S.....j.=.`@8.A....F...g...._ .E..*!.Z...aV.IL...z...?. r...q..j-..0{r3Y..M...m.)....Z..^....$|..... n&.....RB.1...v..~.#..t....4..k...E.........~M...S..>.S..&6t..oB.Y......C.Q....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon-selected.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):366
                                                                                                                                                                                                                                      Entropy (8bit):7.181473502943194
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPUyCfW1DINGm00Q6GhmVMWW5tDGMYmw3H0zPsXFdCkhY1+8EtWmTp:6v/7yfW1i700sMVI5tDGMX0VdCWY9EZ9
                                                                                                                                                                                                                                      MD5:808F5E9FF7B694D5926CE6CFFA336085
                                                                                                                                                                                                                                      SHA1:58C5D8F14FEA91E715F8B3CB9B84421FBE99317A
                                                                                                                                                                                                                                      SHA-256:5331E5CCC4E6F8082F7AAC9492FC3DF5CB810087E6F0CB71D99B1582E233A61D
                                                                                                                                                                                                                                      SHA-512:E2DC4A40D8BD68D7DD31A002F480F3D0C5ED7433D0CB6F966EA11D437FD38A2B12C3F9CFC057DA9118E05BA5E81C1BC0896C5844D78F256084AC81554FC89A82
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................gAMA......a....%IDAT8...AN.0.E..`i....+.-.....(..E9GO.[..._e....P!.....x<v.4...m.<v,c._...?.....*.p..p.7...d..-T.....B..p.G...m=a..Y3.qm.B..m.WWq.p.Q.C..^.w......&bd....^G..W...TMM.....R...~])...]$.#.jA.Qq..<o.....*..-.M.-.j.k.8..>..b.....w.-.Q..|(.&~..M..Y.>..=.:..Y..n.....S.&....)s.c.T...v0.%..!.Y...J%....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\settings-icon.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):617
                                                                                                                                                                                                                                      Entropy (8bit):7.536368903712138
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7y8A6KCbdR+rqKuKRLIRBG9EtiJjt+KxqMK:R6JrXe+BGkiJ4z
                                                                                                                                                                                                                                      MD5:112768C9A06EA1AC8783E7EB786450C3
                                                                                                                                                                                                                                      SHA1:15312DD4FD8F87FD23725531726261CFD73888C9
                                                                                                                                                                                                                                      SHA-256:3AA7CF0C447D88B8CE2C2FC0B50E80E49851217D0CB3BB7D4E38FC22209DEE03
                                                                                                                                                                                                                                      SHA-512:87E13AA38498C7E76EA9B017A893CCEF4819FBC13EB387C8A4946C721EAB176A44A5F3B181FD23AC2D16943D12B452EB8462FE7A57F6572EB047F3876BD2CFEE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.....................gAMA......a.... IDAT8..S1k.Q...K.H...p...TV...../'v...6V.U..PP.;q...H%.&V6...!.i...;~.[&..q.,taw.....f.........z.G....j.Z..Gg.dg..F.l.I.oX..H2.t.\T+...A+....vD.\...6X.....\.R.-.v.{..>....|jb....@7C..Q l.]....A.47.....O.X........$C......p.*_.d&.......M..?m.!.,.C.a......../.8...@n8gw.....@7..1.X.p=......._67.V...a.)...V&....a..R^.b..eN.Q.>?.j#4..A......_C+...A..H?....,o:.>........g...[._...d=\..^:.~.?......A?.cN.,...B.q..M..h.7.I.pT.T.4[.o.o..*.\..m".. ....6.0jk1..../..o....J>..6...C.6l.q.)1..N...s.....^..Y6.p..7......,.....:...C..y....IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_off.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 48 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1523
                                                                                                                                                                                                                                      Entropy (8bit):7.849513030462221
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:4V7JCN3mFRJOJsHKyzBNqS+s6snN326HGGeV6CouULfX7GBo6Bqy4XoRE8ndBAQe:507Zzas6s9lH06EUSBnBqy3dBAPl3
                                                                                                                                                                                                                                      MD5:0A57D1C2AF64AE52DF0CC5AE10897E72
                                                                                                                                                                                                                                      SHA1:923C6AEEA726F5BDAE43F4837C7FFFFE34E90B90
                                                                                                                                                                                                                                      SHA-256:541865D3715C481C1C111ADF0729928E0F6DE4A6B8E1687BB2DA2D26166E8C57
                                                                                                                                                                                                                                      SHA-512:2466E5EC410C6A9484A792B5F431FE3A527A04C01127CF11DFA6AB2ED49860FA052DC84C8AB61441359E03E2DF62341CD7E05F3CD94612AABE1E37564521CD38
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...0.........j.......gAMA......a.....IDATX..X[lTU....;.N...R(}D.-..CA.1.T[.`L4..5~k...*.|..~.eI0..DA..H../..6..VZ.J....:}..{.......bO.....Z..}.>C.P....F@..Zi:z.X..v.!.-.*'.*d..=.%i...m.d.}.d_].E'..}.J..t....c.......7M.T-.$vF.. ....U.....M..2..}..$.P}.....:....[9|..KBx>7.=l2..<ZS.O..fQ0.M'..iht..........".zV...xB....-.8..P&.....s.B.8..+..ris.......s~.M.......{.<^.M....a%a.<...5.}*......y.|.g.OW.QmU..qu...E....$T....."...e9. >j:.*';.=...7>YJ..+\.NU..z....x...k.dB...!'.]....P.......$.....A.[...i...[....M.|#......K~.|...H.;.@ei!m.. .gd......QLz..S.../..'....^mr.......(..|.`.sf!7...E...M....x<C.t2..:e.n^.D...SiqA&.......a...?.i.....D....}.q#....p...I...nl\...|j..s.s.w").a..Wm...$x.A......8.)......_.i..a...q..$!gb...U$.%...o..X.O....D./.....4.[X..yG]../..:..d.%....................-.g>_....h.$.%b...l.....|7\..>.j....[_6'aSs.:n.'...l.|.z.k..h....yu...TU.r;Yv;.F.b.38b..s..$...L.5.....r.9....)+.C....K......'g(.....P....,#..C..F..!

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\switch_on.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 48 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1568
                                                                                                                                                                                                                                      Entropy (8bit):7.855339992904692
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:URY+DGIp5LXcjQxWPQjWqIiU27j2NbCYv0WGYKmUjDeQuksU:Z+DfdXqQihAv/WGYBFQuksU
                                                                                                                                                                                                                                      MD5:1CCDA19F6B165F0487EBB6C65E870492
                                                                                                                                                                                                                                      SHA1:3CB6473AE58648F9E6365DDD44EB6A24529DD55B
                                                                                                                                                                                                                                      SHA-256:8A3C7A2285AF72210C4CEDEB87701596B05C96A435E200A1BC3F0FE1947DB566
                                                                                                                                                                                                                                      SHA-512:D681758B205597B043FFF6F8BE779B5D05E37708FBCC9C08C88DA963B2B4681C33BB3E3B5912E8DF0CAB819A89D520BF1D21DE1C7B7499B5738AB0D557329C57
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...0.........j.......gAMA......a.....IDATX..X]l.U.~.um.....l..!.i"..8...J.@....+.....41A\.K.B....;.:T.1(.B......(l.u.l.m]...k}.....n.vr.....<.{.s.{..[.(..........w#.z.....F..)8...T.pL"V.e....g]...C<.....K..eq...0.o..S.g..T.E\.I.3%.....Mh1i.3...O......fG..Ez.J.....g.t.6...O.H..J.W...;..P........?...,.......H.......$..V$W....B7Sn}..e-.'i..=.....k....3::.....8.p%...6.g)1OT,.L..W.84.....u...7v....!$E.-....j%L....C.T.....&.-~N.b.wZk.y.......:3.W....s...w...1....a."..Z...n..1!........J&/x...b@.=..}.U..rTF.a.....N...A761?q=..~ZID./..Q8.s8....U.m%......3.x....D....2.7V..C.....}..Mj..y....\e..`1.`...Y..i.*I6....o....5..?.kzz.dN.*.......9.........8,o.%...5T..o..cH...j,o...5.Bz.;......<....x.x.._nq...<.{V..o!..!.....S....tx.\.U............u$j.>.....4.....H....F.,..b.Z...R]2}WP.,1L...m.........W.....R)..a..Nl%..s&....9S....F..:q.`..1....b......j%..S..<v\J..]..5z>?=65.Qf)....hd..rx..QtS...pR....r>..G.J.Qj..]Yn........L......L<*..T..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\toast_impact_close.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):245
                                                                                                                                                                                                                                      Entropy (8bit):6.356933018581735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPe/6TsR/h2Ogt2PfVuymklNXULhg+/qp:6v/7m/6Ts/NutyJlNn
                                                                                                                                                                                                                                      MD5:BE47EB430418C03DF89E2CA140BC1325
                                                                                                                                                                                                                                      SHA1:A099F0ED4114F8476D6558BAA30E3DDFDF0512C7
                                                                                                                                                                                                                                      SHA-256:F651001BDF0AD41D9BFB7D5942F136CE75ECCEF744752EE72934980B8ECFFA4F
                                                                                                                                                                                                                                      SHA-512:AD150D115D35F1F796BB0E24C61FFAF72401FE2857A0A4475A2CB7E36325A5130CAAC1F167628E26C7AB6D053B7A3757D57EA3A07C71FC14FC848CFD2771232E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx..S...0...$..F....J&.i..X.b...w.|.pXJi*.N.|..-.."s.Y.`...MX...._.6.mU..aD.0FY*.T.O.....@C.o....&A...Y..C.Z..G...D..5:....9...s..............IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\twitter.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):473
                                                                                                                                                                                                                                      Entropy (8bit):7.236375221337779
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/74/6Ts/fWEpw+mmdlVkAV7AnpSvLkXfwtelX8EFQgdPjSTFN:x/6MWNmXVfV7opSYp8eZPev
                                                                                                                                                                                                                                      MD5:640A9A68216D3ACE0A04C70F745760F9
                                                                                                                                                                                                                                      SHA1:DEF457CF4CC59B638CB4C988652925CBBD7A972D
                                                                                                                                                                                                                                      SHA-256:40171CFFE5FB5BBFDA44569BBF7BBCB3848ECEF6A975CCC237F475B3141CCF4D
                                                                                                                                                                                                                                      SHA-512:A1CFC930207C1F468D423F072CB80CE6D6BC2FE6E8ED54A8A21386445882E9A922BE55AE627330E7810EA3BEF6108F06B4A2E0A3E62EDC659E1992046FD9D8C8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............w=.....pHYs.................sRGB.........gAMA......a....nIDATx..J.P....&........8...... .=|.}...y.....A.X.5.N.P.&1.{.X...B&...$7....O.c.,x..D1x.@q..P0..a...:.Zb..%.........%y..Gp.X.9...ze.$p.UQ]..~u*Nt6,....3YX..F...2.....O6..]...]+#r...`[TzyP......c......Py.... ..j).......5uD.c*......?..1.;..3.x..P.gA..3..=.M...ns3...C.U.L....VO(.............tq....WJh-.o....0..y..0..-u%.+.g......Z@..V...-...P..{....I........IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\upsell_toast_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3796
                                                                                                                                                                                                                                      Entropy (8bit):5.626027437423178
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:vc/g/EYuAiL44bppDPG621D92KCM+ew/4txA:yi7uAiL44MD92K/S/4txA
                                                                                                                                                                                                                                      MD5:0DEDEFBC128A295EC7DBB31400BE5493
                                                                                                                                                                                                                                      SHA1:06732E7C01DAD49616E8F8D0FB5F7D2D55DB3DAA
                                                                                                                                                                                                                                      SHA-256:FCDE33DEF156783CDC5359EEF3C5B8BA0A5F1FB897E253D024F1C68773AB1C9D
                                                                                                                                                                                                                                      SHA-512:BB67D30847FA644D218C1141B1D5D512585F09BA97A68C87E15481CA4CFFE4C8B609A0CD87255687C7D5D80C7932550BFDBD413D6ED7566F0CA0D02E87853C9C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..X...........T.......T.......T.......T...)...T...)...H...)...H....new_tab.browser_launch..........D4.......7...>.......T...4...7.......7...%...>...)...H.......T.......T...4...7.......7...%...>...)...H...4...7...7.......7...)...%...'...>...4...7...7.......7...)...%...'...>.......T...4...7.......7...%.......%.......%...$...>...)...H...4...7.......7...%...>...).......F...Hupsell_toast_handler campaign one: show campaign one - take_a_stand., do not show campaign* equal or greater than xml threshold 9upsell_toast_handler campaign one: client threshold .threshold_take_a_stand.tracker_take_a_stand.GetOption.SettingsDB.utilsdupsell_toast_handler campaign one: Only browser launch and new tab are allowed for campaign one.new_tab.browser_launch>upsell_toast_handler campaign one: User has WSS installed.info.log.core.is_suite_installed.utility......&...7.......T...4...7.......7...%...7...$...>...)...H...4...7...7.......7...)...%...'...>.......T.......T...4...7.......7...%...>...)...2...F...+...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell-logo.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 150 x 314, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42124
                                                                                                                                                                                                                                      Entropy (8bit):7.989049214597359
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:LJZubuFGvQ0hVNPAb14MPMrY0iJyMXbAjw15AIJgW/8QjzastNBmwQ:LJsbu0vQ0hje14M6iJy+sE15AegW/8c+
                                                                                                                                                                                                                                      MD5:6F1B48189D2C835EC68CC9C30BA53360
                                                                                                                                                                                                                                      SHA1:93D78939DA261C4D7CC06E8B8341D9B3D93CEEB3
                                                                                                                                                                                                                                      SHA-256:29ACC284AD48147B1B5FC3F6F8E79F8D7481002E12B7D0B631DF91D9D22E5749
                                                                                                                                                                                                                                      SHA-512:D47ADF288217FFC8AE2F6D9DE1A2FF5E240355EEF3E31F3B204C16A226ED7470D60021E23F155883A9F77275FD1712994565B58392694CEBDC4E28BE7F3AD1E3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......:.............pHYs.................sRGB.........gAMA......a....!IDATx....e.U...}.My.%.F..b.fK.%..........H..@../$|.../...~.. 6.d06`.{U..{.......Y..g.....7..aKo....*......7?@.B)....|...w......}..X..Q......Ju{.k#x......sm...G.@...R...)./m().Q..mwM..'............w....z}.;Sk[Oj\;G........A+....X....g.U..}g%.?..z..U"..A....t.....F....i.4e..X...4..L..LZ.b.. _/J."..6.~.QJ.8EuB.."A~.....j......%VU.sF.i..;....m....|@3.vJT.6...R.S.[.I.m.....=..D.6?...h...]...^^.........X..[.Z.0..BT!<a....TQ.xr...2K.......D. ...m...).xf..<.D.#.J.K......qY.;f.h.U..yfZZ..J.p=...R@3.E/..8..U.:t..W}.4.g=-....4.G7'g.:.\....5J&\4..Ip.....Pk7.........l..f).*.G..yh.D...?~p.0..k5_0.UT..E.L\T.8q..\.>..Y.r...o.B..k.n...jV{....!...YH{U..Y't...b5.A...5..........9zZD$T../.F..Kue.....z......un.h..G..J.!$ru..2......0..n=........U.0.....Qu_.....M..7.@.4.v..3bQ..Q5..zB.}..0....^.L...V.!,.*...D.^.3..._j.....t.(PC6.... ..c.......M.P....H..A.x...........J.#

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1957
                                                                                                                                                                                                                                      Entropy (8bit):5.212141203881511
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UoZHx4Yli5FZSFIuMDWlYOlZiIpd3bF:xANxhi5FUAWlYOl5TrF
                                                                                                                                                                                                                                      MD5:DD692612791E9902321E69520CA83411
                                                                                                                                                                                                                                      SHA1:C8E39D38860B2C338E07E0F5E3042C1890906B1A
                                                                                                                                                                                                                                      SHA-256:23E24EEB8A43278E474647D8E4770A5465F54496FDC5352416B4A26CC22ED294
                                                                                                                                                                                                                                      SHA-512:92A2AD440D40B9047556BBA067CB64DC9DA9D9BD23C4439DE3206246A738CB563548B9324C0E671611D4E970AE37AF2B63EEBAA73EA4B0B1EDE97953B23746CA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 16px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;.. .. width: 510px;.. border: 1px solid #ABB2C3;.. border-radius: 24px;..}.....balloon-I {.. height: 314px;..}.....balloon-II {.. height: 370px;..}.....balloon__card {.. background-color: #FFF;.. /* height: 314px; */..}.....balloon__card-I {.. height: 314px;..}.....balloon__card-II {.. height: 370px;..}.....card__content {.. height: 100%;.. padding: 16px 20px 24px 24px;..}.....content__text {.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 16px;.. line-height: 24px;.. padding-left: 24px;..}.....content__text > p:last-of-type {.. padding-top: 18px;..}.....content__text > h1 {.. font-weight: bold;.. font-size: 24px;.. line-height:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2077
                                                                                                                                                                                                                                      Entropy (8bit):5.280508932997895
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:oOjEJneCWIuCFf7P7d7DtIrINqIdmB9mbk:oAcNz+V
                                                                                                                                                                                                                                      MD5:F36002858C28DDBF02C7EFB286972047
                                                                                                                                                                                                                                      SHA1:B0647C8CE8DA0683B46EF517C2C3A87140058B02
                                                                                                                                                                                                                                      SHA-256:6719C3CD7C9DB80B42B7D270EDEE309AC2884D1DAB4051A5933A9DEE376D4081
                                                                                                                                                                                                                                      SHA-512:11DBA261422A07C24D038F6571ED63DC74E8B67CDBBF631857F83793D69188E5C44249AC120424C2C34444EE027C3318E14C1B61CA79088E4699D3DCFEF5658E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-amazon-upsell.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-upsell-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-amazon-upsell.js"></script>.. <script type="text/javascript" src="wac

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-amazon-upsell.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6225
                                                                                                                                                                                                                                      Entropy (8bit):4.847675462142375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:4G3AXPfTEzni3R4uISETACySbd0SE13z8acglmVnIJ+BH/jyjsHbXkbXy:4oAmMR4FfCSERz8k5ymIHbXn
                                                                                                                                                                                                                                      MD5:C012CC180C8F5B3A7927D3A8481593EB
                                                                                                                                                                                                                                      SHA1:75A379A2F522B800826DB997AF5C150840F88AB7
                                                                                                                                                                                                                                      SHA-256:4424BED81BE3722C57FD6C1A2054F8020145BF2D7D9BF5EC66AC001259DDAB60
                                                                                                                                                                                                                                      SHA-512:0A1CA75E27127F1DA0EF0CD3A36F91C228F8A0A0181D7C083681AEE7C6A00F33D41E4D8176956751C2A9A2DB12A82AE3C81177795430097C57F5988929B2758A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Amazon Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. contentText2: $("#content__text-description_2"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. footerLegal: $("#footer__legal"),.. };.... (show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("toast_data"));.. init(payload);.... _window.show();.. });.. }),.. (init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.UT

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1484
                                                                                                                                                                                                                                      Entropy (8bit):5.242517342858763
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZR3xQpxVYHhLcY39U0M+mtFl2zZRVchpKIjvVCfnvv/UQsUMyoSh:xmp5UoZJxDHF3uBjFloZKY+YfnHcQeyL
                                                                                                                                                                                                                                      MD5:64A921E97406C4660A986850A21FB935
                                                                                                                                                                                                                                      SHA1:49F37F64873371F6C55218E57CC188AD2C1292A8
                                                                                                                                                                                                                                      SHA-256:2C2A3C2B850C9E76D5C2A8072119D95F24FF990572EB22F963CFC49B24EE7903
                                                                                                                                                                                                                                      SHA-512:E53F03E44C9F7EB6EF515AB567A13145C6308E2C643F20F8528C33F07D79B5BB5ECEE3C36FEE88F617A606AF43A6674F8DED691287580377B9422110C49DC18E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;..}.....balloon__card {.. position: absolute;.. right: 55px;.. overflow: hidden;.. box-sizing: border-box;.. background-color: #FFF;.. border: 1px solid #E6E9F0;.. border-radius: 12px;.. height: 200px;.. width: 328px;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. padding: 16px;.. height: 100%;..}.....content__header #wa-logo {.. height: 13px;.. position: relative;.. top: 2px;..}.....content__header #close-icon {.. float: right;.. cursor: pointer;..}.....content__text {.. margin-top: 12px;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. color: #5A6175;..}...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1951
                                                                                                                                                                                                                                      Entropy (8bit):5.235542540075188
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+swDjYARGNVMr7xnVMr7EVMr7VMr/VMrlmVMrkANVMCqAedml3+u4wXRMaHDdt:NOjXxuneCnIJCa63+WvHDdt
                                                                                                                                                                                                                                      MD5:B61C8F46ACA1BFC4D4E07B06FCF28784
                                                                                                                                                                                                                                      SHA1:FD6AFD39202DCCDD2FAC0FE1D7E73CDAD3C99CB1
                                                                                                                                                                                                                                      SHA-256:948931080B10C81F6F835F424828AA5F242C5B17C2DD1200164B9C199B56DE30
                                                                                                                                                                                                                                      SHA-512:98A30D148CDC380F1111683C570E35B14CA4E4E000EC700124DF8E45E03A65DF996093DD47D9961574DC8F4CE7348F6918E98F51623DFF811610EAC7C94DD8EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ch-store-overlay-ui.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ch-store-overlay-ui.js"></script>.. <script type="text/javascript

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.14848258279732
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cMAozDAQV9PqREed0kMTJo9QV9PKgMaGXc9d:vAODAQnTeurQQnzMaGX4
                                                                                                                                                                                                                                      MD5:45195EB555835F68EB10AAB176E71A4E
                                                                                                                                                                                                                                      SHA1:27F54EF5B10CE2CF3D61D9854CFA369DD01F4655
                                                                                                                                                                                                                                      SHA-256:7F1EF8B41CAD8DE79598E9F630967077DFE43D47CDA7A5369E19061D8AB128CC
                                                                                                                                                                                                                                      SHA-512:BD529FA92E219B8F36E97FD960FC2CF9F5293C5E0830B6FB2A4B3EE8F99D31D6E6C76959C472027F23DAFB98E2E9251328337591FD8D57D18B9C53ED10AF3ED1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. contentText1: $("#content__text-1"),.. contentText2: $("#content__text-2"),.. closeIcon: $("#close-icon"),.. },.... show = function () {.. init();.... _window.show();.... // Send telemetry 2.0 for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(_instrument.getBrowserTypeCode()).balloonType("WAOverlayOnboardingOpenExtensionPage").Serialize();.. _instrument.sendTelemetryEvent(telemetryEvent);.... //Send Telemetry 3.0 for dialog balloon.. var browser_code = _instrument.getBrowserTypeCode();.. var screen_flow = browser_code == 'FF' ? 'firefox' : 'introduction';.. var hit_screen_id = browser_code == 'FF' ? '300.1.2.1-w

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-risk.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 20 x 20, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):743
                                                                                                                                                                                                                                      Entropy (8bit):6.485906014360001
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6v/7MRUwaBLht3zHOuVKg7/6Tnpb+R2pi5IDyc1RX25gbhbzS5/IEMS:kwaZht3zuKKC/6jptpAIeEoglbzegEMS
                                                                                                                                                                                                                                      MD5:1ED7DBC29E984E621DB85633607A39EA
                                                                                                                                                                                                                                      SHA1:77CF88D52CB9A32A8EE377E37DC2CA70EBC79143
                                                                                                                                                                                                                                      SHA-256:C364887E094D6235A4FD5774D7CB5D9631A2983C8626998BAD8CA294BC446A19
                                                                                                                                                                                                                                      SHA-512:57CB41F770F5586041F9FCD9E934FEF894301AE8DDF8EFC498E2743FAD006D5C0D4AEF7D2A2086A9D3E60FC08B02AD2505D02E95B039786555522015EC9C41FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............W.?....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE............................................................................................................................tt....WW.ZZ....[[................................r....%tRNS....#BSR$.7}....~9.k.....l.y....z.....>....bKGD...-.....pHYs.................tIME......*..uk....IDAT..e...0.D%....;f.@ ......,`.r.]..J*.Z....jl.3..D...M..q.....(b.."I.6MD..=E...e;..{.<*..X."..$..}..r.el....-..z%..(.^#.f..H...07Up.S0u...a.8.r&#<.N......r9..H}..R4...R...]Y.).3...S.....U..TW..+.z.).3...(.....s..m.....5..3m8....&1@.....%tEXtdate:create.2022-02-18T19:30:12+00:00z.a....%tEXtdate:modify.2022-02-18T19:30:12+00:00........IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist-status.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 18 x 18, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):285
                                                                                                                                                                                                                                      Entropy (8bit):6.92410222781354
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPW/ETnWvTVFX9ls1mDf0J7KzAvC7gnh+i25wp9M+S+N0XXnTp:6v/7uMTWrVFtW1mQJe7ib2uPSjX9
                                                                                                                                                                                                                                      MD5:527825CC6A463D4D1A8E7019B4773D02
                                                                                                                                                                                                                                      SHA1:C58CE479BCED1BA8B47339D6A9867E3D75A96672
                                                                                                                                                                                                                                      SHA-256:87A2C49BEFA3F59750E91A1FCE86FB9AC9BA928A04D4ABE1A7BDFFB25883EC2C
                                                                                                                                                                                                                                      SHA-512:38DFD2D59C8D8A9195BC9D45E45A71FAAA69AB3E7C4777F3A448C31A95D44AA3E97303EF3FABAF13B3BD4F7DA1BCC6269B8A6A668EC758E28EBADCE2F949D0DB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............V.W....gAMA......a.....IDAT8.....@.E.I@....V.AK..K..[.`..zQ<X...EP..&.a3D../..cg...a...o..v.38@.s.|4.....`.;....a.G....k.m".....w........&...`.{..C.2q]jx...l<)OC%4.....'../H.+!y..S].,A..J..stM.^.M[.....2....^...T.(J..7.?.....t.QL..r.........IEND.B`.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2631
                                                                                                                                                                                                                                      Entropy (8bit):4.989770706687156
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3OTFMv26ITWBgkqlgPgOCF/ehQORDa0cYL:IKy/iQqzcYL
                                                                                                                                                                                                                                      MD5:B9246F824BD1F6FCD28F70F7B4937E9C
                                                                                                                                                                                                                                      SHA1:538CA595E196EAA7F142B470BA796984E65084FC
                                                                                                                                                                                                                                      SHA-256:72C05079CC566DAF5FD495E8F3DE971C4978A0A60E03A037045545514D58E6A7
                                                                                                                                                                                                                                      SHA-512:9ACC7D32442ECC10552F08E0C03BF954FC5602D2CB8764296626FACDD06BEAD28C4D6B5EB4C45C6CAF49D58883D46428ABCAE51D0E8A6F114C36BA8E0D49AB0A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-ui-dialog.js"></script>.. <script type="text/javascript" src="w

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-controller-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (339), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23342
                                                                                                                                                                                                                                      Entropy (8bit):4.06976604696877
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:cD3PO1JLwhGbm4Ny+e8yfCwh/ZfiuLeeYjYWUUQo6La+Z13ej+:Y3PO1JLLbm4Nylj6uiuLaM5ZRj
                                                                                                                                                                                                                                      MD5:FA182E2C6E5D81F6CA957E3E644D353D
                                                                                                                                                                                                                                      SHA1:38EFA10933A885A1ED38F2C934EE3E1EAFCE14E4
                                                                                                                                                                                                                                      SHA-256:D77ECA3908B54D794DBC0E10D5C467EF4E293348A4BA3B7E8085FCD9E32FD9EF
                                                                                                                                                                                                                                      SHA-512:7490B997007D4DEF922B1A73BE3B256249CAAB9EA1BD1570F7A6DD778785295D2F3BA7F44831493DB155EE0BA1E2DAA0BD3F1A18236DEFA66E6ADCEAD0801B85
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _l10n = wa.Utils.Lang().checkList(),.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var threatStateCss = "threat",.. infoStateCss = "info",.. greenStateCss = "green",.. waitImage = "wacore:mfw\\packages\\builtin\\white_timer.png",.. alertImage = "wacore:mfw\\packages\\webadvisor\\wa-checklist-risk.png",.. ignore = _l10n("IGNORE"),.. fixNow = _l10n("FIX_NOW"),.. defaultImageCss = "wa-state-img",.. alertImageCss = "wa-state-img-threat",.. keyMap = { "NUW": "WelcomeMessage", "UUW": "UpdateMessage", "CLW": "CryptoLearnWelcome" },

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):802
                                                                                                                                                                                                                                      Entropy (8bit):5.289665507031782
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZR3C3dDUUhiLKyFc43bZ228vatP6X:xmp5UoZJkxQ3SdrCtCX
                                                                                                                                                                                                                                      MD5:0A392CB49EDED69460760F2E14375D5D
                                                                                                                                                                                                                                      SHA1:12A5402D5EC3B9E5C0AF4D4387BC93CEDF08E303
                                                                                                                                                                                                                                      SHA-256:AF73B0DF11ABE67A86099576F2709D4D3B64D186992E2D02F0A54A4503E60C0F
                                                                                                                                                                                                                                      SHA-512:56C08E5CC4F400ACBD21E27B354E1565AAB7D1784F70D73226ADF1787E5EA943AAA1BD11DAB3A4B2DC47DDF45FAB55AE0AFDBF42064C5B9AB577957CD6EBF382
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #454545;.. line-height: 24px;..}.....balloon-arrow {.. margin-bottom: -6px;.. text-align: center;..}.....balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//29CE803FB5103E397E0003270BD0BCCB5C47673C28797B871F6050669D6D4BAB078E01AA46F80C9002568CA51EEB95B613DCF70521A61DE7A9D38D94BBA473BE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dialog-balloon.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1888
                                                                                                                                                                                                                                      Entropy (8bit):5.257526954195077
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+swDjYI2GNVMr7RHVMr7EVMr7VMr/VMrlTMNVMrkANVMCrnr8ymTQogY+ORMaWyZ:NOjPOROneCZNIJCzsTQ++yVWk/
                                                                                                                                                                                                                                      MD5:0C1F54FAE8DBCAC66A71B6343A5DCFAD
                                                                                                                                                                                                                                      SHA1:7E0C6A9130D01B159214DF09C280DF0E9785212E
                                                                                                                                                                                                                                      SHA-256:4A9130C4B7273D7FAD124751FE9AB577DAC65879763F3774DE7C8FE3226BB56E
                                                                                                                                                                                                                                      SHA-512:BB3E87DBF37BF570AE05E314679ED693AD933CF4E839E3B728FBBC5DCF6CC0121626DFD041C36F835375227381A5A2AF0FEF6A3D01B3BAE0589C003C108C7D53
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-dialog-balloon.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-dialog-balloon-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-dialog-balloon.js"></script>.. <script type="text/javascript

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1653
                                                                                                                                                                                                                                      Entropy (8bit):4.932366159294594
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:3JYmsL0yXFeRZ7kkbslksjsjjGbb+CDBXRDDNEVRK1tzZtg77OgKqDmvN3Q9of:9ByXIcrH4fGbaYTEV6tk77OgS3Q9G
                                                                                                                                                                                                                                      MD5:BEF81D30CA0EE6C4DEFCA2DE2465C32D
                                                                                                                                                                                                                                      SHA1:2A4338EC124911D4066A5F1BC1F4E16C27658D26
                                                                                                                                                                                                                                      SHA-256:7D8BB7735A2BB4D72E91C6EFC3CFFADB707B7F162C40EA48DE9971DA144BF94F
                                                                                                                                                                                                                                      SHA-512:CBB077098CCB22DF4A78A27A365141498B9C4E37BE3EB4DB2EF605D143B4B4438B2028A7F13DDED65FAB138EAA79C9557560138569A33DC57035F87811271610
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:#wa-dw-toast {.. height: 245px;.. width: 425px;.. border: 1px solid #B1BABF;.. background-color: #FFFFFF;..}.....header {.. height: 20px;.. padding-top: 12px;..}.....content {.. border-bottom: 1px solid #E6E7E8;.. height: 132px;.. padding: 12px;..}.... .content img {.. margin-right: 8px;.. }.....content-header {.. margin: 0;.. color: #EA1B24;.. font-size: 14px;.. font-weight: 600;.. line-height: 33px;.. text-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.25);..}.....content-text {.. min-height: 32px;.. width: 99%;.. color: #53565A;.. font-size: 12px;.. line-height: 16px;.. margin-top: 8px;..}.....content-footer {.. color: #53565A;.. font-size: 12px;.. font-weight: bold;.. line-height: 16px;..}.....content .body {.. float: right;.. padding: 0 0 0 0px;.. width: 99%;..}.....footer {.. display: table;.. background-color: #F5F6FA;.. height: 56px;.. width: 425px;.. padding: 0;..}.....logo {..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-dwtoast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1693
                                                                                                                                                                                                                                      Entropy (8bit):5.120047875792636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:V2sY0TYttGNVMz7tVMz7EVMz7VMz/VMzlGVMCqEjIYc09WY:3XT0tMv267CjjK09WY
                                                                                                                                                                                                                                      MD5:B420BDF71D0DAC0D9A4EF89A6A4173EA
                                                                                                                                                                                                                                      SHA1:4A18AE3FDA9DDB6FCB55B9B746700F5601A0FE30
                                                                                                                                                                                                                                      SHA-256:5C6671D6C9EDDF8348FD70C77B447304B4416B441790D2BEFF81AC9B70B01EBB
                                                                                                                                                                                                                                      SHA-512:DDD026B82A57B72D55A252E7C0D3D4F375CF81E95616C1B0B4EBFCA798BF0B95BB2EA7154EEE0622A507641097BC5512E06F261B3261FD3054E2BA2C68EEAC26
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-dwtoast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-checklist-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-dwtoast.js"></script>..</head>..<body oncontext

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2137
                                                                                                                                                                                                                                      Entropy (8bit):4.910977970641668
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UUzf2hkRg/q4HWcJ5/VFeICFeI75jYKubJsbnbIeIpqqJZAG:Uh2gy4HWw5/jC75jYbJUba8qT
                                                                                                                                                                                                                                      MD5:A6DD19A76697B102F36324FFB94FC19A
                                                                                                                                                                                                                                      SHA1:131D576A3C41CF088A453854DCBA0314EC67120F
                                                                                                                                                                                                                                      SHA-256:FD2BCDBB2AFBE916C4C3897EE389E4954AD61315167D8299212FD0152F723D3E
                                                                                                                                                                                                                                      SHA-512:7CD50686BAA93A21828F0B021F9909509234756100D90F20706EB7ACC5F23FBAA43957D2855B2A6FF434FE3A2F1CA3C50D58677F99746D7EB98CEAA5B5430D44
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. margin: 0;.. font-family: "Open Sans";.. box-sizing: border-box;.. background-color: #FFFFFF;.. border: 0.833333px solid #BCC3CC;.. box-shadow: 0px 0.833333px 8.33333px rgba(0, 0, 0, 0.254218);.. border-radius: 1.66667px;.. overflow: hidden;.. }.. .. h1 {.. font-style: normal;.. font-weight: bold;.. font-size: 16px;.. line-height: 32px;.. color: #383434;.. }.. .. p {.. font-size: 13px;.. line-height: 16px;.. color: #454545;.. }.. .. .main {.. text-align: center;.. background-color: #ffffff;.. height: 210px;.. }.. .. .main-logo-container {.. display: inline-block;.. }.. .. .main-logo-container .img-wrapper img {.. max-width: 105px;.. padding-top: 32px;.. }.. .. .main-divider {.. display: inline-block;.. margin: 7px;.. }.. .. .main-description-container {.. display: inline-block;.. text-align: left;.. vertical-align: top;.. max-width: 295px;.. height: 100%;.. position:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2618
                                                                                                                                                                                                                                      Entropy (8bit):5.083708862824626
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:V2sY0TYaGNVMz70VMz7EVMz7VMz/VMzl+VMzk8lVMCqX+Q7hc8A5TTD14KtYJCKG:3XTL/v26Tg88ChnR+5WbeIwEeIYOzN/
                                                                                                                                                                                                                                      MD5:DD87915E00002516B9ADB64C67828D86
                                                                                                                                                                                                                                      SHA1:95DD004E6239349314D597BD6CC25ECB17EC47C5
                                                                                                                                                                                                                                      SHA-256:3F417EE606B9CE80207A5B8AEF4D66D81446590BA4102F06D99AAC391F965639
                                                                                                                                                                                                                                      SHA-512:EE214C46BD8DB2DE0476BE156E83D06D494BD40688F479A2955D9554641FCFA3BE8BB9B9A113C580B876F32DF0A382F0B5965FB4D71DE3125AE28945BF8B7C0A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ext-install-toast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ext-install-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ext-install-toast.js"></script>.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4309
                                                                                                                                                                                                                                      Entropy (8bit):5.296651216965151
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:nPT2likC/JkhmmVkH0zf6lui5TF2csEzkb0WDnt+lkz0tRZU77:SMvuhmmVXzf6gah2cBzzWDwlvtc
                                                                                                                                                                                                                                      MD5:22EFCDB954C2BA653B57648D0FC63D02
                                                                                                                                                                                                                                      SHA1:600EFB885BBF48EED64C1A089D2786324BBDF91B
                                                                                                                                                                                                                                      SHA-256:96B9CDF3E2C5740DC345787C3803B528253E7FC47B59DFC1C4DBC63F1946577B
                                                                                                                                                                                                                                      SHA-512:DB99A3D3120E433921BE44C3FF9020C9F37A04E729325D6A866DD3F483AA4125F1D89CEC3AAAFB4CFB1BDCF89DB457C019FBEB3935B51DC56741640CCD746155
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Download Warning Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,... _instrument = wa.Utils.Instrument,... _settings = wa.Utils.Settings;.... ui.extension_install_toast = function () {.. var $el = {.... header: $("#wa-sstoast-heading"),.... description1: $("#description-1"),.... description2: $("#description-2"),.....acceptBtn: $("#button-accept"),.....ignoreBtn: $("#button-cancel").. },.... show = function () {......_window.ready(function () {..............// Set toast window size......setSize({width: "485", height: "265"});..........// Get settings data.....var toastCountSetting = "ff_extension_toast_count";.....var toastCount = _settings.get(toastCountSetting, "0") || 1;............var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.WAIFF).get;.. .....// Initialize toast......init(lang, toastCount);.... _window.show();.......// Send telemetry for toast impression.....var settingTelemetryEvent = new Ex

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 126 x 104, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5630
                                                                                                                                                                                                                                      Entropy (8bit):7.947897963110471
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:QSToxeyGItzC74o5BBiMAxI0Roty8QTzTuWjP4IMqQidjQFl1JuKOrzmdc4z+S3:QScxeyDtMzPBiMAxZtqIXQ6QhJZyS3
                                                                                                                                                                                                                                      MD5:F5D9337BD302C183FFE6B9613EA4E236
                                                                                                                                                                                                                                      SHA1:6C622ECF659AE65E7F6ABFED4FA831D230B51A02
                                                                                                                                                                                                                                      SHA-256:DDC6EC93BB8B7AE8C90D42476ACCC47CB7E9EE28B01A312346462AD54206151C
                                                                                                                                                                                                                                      SHA-512:40270893584E34AD27B7E89DE9466D08464A4A869D96D5CA414FADF7332BD02B7AD1F28725FA82D7EF8AF4A0973494CC8633A202F58F0A2E60933CF482591BF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...~...h.....7.D.....pHYs.................sRGB.........gAMA......a.....IDATx...xT...G2..$<B...6.@?E...#.~U..b..Z.j......E........\...,.......A.V...A Iy.H2.y$s..g.'3.sf..$.{~.w..}.L....Zk..(A.....Q.&...`Q.n.@...j..Wz..2.I*.....f...q. .%..[..x.:B...:.....F.a.,\....O...>.t:....`.Ut...Y..34.O'q.%<..b...B.I...q.%3.n....k..#..=F.J.5.9...;o.R.^...D.N_...9...i?..~A....k.%..l.kiU.\@....`...M.`.....9.L.n.%....t...9..;YK......aT......4-......yq.D.8...>1..."...v#.....]t..i$S..$..H.C)$...i-n.Q(5];S,.Utc......6.....4.WOr..%...-D6v.\.m.m.....r......@..6..1..fQ.......`z.e...J....I...At...0.;..B......?...,...0..8.. ...n...Y..o*....r.6.b.......V...M.....v.J.d.K..y.Hq.|....~...e.=_....x.t...x.x.z.i.%4..~.k>.n..$.&..^.S4s.c...!r...].3..}9M..Mz......u..\..6....=3N.=.#.N...SQ..i\...I.<M.~AdP...G.o....A=.}.L...N.R....N..[nQ<o.8..V.&...,......MMt..a...r.[^..F'9.Ix..t..N'.q.....N8.!.8..%...t...Q=..U[+..Lcs3..j...:r.\I.'S..."9....:Q...YR.WP5[<.w.A.m.0

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6632
                                                                                                                                                                                                                                      Entropy (8bit):4.86774813786894
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:yH5SvRvxVoY2bZ8/C0jBkY52Q5YsYmgdFZR9q:yH5EvxVD2bSq4BksV5BLgd32
                                                                                                                                                                                                                                      MD5:4FAA17C049F9EE1C25A2E06E1CC815C0
                                                                                                                                                                                                                                      SHA1:F9BBC2D5218DCDC68D6E0B5BD6AD6CE5236E5AE3
                                                                                                                                                                                                                                      SHA-256:7EE350878A12F783E99F0FF8E2F8757281A83A0AA12747B304DD565207D6DE10
                                                                                                                                                                                                                                      SHA-512:996A91C249DF410A9B059EE8200F91A77FA8FC87120C05950CE2FB22BB75D9F3C092A448BC53AE2079B7EFC2B13E1B8849E60CB990B99BE786C5D33DE923760D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:#bottom {.. bottom: 0;..}....#left {.. left: 0;..}....#left,..#right {.. bottom: 0;.. top: 0;.. width: 2px;..}....#right {.. right: 0;..}....#top {.. top: 0;..}....#top,..#bottom {.. height: 2px;.. left: 0;.. right: 0;..}....#top,..#bottom,..#left,..#right {.. background: #939598;.. position: fixed;..}....#wa-button-donttrust {.. font-size: 26px;.. right: 2px;.. top: 5px;..}....#wa-button-reset {.. background-color: #00AEEF;.. border-radius: 3px;.. color: #fff;.. font-size: 14px;.. font-weight: 700;.. height: 40px;.. margin-top: 12px;.. width: 145px;..}....#wa-button-trust {.. font-size: 24px;.. right: 3px;.. top: 4px;..}....#wa-close {.. padding: 8px;..}....#wa-options-about ul {.. line-height: 23px;.. margin-bottom: 0;.. padding-left: 12px;..}....#wa-options-content {.. font-size: 12px;.. overflow-x: hidden;.. overflow-y: auto;.. padding: 24px;.. width: 550px;..}.... #wa-option

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-options.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1526
                                                                                                                                                                                                                                      Entropy (8bit):5.25199376932693
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:csY0TYJGNVMz7UAVMz7EVMz7VMz/VMzlQVMzkCZVMCmFgtHAXW:3XT8sTv26ZgzCJtHT
                                                                                                                                                                                                                                      MD5:FC23B2AECB18FCF70F32AFB398328863
                                                                                                                                                                                                                                      SHA1:77DC98239A37EBCB4762E5D86D24C4E932F2EE6C
                                                                                                                                                                                                                                      SHA-256:139C913F875D9AB3AC17B2C03A77506BF58DA5ABD6D925980AA197D10FA62DDC
                                                                                                                                                                                                                                      SHA-512:3142B94D7DF396EA4384ECED7BF2E2E6697882DC5575391768914BFDAE0FA4FC1533406CB6E0E08BDBB58532A35CC5A8394FE1763BB5AFFFF0B51B73F70F3C31
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-options.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-options-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-options.js"></script>.. <script type="text/javascript" src=

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1594
                                                                                                                                                                                                                                      Entropy (8bit):5.198054220050235
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZR3xQpxsVecZa95p4H3rn39UDSyPVhilb39U0M3JtEN8vWZRVcoPuFRnD8:xmp5UoZJxRVXw9n0gA3uBHEN8vWZwDm5
                                                                                                                                                                                                                                      MD5:0BCFF0C285E288A9B4174F7A6C1EAF46
                                                                                                                                                                                                                                      SHA1:13A9941025E337F86D68EEC3707B1D78ECC2F99E
                                                                                                                                                                                                                                      SHA-256:6F3DE5DE455235FB0DA93CE37755789B1D06CE8E4ECDC4EEAC037E5548F49ACE
                                                                                                                                                                                                                                      SHA-512:F85E5CBB3EFD9FA465047F70B4A6EF77F4CC067839BF4542375CEB2AAF444613827FDF9B4C8763BE67DC4141CC902FBF7E3A7ABF6F4F0146900C4EB663AC628C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;..}..../* Arrow pointing up */.....balloon__arrow-up {.. display: none;.. position: relative;.. text-align: center;.. top: 8px;.. width: 440px;..}..../* Arrow pointing to the right */.....balloon__arrow-right {.. display: none;.. height: 130px;.. line-height: 130px;..}.....balloon__arrow-right img {.. display: inline-block;.. line-height: normal;.. vertical-align: middle;..}.....balloon__card {.. float: left;.. overflow: hidden;.. position: relative;.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. height: 130px;.. width: 100%;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. ma

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2157
                                                                                                                                                                                                                                      Entropy (8bit):5.210456042351339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+swDjYiRGNVMr7xnVMr7EVMr7VMr/VMrlwVMrkANVMCrAe+xdmn56+u0INBeRMJF:NOjPxuneCNIJCO06+PCBCg8pw
                                                                                                                                                                                                                                      MD5:173E708C6B6191E3E1D5C85F2ADA18EB
                                                                                                                                                                                                                                      SHA1:29FA373724F56219DF8929CC4EA0B4CB4DD540BF
                                                                                                                                                                                                                                      SHA-256:DB76348308821AD44E8EA90F1276A4EEE2D959CBEA3B539ED311E87D3E4FC928
                                                                                                                                                                                                                                      SHA-512:DD1BDE025B4613B8CD09A589208B0CEB032403AC8598794EC353CFC50A2A76AF11A2CBBDBDB0A7E0C5C587C7E84CE02B0A1120100D02CFCE5B5076356D6401B6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-overlay-ui.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-overlay-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-overlay-ui.js"></script>.. <script type="text/javascript" src="wacore:tele

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-overlay-ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10010
                                                                                                                                                                                                                                      Entropy (8bit):5.210901249991467
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:2Ar/3qYFqFmMKuhiXdeRh3tFuznLe7Q9HKmX5vX:7SVIIh3tFc4QJr5v
                                                                                                                                                                                                                                      MD5:88A90AD0437DA01E1F6E72E791CECC9A
                                                                                                                                                                                                                                      SHA1:000CB8022924070FA7DB0A4AFE435A09F565B6FE
                                                                                                                                                                                                                                      SHA-256:E55C4B1998DADA80B3E3F157A8162285E7F180D080BE678690053A1FBB2E80A2
                                                                                                                                                                                                                                      SHA-512:D1FA4A54FAFFDA1214978C014442364ABA677D3BEA31F0C18D11682DAF9A55DEADE4174A8FFBC072484E701A28485063CBD810C90CE944EFE5BF80D2B49637E4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. arrowUp: $("#arrow-up"),.. arrowRight: $("#arrow-right"),.. balloonCard: $("#balloon__card"),.. contentText: $("#content__text"),.. cardImage: $("#card__image"),.. closeIcon: $("#close-icon"),.. waLogo: $('#wa-logo').. };.... var ENABLE_EXTENSION_OVERLAY = 0;.. var INTRO_OVERLAY = 1;.. var SEARCH_WARNING_OVERLAY = 2;.. var SETTINGS_OVERLAY = 3;.. var TOAST_OVERLAY = 4;.... var WA_EXTENSION = 0;.. var SS_EXTENSION = 1;.... var overlay = {.. types: {}.. };.... overlay.types[ENABLE_EXTENSION_OVERLAY + ""] = enableExtensionOverlay; // enable_extension_overlay.. overlay.types[

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2101
                                                                                                                                                                                                                                      Entropy (8bit):5.234199060438722
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UoZJx7MdDjTPWfx9gczwPpCRulmtI9:xArx7M5TPWfx9lzwsH0
                                                                                                                                                                                                                                      MD5:CEC0B43F52220714A9BF8523F4FB420C
                                                                                                                                                                                                                                      SHA1:8C719251010F5C45EA6276AB3E8FA3ABE7B170AB
                                                                                                                                                                                                                                      SHA-256:A4BAB9BE53BB6A6D13B4BDC6642D7D366D4D291D615DE9409592D16CA0041D63
                                                                                                                                                                                                                                      SHA-512:858B0A8A422C7CF7124509488E55DA806A0DFE6786F844E6DD48E47D31C6F0BA6B9A4AA02A689B1D403B6008EF86D0EE3B92B2C91063F5A034F2B57904535381
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; /* Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 16px;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 16px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. paddin

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2197
                                                                                                                                                                                                                                      Entropy (8bit):5.208280007666155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:AswDjYEZGNVMr71rAVMr7EVMr7VMr/VMrlEa0VMrkbAVMCrmglB7vURFWS4CicmR:DOjNlTneCp3IHCTRSFWSO7QmqPO40
                                                                                                                                                                                                                                      MD5:3F1EF9262ED6F138063AC7E729DEEF10
                                                                                                                                                                                                                                      SHA1:BE601EC6C612A7202335C2A5AC68CA06633AF951
                                                                                                                                                                                                                                      SHA-256:54FD9E2E0A67DF097F13B36F4DB0E49CF493ECB03921246B6C779B0BCBA3C884
                                                                                                                                                                                                                                      SHA-512:51A26B80601A3467D6E29ADC84C66411169499EC25897D67B32071BF3853AF86A24DFE5EA18E9885EF9BA6CBF41526EDE0E32E10097210647B1FF483CAF222F0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>....<head>.. <title>SS Toast Variant</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-ss-toast-variants.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-ss-toast-variants-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ss-toast-variants.js"></script>.. <script type="text/javascr

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11776
                                                                                                                                                                                                                                      Entropy (8bit):4.988591826978154
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lAGSRh8MezXoRYhsCSRyTe7TSlR2R1pUnoKWERjW18jEcYwNNGifX3H:m3hFezXmYhncyTe7TSjg1unoKWyq18jH
                                                                                                                                                                                                                                      MD5:3B83DE1E085361A216A76526831DE1E6
                                                                                                                                                                                                                                      SHA1:CAE72DF0217D68846F7A9802CC4478E2D1D60E29
                                                                                                                                                                                                                                      SHA-256:2BF28A37424DDE23EB4658715CC27237EB1D8142DF57E394249D26CB40E8B335
                                                                                                                                                                                                                                      SHA-512:B24D505991F02CF88AC8992D017325B01AE84E3C602E43A951F5406E719F76445B1AF5A99171ACAB2F758715D542880B07D03B9AA3A1CF40581BE384446C0884
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. };.... var variantsMap = {.. // Toast variation phase 2.. 1: {.. InfoTitle: "TOAST_VARIANT_1_TITLE",.. InfoText: "TOAST_VARIANT_1_INFO",.. Question: "TOAST_VARIANT_QUESTION",.. Label: "TOAST_VARIANT_CHECKLIST",.. ButtonText: "TOAST_VARIANT_BUTTON",.. T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1615
                                                                                                                                                                                                                                      Entropy (8bit):5.1069674598184385
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:UviN/rbeh3kskClt+GSq1lPDgrertqIKV5bZ0CrYk6nLK:UvitmrJpSqbb9AIKV52C8m
                                                                                                                                                                                                                                      MD5:3468BB5D8F25BD605E9942EF470B89CC
                                                                                                                                                                                                                                      SHA1:8AC0C54512A397CC61541DECF3C5B1D003C2D427
                                                                                                                                                                                                                                      SHA-256:E990B637B475C34803E127F86EE76AD98378A0C9A5F3552622AD952244F6CCF5
                                                                                                                                                                                                                                      SHA-512:E7B74E04ABED95203A7022AFB45CA069D91662392A4845E9F5EFE8B4CB148F6BE36A71315734E3951D2D4F1448F571338FEE8546488CE911F57D60C3BDCD2D0C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(wacore:mfw\\packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(wacore:mfw\\packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px 10px 10px 10px;.. font-weight: bold;.. font-size: 15px;.. color: white;..}....#wa-sstoast-content {.. font-size: 11.5px;.. padding: 10px 10px 0px 10px;.. height: 142px;..}.... #wa-sstoast-content table {.. height: 132px;.. }....#wa-sstoast-content-caption {.. font-weight: bold;..}....#wa-sstoast-footer {.. padding-right: 5px;.. padding-bottom: 0px;..}....#wa-sstoast-content-check {.. padding: 0px;..}....#wa-sstoast-

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-bing.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2922
                                                                                                                                                                                                                                      Entropy (8bit):4.612475101351718
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:x2sY0YYkGNVMz7OAVMz7EVMz7VMz/VMzl1urVMzkbAVMzkizVMCqU3jOB3+7f6LS:jXu4v26mCgHgiKCe3BEdrOq
                                                                                                                                                                                                                                      MD5:FB3CD2354A31654DA1A9AA3043BF7E46
                                                                                                                                                                                                                                      SHA1:A4A33D329189B822BE136A34ACB59056097F4EC7
                                                                                                                                                                                                                                      SHA-256:C07FE72F45035547ED61166FB99EC6C1D734E34E030AF0AC1447E32DF0441E17
                                                                                                                                                                                                                                      SHA-512:7B53FF47D2C2009B2AFEDA404A586AF0D745D9CE06B81BEC0A3DC352960443F6545D10F84A9BFB50DCCB12E5EC51E2A672D2AFAD91705DBA72BFBDD3BE283C93
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast-bing.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-bing-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-sstoast-bing.js"></script>.. <script type="text/javascript" src="wacore:telemetry\\serializers\\Secure_Search_Toast.js"></script>.. <scri

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7462
                                                                                                                                                                                                                                      Entropy (8bit):5.110198202407823
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:OWZxXMHRMrola7b6xEgPGquAED+Y8AAoYE9Yl5hpeA8h9Y/5hbqe51E5T9565Cg8:OW0H2zFguf+c9Ug9K7aO9Y1bATW
                                                                                                                                                                                                                                      MD5:5D5F968828D3902C6330FE05A74F1404
                                                                                                                                                                                                                                      SHA1:16F7156F26C96490D39F344758F92DF694FE820F
                                                                                                                                                                                                                                      SHA-256:A18E71847BCDB9DCC64031DFDB08B6B3EB9399A38B4E476894144E51FA84FF6A
                                                                                                                                                                                                                                      SHA-512:1AEF023CEDE2A358728B4E5A8F1CA7F855DAFF2C39B1F719D611772C59063403C21BA0751C9F7B50C6D2E87FB430C792B62D43C33EE28723C530A8BAD7529657
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* version 2 3 */..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;..}....body {.. background-color: #f2f2f2;.. color: #212934;.. line-height: 24px;..}..../* Parent container */../* version 2 3 */...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../* version 1 */...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../* version 2 3 */...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;..}..../* version 1 */...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../* version 2 3 */...card__

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3957
                                                                                                                                                                                                                                      Entropy (8bit):5.044347286271276
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:jMsaURv265bWgHZNY0TUYoAzgs3CZ4ea9S6ghD2QXIanvn+qm:jjbLe9Yo2gs3JeacVDfXIanP+qm
                                                                                                                                                                                                                                      MD5:9597835F22EA601608E34147DBD4E746
                                                                                                                                                                                                                                      SHA1:1F28848FDD87FC3E09D4D3AEE9ABD4C1B2B60953
                                                                                                                                                                                                                                      SHA-256:F84AF62D264204E6060226841F6CAD19E4C7FABCB043781A2A29FDBAF4FCB8D5
                                                                                                                                                                                                                                      SHA-512:316424172895CE633CA9DE2F8BD40DB1F85229C312A3A1E5A4D071A2F73262C09DFE3431E44A8B7851DF06A6A97518C51F93567F958379F505D80F05FD14EC07
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>.... <head>.. <title>WA SS Toggle Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast-toggle.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\weba

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast-toggle.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9376
                                                                                                                                                                                                                                      Entropy (8bit):5.149093107358449
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lAZ3m0aWPwT0JrrvG1zuLIhHQnJC16wZ+3Fo65DcwGWlgXE:mZ4j1yDJG+1opSsE
                                                                                                                                                                                                                                      MD5:45F33C4938D3B42EF320BF46139E323F
                                                                                                                                                                                                                                      SHA1:39D9A197E646F86860F9911C4E0551F547571A5F
                                                                                                                                                                                                                                      SHA-256:349FB95F09C00EE2EA8DE892200D4C12870DF4D716278DAFA07CD731CEEDF91D
                                                                                                                                                                                                                                      SHA-512:E97674C531A5CBE58F4DDA867AD0E18A275A0898F2795B3BC215C4146EF702D15085E2A1EA89879F492DD5B37F30B504ACAA247AF2AB1D1C322DACA713447F77
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. expiredSection: $(".expired__section"),.. expiredDivider: $("#expired-divider"),.. expiredLabel: $("#expired-label"),.. expiredName: $("#expired-name"),.. feature1Label: $("#feature-1-label"),.. feature1LabelContainer: $(".feature__1__label__container"), // dynamically change container if text is too long.. feature1Name: $("#fea

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2118
                                                                                                                                                                                                                                      Entropy (8bit):5.175275994007074
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UfqttN0I4H0m0UY60uR60BFvUIFaSvU49xRstVOWD:UfqttmhR3F7aSp9O9
                                                                                                                                                                                                                                      MD5:8B8DF7AE2C61CF5A94AC4E63DA6C7675
                                                                                                                                                                                                                                      SHA1:736868A5B7CDA40D4C832ABBE85358A0EFC1A8F8
                                                                                                                                                                                                                                      SHA-256:75D8B91E0248B8A11455A44AE0E60A7F08F8F526D0EF26CCFCF3DEE0300C5C0B
                                                                                                                                                                                                                                      SHA-512:49F01D666EF0317B9428E09EE86B9A9F852B7E5C2DE46C0B43217F8358F028BEA9BACA99CAEDB8EBF17B6DBFA2A8A8F058FB79F428A2BF702269251A4F4E458B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(wacore:mfw\\packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(wacore:mfw\\packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px;.. font-weight: bold;.. font-size: 16px;.. color: white;..}....#wa-sstoast-adblock-content-subheader {.. padding: 0;..}.....main-content {.. font-size: 12px;.. padding: 10px 10px 0px 10px;.. height: 118px;..}.....main-content table {.. height: 108px;..}.....main-content ul {.. padding-left: 13px;.. margin: 15px 0;.. padding-bottom: 10px;.. line-height: 17px;.. font-size: inherit;..}.....main-content ul > li {.. padding: 0;..}....#wa-sstoast-content-caption {.. font-weight:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-sstoast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5592
                                                                                                                                                                                                                                      Entropy (8bit):4.097832398384123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:m2sYRYkGNVMz7eVMz7EVMz7VMz/VMzl5VMzkbAVMzkizVMCqU3jOB3+7D/6LG3BW:SCxRv26GgHgiKCe3GyfZ9jey
                                                                                                                                                                                                                                      MD5:761897E62CE42167789F2B5054EDA068
                                                                                                                                                                                                                                      SHA1:60F146DB26AA13F59DE3901B15A3C8CB6E9BF275
                                                                                                                                                                                                                                      SHA-256:6130CA64C9CBAF1DAB705A261F2614A0999AE8F62ADC16960632AA6A9356915E
                                                                                                                                                                                                                                      SHA-512:D0BB7A6ECBF86CB6D7E827E76BC25E203E393FBE23579653177676E5A1735CC6AA5CDF25E1D68B68BC16FB1FE76D13C065184E0FC84569FDCAF52A5A0857454A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-sstoast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-sstoast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-ui-sstoast.js"></script>.. <script type="text/javascript" src="wacore:telemetry\\serializers\\Secure_Search_Toast.js"></script>.. <script type="text/java

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dialog-balloon.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3342
                                                                                                                                                                                                                                      Entropy (8bit):4.667565337590142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:B4j7B2AacfdwtxqA5JBbIVXjQB6UQVVPhPkzYOEbFQO0HR/1xRzi1CePNXDdbq:scAa+dwtDDRgVVPCxEeO011xReXDdbq
                                                                                                                                                                                                                                      MD5:4BF37C9F82106ABFB3A401AC09E48E77
                                                                                                                                                                                                                                      SHA1:000AA1564C982782229C71865FA9CA66644FCF15
                                                                                                                                                                                                                                      SHA-256:737CE9812E00E315B1B1792A4D31CBC35E1738D4FA0F55C13E6BFAB7C1C5926E
                                                                                                                                                                                                                                      SHA-512:E94855251E4B3B6C526D4D2B69A9D729AF447A7F773BBC6D39E9AA37D0E0C4DBED4FF7EC48C5DBADADEE765B282B6CABFA365D0119305AD82C8DEC68A6B76AA5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. button: $("#wa-dialog-balloon-button"),.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $("#mc-dialog-arrow").. };.... var telBalloonType = '';.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.... if (!settings.balloon_type) return;.... init(settings.balloon_type);.... _window.show();.... // Send Telemetry 2.0 for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(_instrument.ge

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-dwtoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2413
                                                                                                                                                                                                                                      Entropy (8bit):4.804134666249459
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:H45ikVjkpq/nWp1qgVsk0HuKAh51nhXjK:Yjk+WlcsBhzK
                                                                                                                                                                                                                                      MD5:2733864B6469F425B14BFA4A33E2346C
                                                                                                                                                                                                                                      SHA1:057319741D42D78F8C73D10C61BB558EB822FFAD
                                                                                                                                                                                                                                      SHA-256:2F718A0EC1E1B88ABCD18A2A7F94C3AE1BC086F0491A3435AF801F225DAA7B82
                                                                                                                                                                                                                                      SHA-512:B4B3D39D30E9718DA4A8BFBB4F2494B065A8411D18F1E8EAF98FE65C2E3533A08A832545AB63AA928C0E1CD26BB5BCDD5722A5B5FABBDC42D66703D7F4E2C8BB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Download Warning Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _dw = wa.Core.DownloadWarning,.. _wa = wa.Core.WebAdvisor,.. _l10n = wa.Utils.Lang().checkList();.... ui.DownloadWarningToast = function () {.. var $el = {.. logo: $("#wa-dw-toast .logo"),.. status: $("#wa-dw-toast .status>span"),.. content: $("#wa-dw-toast .content .body"),.. block: $("#button-ok"),.. allow: $("#button-cancel").. },.... show = function () {.. _window.ready(function () {.. var domain = _dw.getDomain(),.. fileName = _dw.getFileName();.... $el.logo.append(_wa.getProductLogoHtml("wacore:mfw\\packages\\builtin\\mcafee-logo.png"));.. $el.status.append(_l10n("PP_STATE_TEXT"));.. $el.content.append(.. "<p

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-options.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23745
                                                                                                                                                                                                                                      Entropy (8bit):3.894439750463326
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:LravuBFTv2stBHDiF9ymq4pnU5rnXEBF15hZOmvYkydOergIN:PavuB92qBHDdmRBU5rXEBF1VJy9EIN
                                                                                                                                                                                                                                      MD5:A57CF446268BF7CBF054BD9AC1C0618F
                                                                                                                                                                                                                                      SHA1:3F2C8577DD899964257DB70B69E629B8290AFC37
                                                                                                                                                                                                                                      SHA-256:936B11ABC02D2D8E81B07DE4D0A7B8EE73BAB15AA1ADC29A8CEF57E3E9CECEC3
                                                                                                                                                                                                                                      SHA-512:156FB6883E94BA18C1C1D269A7D324E623294C82E7402443254EA79EDAC99ECDDBC2D06A36B24188FE667CC0D282D003C320DEF0152FF661E07F385E95B9D3A1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Options UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.OPTIONS).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml();.. _external = wa.Utils.External;.... var OptionsMenu = function () {.. var menuItems = [],.. el = {.. $menu: $("<ul id='wa-options-menu'></ul>").. },.... toggleContent = function (id, delay) {.. $("#" + id, el.$content).. .fadeIn(delay).. .siblings().. .hide();.. },.... itemSelected = function ($item, delay) {.. $item.. .siblings().. .removeClass("selected").. .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast-bing.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3660
                                                                                                                                                                                                                                      Entropy (8bit):4.763560730421771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:445jWijMxhfOx/2NdFobmZ5oncCl/QSt/QBmy/Qe5OOQH2:bjv23F2+5onCFOOQW
                                                                                                                                                                                                                                      MD5:0775613E8CC154D6497DA2BCE384316E
                                                                                                                                                                                                                                      SHA1:EBDF7207F54B7C32637692FA6CEED167CD55960B
                                                                                                                                                                                                                                      SHA-256:82B79AAC799AF42F4A1F54B621F7AE63FFBB73CFF8E1C469770C233254D62851
                                                                                                                                                                                                                                      SHA-512:BB192025A3FC8EE30720064E973E0DC4DA4168E146D8698D78F426FF87C4A7A7DE84AA21EC0BE6CB1E0A6ABE9732395E97FFB3679E8EFD7954EF31CA1A54F747
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window;.. .. ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. subHeader: $("#wa-sstoast-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. subFooter: $("#wa-sstoast-content-subfooter"),.. submitYes: $("#wa-sstoast-content-submit"),.. submitNo: $("#wa-sstoast-content-bing-no").. },.... show = function ().. {.. _window.ready(function ().. {.. var toast_element = document.getElementById("wa-sstoast");.... if (!toast_element) {.. _window.close();.. return;.. }.. _window.setHeight((toas

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ui-sstoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15681
                                                                                                                                                                                                                                      Entropy (8bit):4.871446512282397
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:QODJo/vVNYs2ebppb08qb1WAWxJK8ku6sI098/CdQkrriKSpKKBS6aYSQwuHcBzR:Fi/vVNQeo8yCdI098+oYupqv
                                                                                                                                                                                                                                      MD5:7F112450EA576AD7FBE90043325E6A79
                                                                                                                                                                                                                                      SHA1:E4081C7EDC1E351DE0BBAF6AF54375945CA6353A
                                                                                                                                                                                                                                      SHA-256:AE5F1E9522DB83351156DBF18475801F0920CD9D67027514C9958F376DF12E7D
                                                                                                                                                                                                                                      SHA-512:E24B115FCA81149C7FAF74537A12DF5973B450C16B07274E5DC8D3EBD8AAEBDBAF800AB0FAAE208210DCE6CE0F0F8612996CA0BBDD42180F13AF9814FFCE1967
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {}),.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var TOGGLE_COUNT = "toggle_count";.... ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. mainContent: $("#wa-sstoast-content"),.. mainAdblockContent: $("#wa-sstoast-adblock-content"),.. mainMavContent: $("#wa-sstoast-mav-content"),.. subHeader: $("#wa-sstoast-content-subheader"),.. subHeaderAdblock: $("#wa-sstoast-adblock-content-subheader"),.. subHeaderMav: $("#wa-sstoast-mav-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. captionMav: $("#wa-sstoast-mav-content-caption"),.. label: $("#wa-sstoast-content-label"),.. labelAdblock: $("#wa-sstoast-adblock-content-label"),.. labelMav: $("#wa-sstoast-mav-co

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-danger.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 210 x 180, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12312
                                                                                                                                                                                                                                      Entropy (8bit):7.968450241648148
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:yRBdas2d1PJ4BYvAHpw+9zCUu3lsOgtPaITUL:6UdVTUoUTHs
                                                                                                                                                                                                                                      MD5:4FB51E8F6008C7C9C8F0A1075BED12A1
                                                                                                                                                                                                                                      SHA1:39C35D6482BF2D7B8A347991BC99F4EB408B7FE7
                                                                                                                                                                                                                                      SHA-256:866910A9732E353EDFE938958BF6F4B6FF03FFA6B90589BD03C44011D2E41C37
                                                                                                                                                                                                                                      SHA-512:6C39FDEB9036823547E8515A7F0505B41A519F5F70D55A1D2B51A10B9FAC6D8738EB3D78D2DE2BEE55666C5712A4753D72450760B69836C7F1B71577760FD99F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............4r.....pHYs.................sRGB.........gAMA......a.../.IDATx...|....vyU.xO.. ..8.%!.8.PJ......t..RHx....@[.......@i...-.<..H..%....x..y.l-3.+.<.G.i...~>.F..5.9.=.\.,,tp.P...rr./~<...h......a........A?.i.m.R.y?9a.y....".......0.,0-........LS,!Y...al...G..k....V.a.NGQ....p8.o.A#..<...<...0.+.`..0.....!...k..Y.x..ax~-....T.8w.t.T^...`..&.a.#.h......}Z.8...(..4.^L2.....&X.M0<.....B.T....d..62......`....,...'f...I<R.....!..t.T..(,.e.."......x..9...Z..(0.BH.]...2....lS.D.'".h)$kU.. 0....:M...z..6`..1.1.|.VI.%.9...3.B.NS&......i...G..i.mS..M...f....x2!.5.....:M......y(......V<...,.%....!.W.d........s.:.BJ.W0...WO.!#.b.E..Z.fP0..r./.j.....lq....M.u....L....3.2PLD.O.Ao.!,.!?.....2...iR.D..[Y...-,. ..d...cC[.%..,,..a..U.m.<.4!%D....`aa..d.L..%".."_.......,.YL.d.|s{gp.L1.......Qv..I....38.q......*pH...j..0!.u..,..XXL.SV.j..p4..1...w...k....$.s...:.e^.Dd..`...g.>.dr......U.b.O.....&.Drr.."_..C..MV..."a\.V.."?.B`.3y.y....E.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-risk.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 210 x 197, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9639
                                                                                                                                                                                                                                      Entropy (8bit):7.959929359756836
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:8Sx+XNV33b9KE2nQId+RaxmxmDzMeRPGUhtGrnGyzcgJSzJKlkY+BjJJnjYdSPay:7SX9KbIRARfvRtklzcgJS1Ukz7hjYdJy
                                                                                                                                                                                                                                      MD5:0960D91DFEAF52DB02812BF775B62C55
                                                                                                                                                                                                                                      SHA1:125D3E9976B984B6BFDD698140626CB92D393722
                                                                                                                                                                                                                                      SHA-256:9E7C4BF9C4911967D24A948BFFE7268F5925A1B1E3DCD5D9CBEB7721DF32DF24
                                                                                                                                                                                                                                      SHA-512:C2AE53F305F34A3E6B0EF8E29A1E21A477C4A62F6AD27A69A91C7F1CD601A94DA1012341169F7E11C293D12AEC9B07B14CCB23185829A8C7F05FE0EDC718B681
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............!J.a....pHYs.................sRGB.........gAMA......a...%<IDATx..{t...._..j..%...`.....!..q.....&.N^..$....Hrv.....v...........l2I&..a.....O.[......l...WU...[.wwuwU...9..]...T..=.D".H$..D".H$..D".H$..D...DR.}}.@.-.iG.k...D........RH..\..&.*.r.M.|..j:.M...a......a..Dkk....)$I.I.pU...w.C.P].p..ok..."bA....>..T.r.!\.&.....R..8..9...8.(..F........;..K..wp.N).rB.){...\gk0....$..]twd..#w.\...Bh.0.....j(.R..*\....7..8.o!..B2-O=.g.}..),.0.....5'..{*.).i.ZW5....UBrP@9..`w.b-....6!.]..O.B1.o[h..5B........r"\A.]..]..B....S{..|....6.\(^B.4.n.o..g...Y+7.q]...N5.R.Hx.....H.Vz\?.....$3..l....Xr.....Z.{.bj".Y.=.v+d...z.J\..1;2...a.(.`].r....U....8..S..../{d1.A/@V*..z..,.o-..MF....&.(.S'..p...V6.w..7.N7.z..i.Lx...vCB..P.(".,..K5pe...l<$q#....B.P..+,.=.H....d..fE.......].FL..I.H........7.G..$...W..>..D..EH.X....H...'....FT]H...9....[.|.5..1.Yl...!...C.......TMHT..*;*...Z....:......q..I.I...G.N>TEHfrA..I.C...G. ....(.K&.$....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-wss.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 142 x 114, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9195
                                                                                                                                                                                                                                      Entropy (8bit):7.974458734523204
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qSgxF7Rxse5mfaPumPCqZplpMCwhsoYl6Va1uaOyplM/0zPMyWEu0:lg77RxsRaJCqD/twhsFl6VaD5KyWEj
                                                                                                                                                                                                                                      MD5:985990E7B49221E68CA85928ABFB55B6
                                                                                                                                                                                                                                      SHA1:A625326AFC180A99526B9C1E36C85718A8AE4E53
                                                                                                                                                                                                                                      SHA-256:6FCA27CE0ADD2712EA1CBAF52291BBC2C9AA3E5B8411348DA4459082E53D456F
                                                                                                                                                                                                                                      SHA-512:AD415F9B2242675A26DFD9FAB9DCC9E2BA02191EDFB4B938C688458E92379263C9E1357EEDF8E97D4956E3A28E69D59A80C6FD23777371A33CC1A02D2AF45181
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......r........j....pHYs.................sRGB.........gAMA......a...#.IDATx..].`TU.=.M.d..R.%..{...*M...(.k..UDqw.U..]uuw]...H.^..RB...u..3...L2.2....}.d......0..#.0..#.0..#.0..#.0..#.0..#.0..#.0..#.0..#.0~.h.v..W..#..%....]..M....e..rA.iI.>q8...E......qI.Y...T. ...Hr..]..{.V;.....G...S.J.........Z.Y.6...(...Dv.%%l"`..`.%X...m...a...J.#...,.....G%..:]...I.^9z..-."#.......B...%(a..0:t.0.`<.@.K:?!G.@...42.`..%..X..\>z.3R..N..}.b..%..:A.N.B..>...d.H0X...C..H0"...,..m.EQ...t....N....Fi.v.Z"y#SE..U?M.....mv...S...T.[.7*.'.T.0<.,..E..%:.ce.Go..g...&G.U.A......;.m.E.k6...%..2.tt..#J.w...|X~.R)h.g.a...6.(c........U.UZ..$.1a.........Pq...+.%....`....p8.6..ZNoWl...8.....$.#.$I{.m4.+`.7...0..B...SC.e............2....;..E..A.H3.^.}.W..E..9.....).Bs.b....K.. .q....q. (...... ..........`.....*..s.........C s..6oJ..Q...F.I.&..Q.N;v..... M..~D..P..Z'Ga.<..{%.....<l...')....A..."..ATT..x.z.c..B...A.q.k.....;...M....0....5.6n.P.7.......w.(,.%..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2407
                                                                                                                                                                                                                                      Entropy (8bit):5.1459059903374795
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Uk73uxPuaasQ8+FQv2xfdleIileIjOmkRlYWBheIpJqqeGzeNeIp5eNeIIBl:UDj+aOxf7KjiRlYWBxadt+t8l
                                                                                                                                                                                                                                      MD5:FBF0A828BE698A31C40E6423AA7BBAE8
                                                                                                                                                                                                                                      SHA1:294F9EE458E0FA6548489B240587F3F46AE0FCAD
                                                                                                                                                                                                                                      SHA-256:9C8A4056E8F5AACF05CEA95FFFDB09C7C4F28C4BC52F34FC83455718C52C3FCF
                                                                                                                                                                                                                                      SHA-512:A3FA178A81A7EA81BD9E78F0EC6C9076CADC1AD9841F47550E6672BB4B7D8B2F7739C333F0E232FB27BFBC7A0F4BC80A233DBD989A972A4DF1540572A97E8494
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. margin: 0;.. font-family: "Open Sans";.. box-sizing: border-box;.. background-color: #FFFFFF;.. border: 0.833333px solid #BCC3CC;.. box-shadow: 0px 0.833333px 8.33333px rgba(0, 0, 0, 0.254218);.. border-radius: 1.66667px;.. overflow: hidden;..}....h1 {.. font-style: normal;.. font-weight: bold;.. font-size: 16px;.. line-height: 32px;..}....p {.. font-size: 13px;.. line-height: 16px;..}.....main {.. text-align: center;.. background-color: #ffffff;.. height: 220px;..}.....main-logo-container {.. display: inline-block;..}.....main-logo-container .img-wrapper img {.. max-width: 128px;.. padding-top: 32px;..}.....main-divider {.. display: inline-block;.. margin: 5px;..}.....main-description-container {.. display: inline-block;.. text-align: left;.. vertical-align: top;.. max-width: 295px;.. height: 100%;.. position: relative;..}.....main-description-container p {.. font-size: 14px;.. line-height: 20px;.. color:#000000;..}.....main-description-containe

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2634
                                                                                                                                                                                                                                      Entropy (8bit):5.071554417168856
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:c2sY0TY+GNVMz7OVMz7EVMz7VMz/VMzlKVMzkHVMCZ+CEv7hW8AoDF0qXRqq5VbP:cXTxBv26HgOCe8+DSSqoFbeIwEeIYuAg
                                                                                                                                                                                                                                      MD5:F704F7D07DB4FA86719D0D5B7B3C44BA
                                                                                                                                                                                                                                      SHA1:3CB37F84F5CB68AE703B6350C73E8679498A3EC8
                                                                                                                                                                                                                                      SHA-256:F1CA18CFF09A5A6C2042DAA71EE27D4A0FA601B060D0F95251933316F2C7A346
                                                                                                                                                                                                                                      SHA-512:143C6ABD886848232AAB2B21A64BA83FF39A9B1CEAE66E933866142E288FF03EF06A0F4A918B2D279DFDEE4A492DEDBC0F7C7FCD707042F7A2B67DD8B4F43B05
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\webadvisor\\wa-upsell-toast.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-upsell-toast-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\webadvisor\\wa-upsell-toast.js"></script>.. <script type=

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12796
                                                                                                                                                                                                                                      Entropy (8bit):5.056756734166245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:80/Pf4lTvqz3NbDdvSNOsxyVVXMT2OpbNg/0r:JPf4lTvECBxyHcTRfX
                                                                                                                                                                                                                                      MD5:27A31150D4884BFDD9D59424B4F2D42D
                                                                                                                                                                                                                                      SHA1:DA3A1997E082EE1D8439DD9C1D320E864DCDCA66
                                                                                                                                                                                                                                      SHA-256:2A55074FBD372A59236735C3017B8C55A01EF5FE0496C23F807319400791E473
                                                                                                                                                                                                                                      SHA-512:FAFF1565E6656A5C65E5412C2E209A934FA22C9339D39CDD343CD1B5E7CA1E594E96AF423B5731DE291A70A7A00EFF6FF0E76C39A53128E2E7F6B8677A1682AA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.createUpellToast = function (toastData) {.. if(toastData.campaign && toastData.campaign !== 'none') return new ui.CampaignToast(toastData);.. .. if (!toastData || (toastData && !toastData.cohort)) return new ui.AvScanToast(toastData);.... switch (toastData.cohort) {.. case 1:.. case 2:.. return new ui.DirectUpsellToast(toastData);.. default:.. break;.. }.. };.... ui.extend = function (Child, Parent) {.. Child.prototype = Object.create(Parent.prototype);.. Child.prototype.constructor = Child;.. }.. .. // ----------------------------.. // Base Toast Object definition.. // ----------------------------.. ui.UpsellToast = function (toastData) {.. this.data = toastData;.. this.lang = wa.Ut

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\warning-icon-toast.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 47 x 46, 8-bit/color RGBA, interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1793
                                                                                                                                                                                                                                      Entropy (8bit):7.876784630522941
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qaOARKiy6Zk/fIEJo8VsjZhQ78P49eiQgPO4sP/ulgafKd6c:/OATy6Zk/1x0TQg+wvPmlga1c
                                                                                                                                                                                                                                      MD5:0649B7E9A67DE6931312BDB5BE3FA6D6
                                                                                                                                                                                                                                      SHA1:285B792941D7CCB34ECC8749A367CAFE4A51D4B1
                                                                                                                                                                                                                                      SHA-256:CBB5964B1888A95703984990FBC9C71448ACBA8A5E19BC0A96E626C2129F7E22
                                                                                                                                                                                                                                      SHA-512:12B8E6C4F3EBFF51BA6CE1FE66D737461CD0C30F0B9E65443256886DDBF9E1518E3A26D9186CD8F2CA95EA09D35F910372558BE1C997073E0E26603C4DABC22E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.../..........|p.....gAMA......a.....IDATh..Y]l.E....R....?.y.A@1.mi.)F.....#J.F.'..O.Q..#Q ......>hPH...X....b[b+..@.Q @....{w<g........W...9s.7...93C...7..e.b..\.d.....d!..'......G.....k...2.1J.a.6.1!.{.E.0..r...D.....I.5k.../.@..&QD.*j.oW.....6...}.2...\O..,..f...q....U...1.....Lf..U....bs....:.0!..?Q...j.e..;...X...qN.JM.[..../....=..2T....T?..VcR...qFl.._.T@.s...rP.....L...3!1...L.Z..xlh0.....Tr3..D..V......^.^..t.....3O.ED....8j8....k.E.`...{.>....v8...R...@.8.R_.. ..|&C..?.....rG..( .y....}.z.p.28w.....k..v.7.~.......7F|.. .@.8"..,..L...Q....7.a......oI*.z.f.{.j...`......}g.....!Y.... ..J2p..IJ...2...X..G8..Y.. N}..t...26.....M.._.....c...fs...{....)t[.,....e.&............t%.PX...W)..%..........t.`>.....7...H..s.CW..........u}.nS...~...&O..1...C}.....#..G.IH0.mjj(.._....M...=..C2..==..V&...~1..?...en..M...\.Q.%...B./.g.S...... .#.(....*..q...jb......p;../5.m.T..-...SE.h..(.|le...[.**!...=:TJ..!m..q2..CI.$

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\custom-checkbox.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):292
                                                                                                                                                                                                                                      Entropy (8bit):5.423375006466325
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:KYCutJFlCutfwEr+gCutF3GHw+amFgqMjMr7aMSSqkQ9c8:lCu77CuuSCu3X+aUhMjSeg4b
                                                                                                                                                                                                                                      MD5:1CC4FFC09D4B9E7A300922BBAC8D6FEE
                                                                                                                                                                                                                                      SHA1:7DBE9BA09919D2469B64EE2A6F2E549E3A482D73
                                                                                                                                                                                                                                      SHA-256:F89990B5E6732FEC83D4B256DEAFACD7970DB66C2D704A27C46C6D22B81DA82E
                                                                                                                                                                                                                                      SHA-512:949801819C752CE8ECCAD82C167E6D537C0025CEB5BA50C4DBE634D6BA5F271E54D8EC71A732F8EE160547999E4EF58371CBA6D6C8494318E2991E7C40FDD0FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:input[type="checkbox"], input[type="checkbox"]:checked {...box-shadow: 0px 0px 0px 1px black inset;..}....input[type="checkbox"] {...accent-color: white;..}....//9B82EBE6370F4B62F2CD4FE6C8CA239703814322D57250385EED612B1ABFD68A874252A76D6AD6BA81DE62A16C1B65392F137A55ED025299CF7F549146A84CFF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\jquery-3.6.0.min.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65446), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):89637
                                                                                                                                                                                                                                      Entropy (8bit):5.297690436754969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:ejExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v/:eIh8GgP3hujzwbhd3XvSiDQ47GKh
                                                                                                                                                                                                                                      MD5:712FE08D558510EAE764484E8589C725
                                                                                                                                                                                                                                      SHA1:4BF8E520E80B803946557166AA91055508363B94
                                                                                                                                                                                                                                      SHA-256:B2CDF00864D1083020AA779B7A977E5BF38FE5913BA6E4C0B2E0B71674AE6D14
                                                                                                                                                                                                                                      SHA-512:F6F50DA112D767B94AD62AC21309F23228A8D52BC8B6568F0398E96814635DA835756DA4F649246A4614859D8B3C9DC303AC5242F0AE6137D620A9CAE025DAF3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}func

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-common.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (33246), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):34187
                                                                                                                                                                                                                                      Entropy (8bit):6.04775948163756
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZ3:E9DDI6thXjez1jtnC
                                                                                                                                                                                                                                      MD5:F91D87301AF75396584604BAA4A45A23
                                                                                                                                                                                                                                      SHA1:A9FF08BE83C44731AEEDBD3A594C80A6EE3166AA
                                                                                                                                                                                                                                      SHA-256:772AC52600270A43EAA9494087096A83C4CE8C8CDFD82770F546EE1FCB54CBBE
                                                                                                                                                                                                                                      SHA-512:099B43A60A2F42768BA7340BFB9C634B9EDF7663FFD6BFA4D5F408C297D14F01BB7C4A7DB2D38BF6EC4275CE66212C217A2AB5791C1F02F91B875228E71723D5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-common.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):853
                                                                                                                                                                                                                                      Entropy (8bit):5.332212183702675
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:2B/hPp825C8dJK5VKv5iP5h158qESea06/AXJ:Y/h2P8dEnjPESTIJ
                                                                                                                                                                                                                                      MD5:A9D8E519E059B0395A0637969214F326
                                                                                                                                                                                                                                      SHA1:D1BDF66B7A5E3D185BB03CC95F93FE0354CF91D7
                                                                                                                                                                                                                                      SHA-256:D429A5E4A16B6E1801921515B59B1F706BF9564667F5EC224702ADE90749CCFD
                                                                                                                                                                                                                                      SHA-512:E5FECED82E7D90383FD526E14073F0A6FC0A6300531BD697FE624998CCC3CFA9E1FC7F68820AF74FF7198E10C4E37BF2F8ED5EF3284B7936761F1B9449F6B18F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa) {.. var common = wa.Common = wa.Common || {};.... common.getColorAndStatus = function(score){.. .. let color="red", status="WA_ST_SCORE_LOW".... if(score<400){.. color="red".. status="WA_ST_SCORE_LOW".. }else if(score>=400 && score<600){.. color="yellow".. status="WA_ST_SCORE_FAIR".. }else if(score>=600 && score<700){.. color="green".. status="WA_ST_SCORE_GOOD".. }.. else if(score>=700 && score<850){.. color="blue".. status="WA_ST_SCORE_VERY_GOOD".. }.. else if(score>=850){.. color="purple".. status="WA_ST_SCORE_EXCELLENT".. }.... return {color,status};..};....}(window.WebAdvisor = window.WebAdvisor || {}));....//2F9F7075A941ABE1C0AB0710F1D9280E8104D4FC90258B062E8C2F9436F7C39F95DBD73EF0D4B7F2054DFCA3286089732CE5A621EE238CD993EF63A62D616793++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-core.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23487
                                                                                                                                                                                                                                      Entropy (8bit):5.123179029687177
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:GZCfU5OMibTTqFf3+CyZRCDqRkaPUEgpLS5ueJw+dc0cbT4M/5cWal1fGoy:GZCfU5OMiLqFf3+CyZRCDqRkaPUECLgM
                                                                                                                                                                                                                                      MD5:E7984550A5EC9D0660F3DCD30D73C08C
                                                                                                                                                                                                                                      SHA1:581B46B50B0A696411B2ECC370679E310DB93C55
                                                                                                                                                                                                                                      SHA-256:1B0264EDF2BA956924D727FBDDA0D8ADEB48EF83D54A3E2A3981535A4CCBE226
                                                                                                                                                                                                                                      SHA-512:EFADF30DD5D682438615AABE4E2B42014ACA47FF710F7D780009A2164F65B50F3345787CFE3BC1F8FB3AACE30CD52A47F7FE5FB06B073F6ED658E8D02E921A6E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Core */.(function (wa) {. var core = wa.Core = wa.Core || {},. _settings = wa.Utils.Settings,. _external = wa.Utils.External;.. //Component. core.Component = function (name, status, key) {. this.name = name;. this.status = status;. this.key = key;.. this.isIgnored = async function (key) {. var isIgnored = false;. var startIgnore = await this.settings.get("startIgnoreDate" + (key || this.key));. var ignoreDuration = parseInt(await this.settings.get("ignoreDuration"));.. if (startIgnore && ignoreDuration) {. var today = await this.settings.getToday();. var startIgnoreDate = startIgnore.parseBasicDate();. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);. }.. return isIgnored;. };.. this.isInFixGracePeriod = async function (key) {. var inGracePeriod = false;. var gracePeriodStart = await this.settings.get("fixGracePeriodStartDate" + (key || this.key));. v

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-ui-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7998
                                                                                                                                                                                                                                      Entropy (8bit):4.697678020464664
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:j8KiNn2zKMXjRIQIeTZmY2OToGF/8OJISRjla0mo9SWLpmUtpdcSbFn4zN:IKiN2zKgyTeTEZzSRjg0jScmcdva
                                                                                                                                                                                                                                      MD5:B3E1EE6486B1A4B9129E992ED2DFEF20
                                                                                                                                                                                                                                      SHA1:ED01784F5B330C4A0C387BF1B8AE428A777DCC5D
                                                                                                                                                                                                                                      SHA-256:9760D164416EBBB611C4DCB333EB39B3C61C09A93DE2B311A4743A37FE616516
                                                                                                                                                                                                                                      SHA-512:75FAA2CD9E4FC894E9DAA634B0B0D473AAE70EA3A57674A290AE6563BEE71B5A2A7B779F4B2A56F0294F3A0B45369F888E75ED03CC689E807B23F62CD027E357
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* CheckList UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.... ui.closeDelayTimer;.. ui.CheckList = function (options) {.. var el = {.. $checkListWrapper: $("#wa-checklist-wrapper"),.. $checkList: $("#wa-checklist"),.. $messageWrapper: $("#wa-message-wrapper"),.. $message: $("#wa-message"),.. $messageImage: $("#wa-message-img"),.. $closeWrapper: $("#wa-column-four"),.. $close: $("#wa-close"),.. $logo: $("#wa-column-one"),.. $state: $("#wa-column-three").. },.. checkDomLoadedInterval,.. animateDurationInMs = 400,.. self = this,.... setState = function (options) {.. el.$state.. .html(options.state.template).. .addClass(options.state.css);.. },.... setMessage = function (options) {.. el.$message.. .html(options.message.text).. el.$messageImage.. .html("&#187;").. },.... setBorder = function () {.. el.$checkList.css({..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-ui-dialog.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3536
                                                                                                                                                                                                                                      Entropy (8bit):4.497799855004851
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:kZGJ5nzQQenlzN1vylhovKKHNLzpCZjeVBXfoifB:kZ8W0v8RHNLlCZjoJfoiJ
                                                                                                                                                                                                                                      MD5:0AB97B4205078265FB7504A5B4BF940D
                                                                                                                                                                                                                                      SHA1:E82B266B7B9D7FAD710434872B539DB6077480C0
                                                                                                                                                                                                                                      SHA-256:94F25897C89EA15E2D506228F120B42BADC12C2049ABC67917791745656B4D08
                                                                                                                                                                                                                                      SHA-512:8A309B6C71A4C0791909DA3DB66A74BA5CEBE4E3A5C15622A93A6580DFF47684729A57D13FB2536D9EEF40A23B17253628D2835D44C5C2A17C10E0D6AE150A75
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Dialog UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.... ui.CheckListDialog = function (options) {.. var animateDuration = 400,.. el = {.. $dialog: $("#wa-dialog").. },.... create = function () {.. clearDialog();.. createHeader();.. createContent();.. createButtons();.. },.... createHeader = function () {.. if (options.header) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-header",.. html: options.header.html,.. tabindex:"0".. }).addClass(options.header.css));.. }.. },.... createContent = function () {.. if (options.content) {.. el.$dialog.append(.. $("<div>", {.. id: "wa-dialog-content",.. html: options.content.html,.. tabindex:"0".. }));.. }.. },.... createButtons = function () {.. if (options.buttons) {.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-utils.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17296
                                                                                                                                                                                                                                      Entropy (8bit):4.480889556991821
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:BZwBjF3z+j5csy4h11lidEaCa3z46U2EW85xFYmah2OY9c8o9OQ/r:WJyj5csy4DIE3mU6URbFYmafj
                                                                                                                                                                                                                                      MD5:D7BDC589D438DF5A5CA04EDADF62EF1E
                                                                                                                                                                                                                                      SHA1:7D4DCA5943FEBF146A58A6EEF80CEC1E354C6E32
                                                                                                                                                                                                                                      SHA-256:1F1C4E7C6EB1149FB9928AB594D343C268CC41191990072A01C560B9B7103E9C
                                                                                                                                                                                                                                      SHA-512:C3FAC1FA9B8627BE71BD1211C6263C6CA90D09C4460A567073D7BB63ECEF21A4FA7E886A8064586DD5AC4ED8E4FB9402DA6E4D7C248DF27DEF3E0C713CEB53D9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_)..};....(function (wa, lr) {.. var util = wa.Utils = wa.Utils || {

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-controller-mwb-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9676
                                                                                                                                                                                                                                      Entropy (8bit):4.9173568605310845
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:O4n4gMn8LeQ1EU/AF5kSS3zwgFdliSQyglzMiqXjAMfxE78:p4gMns48SS3znJiS0miqUMfx7
                                                                                                                                                                                                                                      MD5:01528F3D6F98A8B53CD0A3C5129CB11E
                                                                                                                                                                                                                                      SHA1:0C3AC682FCB9DE055845BCABF2C4921966F47725
                                                                                                                                                                                                                                      SHA-256:C505DD1B8ED7E21CFB1802B30669CC1E0404CFD29CFEEDA61D651CD4EBEC43E6
                                                                                                                                                                                                                                      SHA-512:EC6437BB197E07267B67B398D748DF70406DA5DFF02DA0B64FB5C0EE05E394ABBE5F7849E81FCB753AA0F413127E54B6D77CDA87DDB1E4B16832E97EF258807C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* MWB CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.WEBBOOST).get,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. var self = this;.. var browser = ""; .. var wbShown = "WBShown";.. var wbLastShown = "WBLastShownDate";.. var installDir = "";.. .. this.update = function () {.. _window.ready(async function () {.. var args = JSON.parse(await _external.getArgument("template_args"));.. var isInitial = false;.. browser = await _window.getBrowserType();.. browserCode = await _instrument.getBrowserTypeCode();.. installDir = await _external.getInstallDir();.. if (browser === "FF") {.. wbShown

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-mwb-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2727
                                                                                                                                                                                                                                      Entropy (8bit):5.129074309662149
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3Ox0xsUa3l363kKk+kUTkikfE5h2CYqOcqe5QORDOXGA:32EAqOcq6Qqw
                                                                                                                                                                                                                                      MD5:7422D78DD95DFA6FEBF9BD6790829B50
                                                                                                                                                                                                                                      SHA1:DEE658C5552C743A12D54F8E27AD2ED170D90077
                                                                                                                                                                                                                                      SHA-256:78FC494C1BE062BB335CAF4439BCA8FE1E59FEF7E2C9B91F9FEC054DF034C54C
                                                                                                                                                                                                                                      SHA-512:2F6A398093471E96917F8AE53D3B70EDA1843FCF4F5A8A3456EABBDEDF66919B41E936F0ADADCF4A446EF5AB0CC58ADAB028B008D7D050EE1CD834F39950DF73
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-webboost-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\wa-controller-nps-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (452), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):24334
                                                                                                                                                                                                                                      Entropy (8bit):4.49466804246202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:CYEzX7WKuUDfpG7I85C6ylu6MJcDoGeDbC9dDMQU:3e7Wa806+Q
                                                                                                                                                                                                                                      MD5:B36CB3DF5176263A480D43E4B4959ACE
                                                                                                                                                                                                                                      SHA1:F888A6628F2342EE4DDDA578A9768BD43C3EFDCF
                                                                                                                                                                                                                                      SHA-256:1D191A5516AFFEA85237DE3EC1998666E18BB1B9CD955BE3238A873DD38DB98D
                                                                                                                                                                                                                                      SHA-512:14FBCB79E8E67239726604F6D20C274BEDC7F528C2FA1BA87F8F857A2AA163185610DC9C941D0FC5F0D4DDD9B61FD157BB3BD18E59A10A021B64249A1B0B085C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* NPS CheckList Controller */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.. var browserCode = "(unknown)";.... ui.CheckListController = function () {.. var self = this;.... this.update = function () {.. _window.ready(async function () {.. browserCode = await _instrument.getBrowserTypeCode();.. var args = JSON.parse(await _external.getArgument("template_args"));.. if ((await $(window).height()) >= 630) {.. self[args.commandName]();.. } else {.. _window.close();.. }.. });.. };.... this.showNPSSurvey = async function () {.. var html = "";.. html += " <table style=\"border-collapse:collapse;width:450px; height: auto;font-family:Open Sans; color:#53565A;border:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\wa-nps-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2636
                                                                                                                                                                                                                                      Entropy (8bit):5.12509061942106
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3kx0xsUl363kKk+kUTkikChZhAFqOcqehQORDvM9:O6qOcqiQqDM9
                                                                                                                                                                                                                                      MD5:226A778BA5FAE5B6205318E2C4EED48A
                                                                                                                                                                                                                                      SHA1:2F379A05215C9C707A3FD0FC96A6E4A38C96C631
                                                                                                                                                                                                                                      SHA-256:C442FEAA745966D3F60B801454BD916A692A071DED6A27B2855DCE188912FC96
                                                                                                                                                                                                                                      SHA-512:20CB2D7A78FC603A3E6A58C5D3AA80C763E042D1BEEA05EBBFE62E6A5DED137D242B32A9B199E3329B266107949C6C1029FBC52BEEFFB18D6B95EA889C2A3A5A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\bu

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-coachmark.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1990
                                                                                                                                                                                                                                      Entropy (8bit):5.453293982433959
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UEWZpxtrnPxwqvUw0z5Nqui1l5NqFpW5NqJd5cF5Nqc55N1B+66Q:xsWL7xwdNXWN9NgcXNrDNL+6J
                                                                                                                                                                                                                                      MD5:EB2EDF2F1BAA834ABB9717C26EBD8BB9
                                                                                                                                                                                                                                      SHA1:B44DFE226BC050D12CADA0E015AE673882AFE399
                                                                                                                                                                                                                                      SHA-256:78B96327559957F24F677C9DE51A7D2AEA76A189EDCF0946B9109A5DC3F61D1A
                                                                                                                                                                                                                                      SHA-512:538C302EC25E3521FA74EDB46574CC381CD4D612DFF6A4BF072A7CD98B4C83B5D0F4458CBBDB3152779CB5A59D3512F117152C10FAE7409F63E9DA1F5EE2D9B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....html {...position: absolute;...top: 0;...right: 0;...left:0 !important;..}....body {.. color: #212934;.. line-height: 24px;.. width: 485px;.. height: 250px;..}.....balloon-arrow {.. margin-bottom: -6px;.. background: url('file:///[WA_FILES]/mfw\\packages\\builtin\\balloon-arrow.png') no-repeat 57% 0%;.. height:54px;.. width: 585px;..}....#toast {.. display: flex;.. border-radius: 24px;.. background: white;.. box-sizing: border-box;.. border: 1px solid #ABB2C3;..}..#card_layer {.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\card_bg_image.png');.. width: 150px;.. height: 198px;.. border-radius: 24px 0 0 24px;.. float: left;..}....#card_layer > .tooltip-a {.. margin: 36px 18px 0 10px;.. width: 123px;.. height: 127px;.. background-image: url('file:///[WA_FILES]/

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-coachmark.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1747
                                                                                                                                                                                                                                      Entropy (8bit):5.399701178335765
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:1sYzxdk+IQ0NVMz0+WrVMzQzVMzQXVMzQdk+4VMzlQsoVMzQdk+2jVMC9rap0aqM:uOxZlg+3kKk+kvhD7kCaC9y
                                                                                                                                                                                                                                      MD5:A9E8256A573FB58C772268B57B5ABC02
                                                                                                                                                                                                                                      SHA1:3CC3A5D587F1144D1751AD60EBBFBF7738A44083
                                                                                                                                                                                                                                      SHA-256:5B2168F868D3064082494DEFBECBAC5B412F75577D706C0F4765F7AF8733903B
                                                                                                                                                                                                                                      SHA-512:CE97472308FD57FCAE23463373170A7313F4F6B4F515A35960462C0A9D43386D727AE729E0B9907EAF6B7DDB3041D0EBD769CC45D7ADA91775244A42CF656BD2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\edge_onboarding\\edge-coachmark.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\edge_onboarding\\edge-coachmark.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/telemetry\

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-coachmark.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3120
                                                                                                                                                                                                                                      Entropy (8bit):5.203659322910627
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:uMADc1eQ6rQgiOsbxYuqrHWwXDXjZXGzz:xAS6UdlS6wXDXjZXGzz
                                                                                                                                                                                                                                      MD5:7F24769C85C484BE4A8594089EB439D0
                                                                                                                                                                                                                                      SHA1:DE879BEFAA2353453E1E1C5682BF11F9EB417EE4
                                                                                                                                                                                                                                      SHA-256:214C5A47F2328BA05091FF57E0F966A560816BD1CCE1AA67C7FBB44A0F31EB8A
                                                                                                                                                                                                                                      SHA-512:BFEFA08289A848B2EC33A48456EC5F1CBE6B9CB3F1CEA2900091076DF329484BBD86EA8F7B773D058D14EC420CB905DB3A7DE9F89537D5FA8521036CF5490928
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... ui.accept_extension = function () {... var newToastDimension = {.. width: "585px",.. height: "250px".. };...... var coachmarkType = {.. toolTipa: 2,.. toolTipb: 3.. };.... show = function () {.. chrome.webview.hostObjects.wa_external.log("inside show");.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("inside ready");.. var settings = JSON.parse(await _external.getArgument("overlay_data"));.... if (!settings.cohort) {.. return;.. }.... init(settings.cohort);.... await _window.show();.. window.chrome.webview.postMessage("draw_background");.. await send_onboarding_telemetry("Impression", "ToolTip");.. chrome.webview.hostObjects.wa_external.log("_window.ready end");.. .. });.. },....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2987
                                                                                                                                                                                                                                      Entropy (8bit):5.351261552243215
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UEWZp8xgC9WqJfW05NqIEp5NqIr+5NqUuxkxrxSrMq6x8zOGFqkmiZEqPeIO:xsW0xghYdNYNb0N1uxkxrxSrJ6xRGFq5
                                                                                                                                                                                                                                      MD5:88D3B2A223DC9766B8B36C3C68D251B4
                                                                                                                                                                                                                                      SHA1:A0B662FCF6944A92E53C3C87B85AE5F1D73B5C4D
                                                                                                                                                                                                                                      SHA-256:D327FADDB6EC98B50AA598D368CADA2A51CDC8656F471F72D03ADBC55E937159
                                                                                                                                                                                                                                      SHA-512:741F6CB27BB87BCEEFA8D22D118AFED47C1919C6DFDFFD366B2C0B52DD4D5E198C0D503668EFE3D07997336767DF8988FB12164D746EFFA349FAD48F9860B07D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}....#dialog {.. display: flex;.. width: 761px;.. height: 565px;.. background: #fff;.. border-radius: 24px;.. border:1px solid rgb(0, 0, 0, 0.12);..}..#card_layer {.. background: transparent url('file:///[WA_FILES]/mfw\\packages\\builtin\\women-on-laptop-features.png') no-repeat 0% 100%;.. width: 276px;.. border-radius:24px 0 0 24px;..}.. ..#progress {.. width: 173px;.. height: 173px;.. margin: 52px;.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\progress_0.png');..}....#progress.enabled{.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\progress_1.png');..}....#description_layer {.. padding: 35px;..}..#logo {.. background-image: url('file:///[WA_FILES]/mfw\\packages\\builtin\\mcafee-logo-1.png');..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2219
                                                                                                                                                                                                                                      Entropy (8bit):5.306608102736013
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:5srbbqNax+k+CQ0NVMzWWrVMzLKWrVMzQ0VMzQeVMzQ+k+2VMzlQsoVMzQdk+2jo:qaaxily363k3k5kEhD7kCaCNcCgSTPy
                                                                                                                                                                                                                                      MD5:4E2D61BC1BCE66111BCBC8EDF39844A5
                                                                                                                                                                                                                                      SHA1:9A89E0987E4D2D08584ED915C506C72E649707C8
                                                                                                                                                                                                                                      SHA-256:9B16BA12BF54FB940546464A6C2890659E70973F5DA4D6E0AB3F3FEC4C63F877
                                                                                                                                                                                                                                      SHA-512:17518B017C5CDAD79F4186AADD8167FB2C8956EA9FF37F0516FCF6D4D990D99262FD59B79A3E80D0254FCEA8F7F74F91D57E51F7639A54452100257C42B4DD43
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/mfw\\packages_web_view\\webadvisor\\edge_onboarding\\edge-ext-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="fi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge-ext-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4043
                                                                                                                                                                                                                                      Entropy (8bit):5.157709269203089
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:lAFMuLlxkllDE3zG6lsg9EYcvrEPwSYlZXoPq:lAWuLlxkllDE3zG6ls5hrEulZXaq
                                                                                                                                                                                                                                      MD5:305E4A878E0ACA697A85675A427BD235
                                                                                                                                                                                                                                      SHA1:F70CFB677050DCFFEAE3CE53702AACF2EF4FB299
                                                                                                                                                                                                                                      SHA-256:C0DAFD1A4C5222AB87330998F70A2DC99643509D5115F8B1133F63609AA00EA2
                                                                                                                                                                                                                                      SHA-512:4A4512DBAEB5E06E02C5B60584D041DD147D16D83791DEB338209DF203816261835A4F23F71426212C923C8E3B4A051C64A51C2E7BB757D67CFA49F05978C9A0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {... ... var newToastDimension = {.. width: "761px",.. height: "565px".. };..... var $el = {.. progressPic: $("#progress"),.. checkboxInput: $("#set-web-protection"),.. title: $("#title"),.. desc: $("#content p.desc"),.. featureName: $("#feature_name"),.. featureType: $("#feature_type span"),.. featureDesc: $("#feature_desc"),.. doneButton: $("#done_btn").. };.... var stringMap = { // check for correct string.. InfoTitle: "SEARCH_TOAST_TOGGLE_VARIANT_1_HEADER",.. InfoText: "SEARCH_TOAST_TOGGLE_VARIANT_1_INFO",.. FeatureName: "SEARCH_TOAST_TOGGLE_FEATURE_1_NAME",.. FeatureDesc: "SEARCH_TOAST_TOGGLE_FEATURE_1_DESC",.. FreeLabel: "SEARCH_TOAST_TOGGLE_FREE_LABEL",.. ButtonDone: "SEARCH_TOAST_TOGGLE_BUTTON_SS_PROTECTED"..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_onboarding\edge_ob_telemetry.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):369
                                                                                                                                                                                                                                      Entropy (8bit):5.417141120443004
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:2EmuogRreo9LClyqZy+cPupMrX9ElbFmFvH5XCgyoXzXf3BnRkXYJU6hkKkckDJ0:2woUrXAyXprOlJmVJbP5KXYJNQOG6
                                                                                                                                                                                                                                      MD5:801817972C6F084A79B4064F89B04CE2
                                                                                                                                                                                                                                      SHA1:AE9DA114866699BC2C9ABC34D550E9882CC73772
                                                                                                                                                                                                                                      SHA-256:D7DBF4FE76374CE5B88CD6B521D536F9FAC02A5E788BFB6D63095E2AB939BC06
                                                                                                                                                                                                                                      SHA-512:6546431F0DDAD4DD6776FF445D4C78546E0F1D95F3AA9D944B4EF829F6778CEE99EC1102F247071869C4B5F51D2C70BC5D9883293B2563FED08FC53D47B1FAB0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:const send_onboarding_telemetry = async function (action, ui_type) {.. const event_obj = new EdgeOnboarding().action_type(action).type(ui_type).Serialize();.. await window.WebAdvisor.Utils.Instrument.sendTelemetryEvent(event_obj);..}..//08EC8063108F5EB45D8F002B59813DCADFD21B1689D170117BCBCC7870A548FF529C61B3A4008E1A5F3728B850CAC23B77C7BF4454A3B1B31127755B9C0250A8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1497
                                                                                                                                                                                                                                      Entropy (8bit):5.1680557791116355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UEWZR78xQ/0elV7k1Ze+fkMFE1g60q30iTxhxs4P0Fu0xx0j000sT06bw0Sa:xmp5UEWZp8xo0uOuHMFYg60q30Mx70Fi
                                                                                                                                                                                                                                      MD5:D3248BB45A93E1AF56514F3B1FE847F5
                                                                                                                                                                                                                                      SHA1:0CE2AD1D8B3DAA528ECFB6165E7B85EAD1C03B11
                                                                                                                                                                                                                                      SHA-256:97DCC7385DC27E8BD8DFCC97CBEC3702C53A3567F8E7D507426A14798D8FA9AD
                                                                                                                                                                                                                                      SHA-512:A3CE254CB550DCDD14802360477C0F971E64EC84A33366B35CA2ACEE2CAC649B62711AE410642DED23C869A8D1B463A0A2E8FA13F6FB4129DE6BB7D28B0050E1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}.....main-container{.. width: 656px;.. height: 392px;.. flex-shrink: 0;.. display: flex;.. flex-direction: column;.. position: fixed;.. bottom:0;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.. align-items: center;.. padding: 0px 35px;.. border: 1px solid #B2B2B2;..}....[class*="flex-item-"] {.. display: flex;.. align-self: center;..}.....main-container .flex-item-1{.. justify-content: flex-start;.. align-self: flex-start;.. margin-top: 32px;..}.....main-container .flex-item-2 p{.. color: #212934;.. font-size: 20px;.. font-style: normal;.. font-weight: 700;.. line-height: 28px;.. margin-top: 14px;..}.....main-container .flex-item-3{.. margin-top: 34px;..}.....main-container .flex-item-4 p{.. margin-top: 32p

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3191
                                                                                                                                                                                                                                      Entropy (8bit):5.32780796167714
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:wjRaxDlg+3kKk+kgkah2Cm5wEsCILQq5wEsCI2A5wEsCIIK1bY8:wjTdsT/dsTdsAD8
                                                                                                                                                                                                                                      MD5:B82D3682B6F5308261493430D1593AC3
                                                                                                                                                                                                                                      SHA1:364A8DBF50DDC8CEAA85ACECB934C83D55D7F5CC
                                                                                                                                                                                                                                      SHA-256:774F2553B59F8788AE275EE3E4EA5F546C179A0154A5DF507C7C8FBA82304586
                                                                                                                                                                                                                                      SHA-512:EA374C683751D388D6697D7A3B7D5EF373F85811420E75CE5B28668EDFD220C2D0093042CD313A8BE0EB2C44315444E6B9640ECD55194AC94925D4B467F11753
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\edge_search\\edge_search_ext_coachmark.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.js"><

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\edge_search\edge_search_ext_coachmark.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4447
                                                                                                                                                                                                                                      Entropy (8bit):4.888905733808312
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xe04JN7xWXXZ8NQK8E3NQKbk/5XNmsN4qBNINHN4qPdFe2FX1YYtuK1H6ItuNn1D:EPoHvOGX67qPqP2k1xafsmWa6Qiah6rO
                                                                                                                                                                                                                                      MD5:CD30752F47FC420DE12612756E942473
                                                                                                                                                                                                                                      SHA1:C12EB5618AC222098D7589706FCDF26C18048B3C
                                                                                                                                                                                                                                      SHA-256:39190A440A75435388078DDCFA121C521995FF738025DD9D289DD87D703E348B
                                                                                                                                                                                                                                      SHA-512:7BAB53B80FA0D291030D520FC9F3060D5C4AC4B6180D81983364FA8C9423569AFC5B62035678F1AFFE58B477C0E458C6C9CF96D3AF8897CD3AF5C9B3FCB03162
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch edge monetize phase -2 */..(function (wa,$) {.. let ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 392;.. ui.SecureSearchTooltip = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. .. _window.setWidth("656");.. _window.setHeight(windowHeight.toString());.. .. let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.OVERLAY).get;.. .... chrome.webview.hostObjects.wa_external.log("inside ready");.... var json_to_parse = await _external.getArgument("overlay_data");.... chrome.webview.hostObjects.wa_external.log("after getting overlay data");.... if (!json_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-overlay.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1839
                                                                                                                                                                                                                                      Entropy (8bit):5.465981594523217
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+swDxNxulQeNVMr0+WrVMrLKWrVMrQzVMrQXVMrQdpVMrlANVMCrNM/QoguKORML:NOxNx1/Y+3i3cKc+cGpJCEQgKy4SqyO
                                                                                                                                                                                                                                      MD5:F428431EE41BF998512A71594315A827
                                                                                                                                                                                                                                      SHA1:12AA1E7862E8F0896A8F5DCBCF734095010C6B87
                                                                                                                                                                                                                                      SHA-256:313AFFD1EAA2EAB32D632A4B77A66FA7ED5231E9580245DC0878D5CBC158CF70
                                                                                                                                                                                                                                      SHA-512:EB569A4B665975F47E03CD1F4636088D2531D79C464FCADCC6BB5999CB5D8A561B788CE3A692480EFD92FA32A181F28252371162AA359B668C54F18E542B06C8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\new-tab-overlay.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-overlay.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4434
                                                                                                                                                                                                                                      Entropy (8bit):5.0619550875446455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:T0AmdonK4uoNkCsVgV1PixEeB0NufP9SdaQbXk2H:AATK4bNrAg/jeCQS9bX9
                                                                                                                                                                                                                                      MD5:8C44F3A5D1F2C5A0FD89C6447BBBFE51
                                                                                                                                                                                                                                      SHA1:F1A6E3CAE873BAFE530A7BCF64C254CDD4769F6F
                                                                                                                                                                                                                                      SHA-256:887DC0B58A17B74743A43A6038E119AB65177031DFDCD888B2D3CB7FC7A246FC
                                                                                                                                                                                                                                      SHA-512:A9C1BA4288D75D1F0C1C888AEA9C48C30B80951AE49674B0F6788E315164E39605324D92D1E19EF431377855B9C8D63EEFF0F9E9C12817A265B598EF48AB0E68
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {}),.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. content1: $("#wa-dialog-balloon-content-1"),.. content2: $("#wa-dialog-balloon-content-2"),.. arrow: $(".balloon-chevron"),.. },.... show = function () {.. _window.ready(function () {.. var settings = JSON.parse(_external.getArgument("overlay_data"));.. var overlayType = Number(settings["overlay_type"]);.. var extensionType = Number(settings["extension_type"]);.. .. // Polyfill of isNaN for IE version < 12;.. Number.isNaN = Number.isNaN || function isNaN(input) {.. return typeof input === "number" && input !== input;.. };.... // Validate toastCount is valid;.. if (Number.isNaN(overlayType) || Number.isNaN(extensionType)) {.. _window.clo

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-toasts.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2295
                                                                                                                                                                                                                                      Entropy (8bit):5.353370396572987
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:NOxNxj/U3i3cKc+ccWCpnHCFAf2PKqAqIMImqIusux:chkiJJmz5ux
                                                                                                                                                                                                                                      MD5:FFAE7F223EDADB44303A8E4D9DD882FA
                                                                                                                                                                                                                                      SHA1:7B264C8AD82401D716857B4EFFEE4E30F3E53395
                                                                                                                                                                                                                                      SHA-256:3E06B0F26AAE778DB53448290B3FCD5DCCAC198266B45404B05EABC6A2FC5C42
                                                                                                                                                                                                                                      SHA-512:2B13CCB03A8BD3CA493913FC03F1A337AD948C657BD4170DCB08B45405ABFFB240A3E0A2226AFA1A7BB66FAD4E1C2BBEE3A1BEC6A4CC396A41BAA208932CC05E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\new-tab-toasts.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\new-tab-res-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="fi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\new-tab-toasts.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4089
                                                                                                                                                                                                                                      Entropy (8bit):5.1348183661160425
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:n3AXKffHguIKz1hauWSQ0RVflDh84bXkgX:3AogosXiVfVh84bXV
                                                                                                                                                                                                                                      MD5:196B135F07AA22FBB15A8508AED71CDC
                                                                                                                                                                                                                                      SHA1:C468F1A87C388E7E017B31ABB1FFB653B7AD10DA
                                                                                                                                                                                                                                      SHA-256:52F91D4BAB84DF1D662DAC2C72052A1411EAD487E8149EA701B4D10F673F4EEB
                                                                                                                                                                                                                                      SHA-512:99BD16F46F3D9E8EF306444E5BDE2DD3121891BCAF438F1F6FDA89AF834A277DD2B17C32254922FAE29F107C4C773A72EC6CBDDAF4D1903D8223F3956DE1647F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {});.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. balloonCard: $("#balloon__card"),.. headerText: $("#content__text-header"),.. contentText: $("#content__text-description"),.. acceptBtn: $("#content__actions-accept"),.. declineBtn: $("#content__actions-decline"),.. };.... show = function () {.. _window.ready(function () {.. var payload = JSON.parse(_external.getArgument("overlay_data"));.. init(payload);.... _window.show();.. });.. },.... init = function (payload) {.. var lang = wa.Utils.Lang(wa.Utils.Lang.ResType.NEW_TAB_TOAST).get;.. var toastCount = Number(payload["toast_count"]);.... // Polyfill of isNaN for

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1604
                                                                                                                                                                                                                                      Entropy (8bit):5.262918468096288
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:rp5UEWZp8xw942MDIjLMI6dSEkf3cdbOFv:LW0xwa2eIjLd6dSX3cdbOp
                                                                                                                                                                                                                                      MD5:439FF5DF150153E5A1858D146E1BF41A
                                                                                                                                                                                                                                      SHA1:444267714C2E2D17CE7EF6D017782C65EF4AB3FA
                                                                                                                                                                                                                                      SHA-256:8B2B3C43628D8075875C61F8CCB9AF1CB25F82C8E057B1F597B8D443F572CFA8
                                                                                                                                                                                                                                      SHA-512:BAB1FC5E849C1CAF923811703528CD1E9310C7148DEFA30504AB27A95500CE97558FC79E0F2318AEFF10C5E06C92CCD2DD7E514C966DE3DB3EA1DECE915E9AA2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}....#wa_score_toast_confirm.main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.... width: 365px;.. height: 326px;.. align-items: center;.. flex-direction: column;.. flex:1;..}..[class*="flex-item-"] {.. display: flex;.. width: 311px;.. justify-content: center;..}..#wa_score_toast_confirm .flex-item-1{.. justify-content: flex-end;.. width: 100%;..}....#wa_score_toast_confirm .flex-item-1 img{.. width: 13px;.. height: 13px;.. margin-top: 16px;.. margin-right: 32px;.. cursor: pointer;..}....#wa_score_toast_confirm .flex-item-2{.. margin-top: 17px;..}....#wa_score_toast_confirm .flex-item-2 h1{.. color: #383434;.. font-weig

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2144
                                                                                                                                                                                                                                      Entropy (8bit):5.416061725646171
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:JjRax0x3m363kKk+k3shFhiKC+yxi8mG6yMm+A7zx:JAm2ie6yGa
                                                                                                                                                                                                                                      MD5:015AB91EB06DB5AA9D9CAC8F4D43A24A
                                                                                                                                                                                                                                      SHA1:52C707275B73B75CE56B507BF1E9223E5735BE50
                                                                                                                                                                                                                                      SHA-256:F9AB057A883A9C6DCBAA906339A4BF5423C8E0336D27783743F704F9DEBFA852
                                                                                                                                                                                                                                      SHA-512:E69E64D078A140F7CA864EC716AE21C60898FE1C37F8F10AC0B94094FA25EC754BAA0A6D72FC719DB47747020274F1B2631BB7724031567C3D20A5B10157B71F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-confirm.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <s

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-confirm.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:assembler source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2765
                                                                                                                                                                                                                                      Entropy (8bit):5.074954727516563
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Yj4Ji7xWXXRMNQK84lhNQK23NfGTNkAYi/zNQmnOtw/7tT/Bztn6TYOYEfNgpbjY:YhoH/C0Lln8qmncw/RT//D7EcPcvgd5g
                                                                                                                                                                                                                                      MD5:BEE2A9AB120F04B5815F05AAEE963C19
                                                                                                                                                                                                                                      SHA1:20053CCB54001D54E5CCFB200EA987B27D85BCA9
                                                                                                                                                                                                                                      SHA-256:8120D2F7B9B0DA3140AE0304181C0853D1530ED889912A91E44CFC024DD3C999
                                                                                                                                                                                                                                      SHA-512:1878959248EB14CB52DF564610A895F7E410E5F1D722E2AD43492E09F82DB69A302761CDCB4C5A0F0AEA310388167A81DEAAB5B67E110E38EA4DBEBF42C3AC2A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window;.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.... ui.SecureSearchToast = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {... .. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.... _window.setWidth("365");.. _window.setHeight("326");.. chrome.webview.hostObjects.wa_external.SetDraggableOffset(20, 50);.... window.addEventListener("resize", (event) => {.. chrome.webview.hostObjects.wa_external.log("draw from resize handler");.. window.chrome.webview.postMessage("draw_background");.. });.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webview.hostObjects

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6113
                                                                                                                                                                                                                                      Entropy (8bit):4.974400810754339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:xkWsYW9FbqA1eR0/DJgltvLtDmwJVNUNYNnYFaYoty55u7Y:xkWXWbqA3FgltvL5mqVNUCC3oku7Y
                                                                                                                                                                                                                                      MD5:290F3D6479ACBBE88DB79A1BF3DBB160
                                                                                                                                                                                                                                      SHA1:847ECB66686924790D3709A7C055AE14B5B30483
                                                                                                                                                                                                                                      SHA-256:8AD189406B63222B1C9D403F1F6E52215B7BF15466AF3F4EE5DA0BA9D36D29A6
                                                                                                                                                                                                                                      SHA-512:D432095136F1C7DED06FD4953BC74229241546D1CCBB1925D8FFF0732289509413DB79407D465C6B1E76512F77C8BBDC4B2B732A72F33C33176A14DD8AA9CDEC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;.. }.. .. body {.. color: #212934;.. line-height: 24px;.. }.. .. #wa_score_toast_increase.main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.. .. width: 761px;.. height: 283px;.. align-items: center;.. }.. .. [class*="flex-item-"] {.. display: flex;.. height: 100%;.. }.. .. #wa_score_toast_increase .flex-item-1{.. display: flex;.. width: 276px;.. justify-content: center;.. background-image: url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_increase_bg_left.png);.. flex-direction: column;.. align-items: center;.. }.. .. #wa_score_toast_increase .score-status{.. width: 205px;.. height: 60px;.. ba

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2770
                                                                                                                                                                                                                                      Entropy (8bit):5.2936838336178536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:JjRax0x3i3363kKk+kgk3ithFhiKC95ix8LStjLRjxk+ann43iAR:JseqjiHjtjBinY
                                                                                                                                                                                                                                      MD5:5EEE9EF93A59076585970A590542FEFF
                                                                                                                                                                                                                                      SHA1:5D9EC0E5E394D12ECC79166E6E1AEFF86AC00B6F
                                                                                                                                                                                                                                      SHA-256:1604FCA3DE43E3799FB8BD71FD008410E8983B0940F52AD171EA7ECD37E580F6
                                                                                                                                                                                                                                      SHA-512:D540AEBD5922587B23185F9CEC3FBD19628817F631F233CAB3E65C9C10160876A2F3F3EA6AD1C0DD872F6862EF348914DC0F18437EFC376F3E420E59DEB5C283
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-increase.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-increase.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:assembler source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5026
                                                                                                                                                                                                                                      Entropy (8bit):4.955118503603607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YuoHAOGj0xqGgrVTWm03Sk457EcPQvNQoxVRzZgC:JX4k7RTWmp57EcPQvN5/RzeC
                                                                                                                                                                                                                                      MD5:0F24B27A49EE1FB03B060E0B7E1985D6
                                                                                                                                                                                                                                      SHA1:CD1F02C24140D396BB78FC8C46D1C14651E36DFE
                                                                                                                                                                                                                                      SHA-256:0CB8661D1BD9071BD601B5C8BA4D55B26DA6B3E990A1A8D81A5D2C6B76C6CCDD
                                                                                                                                                                                                                                      SHA-512:0D4F66A214CB363303AE4DD0D559923DAC2CF146192FCBFF5ADEAA0ABB08A0F7BADAC1B1497B31C74BC3D333D25317782962A1E01CCCE463F10AAFB290224254
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 283;.. ui.SecureSearchToast = function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. show = function () {.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("ready: begin");.. .. _window.setWidth("761");.. _window.setHeight(windowHeight.toString());.. .. var toast_data_string = await _external.getArgument("toast_data");//json with score.. chrome.webview.hostObjects.wa_external.log("ready: toast data is " + toast_data_string);.. var payload = JSON.parse(toast_data_string);.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webview.hostO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8459
                                                                                                                                                                                                                                      Entropy (8bit):5.154566859405699
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:OW/al9Sqd0++Jx0ZBSaLR5YDm9eHnqWNRX/:OA+AaLR6HnqWN5
                                                                                                                                                                                                                                      MD5:BC356AB30B66E093B0BE7917FC6A7B3B
                                                                                                                                                                                                                                      SHA1:440521B8730E1488A88061DC0062197F5C32C683
                                                                                                                                                                                                                                      SHA-256:4FCA469CB603F4A0C4FFBF7D30D55B6BCFB68292704F72FA4B89C3938C4E3020
                                                                                                                                                                                                                                      SHA-512:2F0A318D92BA1899A7E6CEC7EEFDC6F1AFFC270B67EC69285957E61C38E663A4561624F477ACC9A2B0156C1210B690FCE04D4A1AD6503E9EB9B02CCDCD568E47
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* version 2 3 */..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}.....main-container{.. display: flex;.. position: fixed;.. bottom:0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;.... width: 761px;.. height: 565px;..}.....left-container{.. width: 276px;.. height: 100%;.. background-color: #F5F6FA;....}...right-container{.. width: 484px;.. height: 100%;..}.....inner-div{.. width: 100%;.. height: 100%;.. background:url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_main_bg.png);.. display: flex;.. flex-direction: column;.. align-items:center;..}.....variant_2_bg{.. background:url(file:///[WA_FILES]/MFW/packages\\builtin\\wa_score_toast_main_bg_v2.png);..}.....inner-div > div{.. display: flex;.. width: 100%;.. align-it

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4418
                                                                                                                                                                                                                                      Entropy (8bit):5.036576331067931
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:JjRax0x3/363kKk+kgk31hHhiKCOGmBmKbTlVRWJ0IRVXhTAhc9CRj7SO1CCR21M:J+xmfb3Re0IPhTigCx7SOgCgKF
                                                                                                                                                                                                                                      MD5:4C524597D97FE10760CE23E6FC2A8267
                                                                                                                                                                                                                                      SHA1:A08E7BAD91210E850C086E2DD2E4FB49FE77FFF9
                                                                                                                                                                                                                                      SHA-256:3899AA66F66FAD00FDC573356D9B37B9C5CC864807A03E5CC21041933ABD6C97
                                                                                                                                                                                                                                      SHA-512:F68CDB978BC6BF6CFF334D721A6CB18EE44B5656C88FDD01AD7EF2E131066CDF66E2F614EBE5CDD84F45D9A5474FB83D512C327B905DE45FE302D568A5F7BD72
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>SecureSearch Score Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap" rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\score-toast-ui\\wa-score-toast-main.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-score-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <scri

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\score-toast-ui\wa-score-toast-main.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8673
                                                                                                                                                                                                                                      Entropy (8bit):5.0198551982962245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:N9T16teT2I8GkkA7KQ23LGhmPvHVe7Ela7MLuLULxLQLnLJE70:N9T16teT2I83kA7KQ6LGhmPvHVe7FMqh
                                                                                                                                                                                                                                      MD5:34CDE33335C79A1E32DAA62169534FF1
                                                                                                                                                                                                                                      SHA1:5145B0536DFE9E7C5CDB0C336EAA579272F299A6
                                                                                                                                                                                                                                      SHA-256:DEB3271DB9D1A06516D4EEDDC450EECD9DF8B0A4C6338018004E08380EECE4D2
                                                                                                                                                                                                                                      SHA-512:E9FD1EA8E105B7CD36A6F6F552E3E4FDCF568AFB38162B0588FFEC952AD91016C696AE2FDE2D1932D2C469510E7268D183B958A03616BA084F9F9C66A23AE50D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Score Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window;.. _external = wa.Utils.External;.... var browserCode = "(unknown)";.. var provider = "Yahoo";.. var windowHeight = 565;.. ui.SecureSearchToast = function () {.... show = function () {.. _window.ready(async function () {.... chrome.webview.hostObjects.wa_external.log("ready: begin");.... var toast_data_string = await _external.getArgument("toast_data");//this is json passed from logic with cohort and score.. .. chrome.webview.hostObjects.wa_external.log("ready: toast data is " + toast_data_string);.... var payload = JSON.parse(toast_data_string);.... _window.setWidth("761");.. _window.setHeight(windowHeight.toString());.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... chrome.webvi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1454
                                                                                                                                                                                                                                      Entropy (8bit):5.24591805737482
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZRqxQpxVYHhLcY39U0M+mtFl2zZRVchpKIjvVCfnvv/UQsUMqdnDsK5:xmp5UoZwxDHF3uBjFloZKY+YfnHcQevy
                                                                                                                                                                                                                                      MD5:9947BCD2630B5E879AB269045822F018
                                                                                                                                                                                                                                      SHA1:65F647CAD10AB11518FC1026886DE5C3D3064A57
                                                                                                                                                                                                                                      SHA-256:F6BA409C3D93B510C34B291B0C50BAB90C4CD566F2D6E0656B0E7A8455142FD4
                                                                                                                                                                                                                                      SHA-512:54370957642D14237E1918091FCA28C1444E3BBEE4070ABB3342CA481DA2F37BB6DC577534F3FBD0B9269D51FE8E49ED8B593BF433098DDE88F762DE69458E9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container */...balloon {.. overflow: hidden;..}.....balloon__card {.. position: absolute;.. right: 55px;.. overflow: hidden;.. box-sizing: border-box;.. background-color: #FFF;.. border: 1px solid #E6E9F0;.. border-radius: 12px;.. height: 200px;.. width: 328px;..}.....card__content::after {.. content: ' ';.. clear: both;..}.....card__content {.. padding: 16px;.. height: 100%;..}.....content__header #wa-logo {.. height: 13px;.. position: relative;.. top: 2px;..}.....content__header #close-icon {.. float: right;.. cursor: pointer;..}.....content__text {.. margin-top: 12px;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-weight: normal;.. font-size: 14px;.. line-height: 20px;.. color: #5A6175;..}.....content__text:last-child {..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2054
                                                                                                                                                                                                                                      Entropy (8bit):5.4033231852984045
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+s8xMxdARQXNVMr0+WrVMrLKWrVMrQzVMrQXVMrQdmVMrlANVMCuedmlOK+uEra5:N8xMxtUY+3i3cKc+cjpJCX6OK+punGV8
                                                                                                                                                                                                                                      MD5:E56175F83354180DF530F286C5AEEAB1
                                                                                                                                                                                                                                      SHA1:F8182B3191F3F0A011BD3C0AFEDDF3CDAD7D15A9
                                                                                                                                                                                                                                      SHA-256:8149566911CA065A5F9D1A0B8D3810F2800145255975458ACC7BCB2FF12BBB0D
                                                                                                                                                                                                                                      SHA-512:35FDDCB72EBCBD6E8E3FC44423433C535F0364D8C16EB5D2B0D07BC8E1CCDFEB3F677F8DD2EBC8629F96D1D734DC9F0DED571FFDCCB1863BB069FAC4CD1A038B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ch-store-overlay-ui.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ch-store-overlay-ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3609
                                                                                                                                                                                                                                      Entropy (8bit):5.138883412600274
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cMA4qOTkC/pV9WqxEz0TnMTJo1CV9WE6KGXwZ:vAUr/pubwT8uCu1KGXwZ
                                                                                                                                                                                                                                      MD5:F85038F00A727AC02818213E8B148281
                                                                                                                                                                                                                                      SHA1:A16850B771C3B632E99CE252B9090B1AE289581A
                                                                                                                                                                                                                                      SHA-256:907CBB86E26AD171968BF27A08F1C09582368A75C10F50084B0F5EF6F2B33D9B
                                                                                                                                                                                                                                      SHA-512:8085FA113F65AFAE0CCC5191553289D981C53978CE0D9E95C80F143CC3BE5D93ABCEFB1241E640AE61D5A854DB8A27C072C7165EB1B5D3B8FA7D3BA49DEFB552
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var $el = {.. contentText1: $("#content__text-1"),.. contentText2: $("#content__text-2"),.. closeIcon: $("#close-icon"),.. };.... let browserCode = "(unknown)";.... show = async function () {.. init();.... _window.show();.... browserCode = await _instrument.getBrowserTypeCode();.. // Send telemetry for dialog balloon showed.. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(browserCode).balloonType("WAOverlayOnboardingOpenExtensionPage").Serialize();.. _instrument.sendTelemetryEvent(telemetryEvent);.... //Send Telemetry 3.0 for dialog balloon.. var screen_flow = browserCode == 'FF' ? 'firefox' : 'introduction';.. var hit_screen_id = browserCod

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-checklist.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2823
                                                                                                                                                                                                                                      Entropy (8bit):5.165745326024714
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3kx0xsUl363kKk+kUTkikthkxhlhPhOCCv/enQORDAfVSB:OP8v/WQqUf0
                                                                                                                                                                                                                                      MD5:889D072565412C576AD60B5375272473
                                                                                                                                                                                                                                      SHA1:2D36DAAA7C202F67F4C37B0CCE91BE0E095A2CA9
                                                                                                                                                                                                                                      SHA-256:17703CDCB2E0CFEF1F70C65581CECF4898D1103DA5AF19EC67809596B0B9DF27
                                                                                                                                                                                                                                      SHA-512:29D1B6F83A7F2C9CFA974AE99987EECB5CDCA2650D20A41BCD41D0E5D1FFD5077F247A0A0DE967C01253E2B5813B9184EE6D5A1BF96880DA38F5C156ED11C608
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-checklist.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\bu

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-controller-checklist.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (333), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19476
                                                                                                                                                                                                                                      Entropy (8bit):4.751230911570333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:cD7PaE5bXIDT2o1Cm+kYNTtazx/6x5o+72vY4jQWvHDsRFLFmZlP2Su:Y7PaE5bWT2o1CzksTcY5o+7GREjYZ5S
                                                                                                                                                                                                                                      MD5:02358545377B8B456A32031C47CCE72F
                                                                                                                                                                                                                                      SHA1:A35997D408567AD0BCA133C22A39C0CD712A2395
                                                                                                                                                                                                                                      SHA-256:625856A571BB6A04B54ACEA683948DEA1DD43A3127C9AE68C176FFD33BA65916
                                                                                                                                                                                                                                      SHA-512:A8953AC7B9EFF14E0C5827BCB06823404CACEF8E73323B312798261279C318DA51C31946AB25FF8F4139DD777BFCB39FB941951C330B7127B1FF4E0B860C084C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* CheckList Controller */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _l10n = wa.Utils.Lang().checkList(),.. _tmpl = wa.UI.CheckList.templates,.. _core = wa.Core,.. _window = _core.Window,.. _checkList = _core.CheckList;.... ui.CheckListController = function () {.. let threatStateCss = "threat",.. infoStateCss = "info",.. greenStateCss = "green",.. waitImage = "file:///[WA_FILES]/MFW/packages\\builtin\\white_timer.png",.. alertImage = "file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-checklist-risk.png",.. ignore = _l10n("IGNORE"),.. fixNow = _l10n("FIX_NOW"),.. defaultImageCss = "wa-state-img",.. alertImageCss = "wa-state-img-threat",.. keyMap = { "NUW": "WelcomeMessage", "UUW": "UpdateMessage", "CLW": "CryptoLearnWelcome" },.. self = this;.. let browserCode ="(unknown)";.... this.update = fu

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):772
                                                                                                                                                                                                                                      Entropy (8bit):5.273790105266564
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:xmp5UoZRqC3dDUUhiLKyFc43bZnoBngix:xmp5UoZwkxQ3ShBg+
                                                                                                                                                                                                                                      MD5:2A18B76ABE7BA857FFFD71F1E6EF7EAB
                                                                                                                                                                                                                                      SHA1:F67137802D7B2F33F082463BB3EC3B877AC4DE03
                                                                                                                                                                                                                                      SHA-256:F39CF4BF2A67FC71522ADE895C96043C4BB579B2204222BC27AD9D634E4A24BC
                                                                                                                                                                                                                                      SHA-512:CCBDCC0B0201CC76A32BB12B0C02A8104D431CC818CAF3F259D896F25A481F10E61DAD6C0163CDDD82CC90537E51FDDFFF827A96AAF4A33BDE6E701E644B90D8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #454545;.. line-height: 24px;..}.....balloon-arrow {.. margin-bottom: -6px;.. text-align: center;..}.....balloon-main {.. box-sizing: border-box;.. background-color: #FFF;.. border: 2px solid #E6E9F0;.. border-radius: 24px;.. padding: 24px;..}.....enable-ext-btn {.. background-color: #4989EB;.. border-radius: 4px;.. border: 1px solid #EFEFEF;.. color: #FFF;.. cursor: pointer;.. display: inline-block;.. font-weight: 600;.. padding: 2px 8px;..}..//4E48995CDFA9B08B2A839A7C17D589D77E3EC0DD3FADA9A48AFDF2ED741B92822DC1F2D250D2B099953186247A945145F02E720E8B85DF37BD6097EEFECE7477++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dialog-balloon.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1945
                                                                                                                                                                                                                                      Entropy (8bit):5.434187038880688
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:NOxMxG75Y3i3cKc+cdNpJCzd+TQgT+yvgXcn:w7aAMTQI+ns
                                                                                                                                                                                                                                      MD5:F868BB08F22DB29530B8E73E07388230
                                                                                                                                                                                                                                      SHA1:7C96855C34DDDB94834DF6DF948238D4AA8225D0
                                                                                                                                                                                                                                      SHA-256:4FA314BC8841562C129FE700D12C4D36081EB37DBB77C1181239217304CEBC22
                                                                                                                                                                                                                                      SHA-512:6F3EFB7F0FEC8F2BC15B654FD51D8611D01DC69D6498C499046B58394EA2C87059162C50A9D01913016FCBC4173F1E1CCECB606956FC69275C4A260F085D34A0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-dialog-balloon.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-dialog-balloon-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-dialog-balloon.js"></script>.. <scrip

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dwtoast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1617
                                                                                                                                                                                                                                      Entropy (8bit):5.2771505087232216
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:V2skx0xutt5WrVMzLKWrVMzQzVMzQXVMzQdGVMC8jIYcaNJ89T:3kx0xi7363kKk+knC8jKaNQ
                                                                                                                                                                                                                                      MD5:6FD4D0BA7A717161A260B8A674A8CC96
                                                                                                                                                                                                                                      SHA1:C83FB3197E7406790E20ACFA2DA29C8E58A7C683
                                                                                                                                                                                                                                      SHA-256:955012511DA9CE9BDE539F6421F397B04B9DD45C2D46A1E7FDA3C77E057FB11A
                                                                                                                                                                                                                                      SHA-512:E5F2BD0845CED4A84FE948992AC08907B9577AAEECCF0442445E0A906BA78AFE059273A1746D0E4E0FF3FEFCD91DDEC0E63CFBDB88F5651FF7A07ACFA408E7B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-dwtoast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-checklist-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-dwtoast.js"></script>..</head>..<body>.. <div id="wa-dw-toast">.. <div class="heade

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ext-install-toast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2608
                                                                                                                                                                                                                                      Entropy (8bit):5.227789851308056
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:7kxtxC363kKk+knh88CVr/R+5a5beIwEeIYOzN:U/Fb1DR
                                                                                                                                                                                                                                      MD5:CE85459872AC8BC2FA48DE062EA5D7C2
                                                                                                                                                                                                                                      SHA1:712BE0AA2DF90C4308F41A6E4CA61FBEF77F3CE2
                                                                                                                                                                                                                                      SHA-256:67BAAD77BC312B0752329E9535699284C7735638CAAE4561358EC38296B84CA0
                                                                                                                                                                                                                                      SHA-512:8D4166D6293D4B89E00D639C4DAAC1E266CCDFD1682C659F33D8F9440D5E7BAB43E5DB26D52FE2D2B709371A4B8F09ACB029C331C29EABED7B937F9EB1DD9A12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Download Extension Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-ext-install-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-ext-install-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ext-install-toast.js"></script>.. <script type="text/javascript" src="file:///[WA_F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ext-install-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5566
                                                                                                                                                                                                                                      Entropy (8bit):4.856364699105961
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:1zDsTVq7EIkY+0vTkE0oN6El4iTZTzMuFqEFDk00jl8arkM0d7XV9hn:qc7EIV+UTq06ESGZ3fFq2DajlJryd73h
                                                                                                                                                                                                                                      MD5:CC4875E5ACB06FEC27199CBB3766CC7C
                                                                                                                                                                                                                                      SHA1:B745C4405DB3CA4A581E834CC1F92FE528AC024A
                                                                                                                                                                                                                                      SHA-256:5C739D1A4FF478931D62E1713922547247999C7AF43336FE14C45D65798853ED
                                                                                                                                                                                                                                      SHA-512:AF80086190DDB56A05A240B149A7B28165382311C85D696CE1675087BCF7BE03B75C544A037C2C06781C13A9ACDBE53EC94CD8198CC5C388BB973273FD03DEB0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Download Warning Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.extension_install_toast = function () {.... let browserCode = "(unknown)";.... show = function () {.. _window.ready(async function () {.. // Set toast window size.. setSize({ width: "485", height: "265" });.... // Get settings data.. let toastCountSetting = "ff_extension_toast_count";.. let toastCount = await _settings.get(toastCountSetting, "0") || 1;.... let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.WAIFF).get;.... // Initialize toast... init(lang, toastCount, document);.... _window.show();.. window.chrome.webview.postMessage("draw_background");.. window.chrome.webview.postMessage("set_focus");.... browserCode = await _instrument.getBrowserTypeCode();.. //

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-options.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6769
                                                                                                                                                                                                                                      Entropy (8bit):4.973225248749686
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:yH5SvRvxVoY2bZX/o0lhOY52Q5YsYmafFZR9f3:yH5EvxVD2bJQChOsV5BLaf3D
                                                                                                                                                                                                                                      MD5:F39F2A3071840E2CF85785BD610F9CD9
                                                                                                                                                                                                                                      SHA1:8FC5EBE0CB0C954B6D01A7B6E07666A428C785F3
                                                                                                                                                                                                                                      SHA-256:8CCF82E348D644CFDCC35A365A6D9519DD91F17CEAD9337CBB53B1ECAE42476C
                                                                                                                                                                                                                                      SHA-512:27CACAF6107A83D8E4776A41B6DAB1D35174AFB13C894FBE38E3B8E9421175CBCC5C39A5D368492F255CEA1A89A0D0ED92E789161C0DECB504C2C6F32F3F9218
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:#bottom {.. bottom: 0;..}....#left {.. left: 0;..}....#left,..#right {.. bottom: 0;.. top: 0;.. width: 2px;..}....#right {.. right: 0;..}....#top {.. top: 0;..}....#top,..#bottom {.. height: 2px;.. left: 0;.. right: 0;..}....#top,..#bottom,..#left,..#right {.. background: #939598;.. position: fixed;..}....#wa-button-donttrust {.. font-size: 26px;.. right: 2px;.. top: 5px;..}....#wa-button-reset {.. background-color: #00AEEF;.. border-radius: 3px;.. color: #fff;.. font-size: 14px;.. font-weight: 700;.. height: 40px;.. margin-top: 12px;.. width: 145px;..}....#wa-button-trust {.. font-size: 24px;.. right: 3px;.. top: 4px;..}....#wa-close {.. padding: 8px;..}....#wa-options-about ul {.. line-height: 23px;.. margin-bottom: 0;.. padding-left: 12px;..}....#wa-options-content {.. font-size: 12px;.. overflow-x: hidden;.. overflow-y: auto;.. padding: 24px;.. width: 550px;..}.... #wa-option

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-options.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1673
                                                                                                                                                                                                                                      Entropy (8bit):5.426748262408819
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:csY0xtxdJQeNVMznWrVMzLKWrVMzQzVMzQXVMzQdQVMzlCZVMCmFgtHQS51c:3Xxtxk/r363kKk+kNhzCJtHhY
                                                                                                                                                                                                                                      MD5:37A8A0FB8C135A0ECAF7DE4E5F0B4F99
                                                                                                                                                                                                                                      SHA1:344645FD132A2582744B102D6596E6ACB9557B6C
                                                                                                                                                                                                                                      SHA-256:CD5EFB06928D501A740F7EE13429B94FE49AD4EDB35AE34BF1C44DAD988E8A8B
                                                                                                                                                                                                                                      SHA-512:882FBE3148D4E486A25325EF6392DB7A75BA1A70408942727746AC4AD490320E688EF1B7930DF7C959F66D2FB550E4B6228298BBB41D74A54FC6446CB5ADBF68
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-options.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-options-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/java

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-overlay-ui.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2339
                                                                                                                                                                                                                                      Entropy (8bit):5.391157063631918
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:NOxNxS/Y+3i3cKc+cppJC3W0PK+ptCHJCC6/7Rgm6W:YFi2CozRfn
                                                                                                                                                                                                                                      MD5:582AD59BA2DFC629436FB875F001BF85
                                                                                                                                                                                                                                      SHA1:F667E63B5B2F23494DE85BBE24BA5965EE51D328
                                                                                                                                                                                                                                      SHA-256:3AADFA5C03F8D58167C48728AA2371B0A13D2EF096D88E6338748EAB6BF57B90
                                                                                                                                                                                                                                      SHA-512:9B80C4A4702C32609BE0A9A88A72877D027038E62318700AB22F3FC5A01DAC854546938C20EC57096EF36D41D36AE6B460A611AE6DA22A2FA8D161548EC5A68D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <title>Accept Extension</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=11" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-overlay-ui.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-overlay-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:/

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-overlay-ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10070
                                                                                                                                                                                                                                      Entropy (8bit):5.234843937749983
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:2Ar/3q1FNFmMtuhVXdeWG3trDCpnb+LwlY7ZmXE:7Q8XPG3tPqoQqUE
                                                                                                                                                                                                                                      MD5:B1558925997E35AC69C615A183348DDC
                                                                                                                                                                                                                                      SHA1:883100BCCA24950541B1C1270EC1DD57C09F65F6
                                                                                                                                                                                                                                      SHA-256:B7E706A8AC69F5632D4B6C43CE32B2E6C3454117D57F031BC3C4C8C2DC888765
                                                                                                                                                                                                                                      SHA-512:FFED2985935D9B4131D3C29EF1A794AF48279D8122AD4FA06B16AB0B08525E03601CE131E5F3F3DCB5B19F26790421E790D1C12452B39691003309FD651EAA60
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _settings = wa.Utils.Settings;.. var _instrument = wa.Utils.Instrument;.. var browserCode = _instrument.getBrowserTypeCode();.... ui.accept_extension = function () {.. var $el = {.. arrowUp: $("#arrow-up"),.. arrowRight: $("#arrow-right"),.. balloonCard: $("#balloon__card"),.. contentText: $("#content__text"),.. cardImage: $("#card__image"),.. closeIcon: $("#close-icon"),.. waLogo: $('#wa-logo').. };.... var ENABLE_EXTENSION_OVERLAY = 0;.. var INTRO_OVERLAY = 1;.. var SEARCH_WARNING_OVERLAY = 2;.. var SETTINGS_OVERLAY = 3;.. var TOAST_OVERLAY = 4;.... var WA_EXTENSION = 0;.. var SS_EXTENSION = 1;.... var overlay = {.. types: {}.. };.... overlay.types[ENABLE_EXTENSION_OVERLAY + ""] = enableExtensionOverlay; // enable_extension_overlay.. overlay.types[

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2773
                                                                                                                                                                                                                                      Entropy (8bit):5.21697974460176
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:xmp5UoZwx7MdDyTgWfx9gazwPpLDqELO1CX7EnulmQt:xA2x7M8TgWfx9ZzwRqzkh
                                                                                                                                                                                                                                      MD5:B20212C06FA27F99B7E1057C4A9A4C64
                                                                                                                                                                                                                                      SHA1:3AEFE9152B08C8BC38EA557FBD0122F9FEBC2AC0
                                                                                                                                                                                                                                      SHA-256:0EE31F5A4E7EAB47E286D656D59D578E9FBAA84746C8C58CDC6535AC404F9970
                                                                                                                                                                                                                                      SHA-512:15DF14A2CB81942027863A767456F6248ED15F71FFFD520B1648E96C730AC7E359E8E2F9C864D1A442BF22C7F4DEB2430CA88B810D5C5F49462D99215297141A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", Arial, Helvetica, sans-serif;.. font-size: 14px;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container */...toast {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px; /* Window width is 530px */.. margin-bottom: 6px;..}.....content__checkbox {.. margin-bottom: 25px;.. display: flex;..}.....card__content {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}.....card__content #checkbox-question {.. font-weight: 600;.. font-size: 14px;.. margin-bottom: 15px;..}.....card__content .button__unfixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;.. border-radius: 100px;.. display: block;.. margin-left: auto;.. height: 38px;..}.....card__content .button__fixed__width {.. background-color: #1671EE;.. color: #FFF;.. padding: 8px 16px;

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2674
                                                                                                                                                                                                                                      Entropy (8bit):5.3441295562655045
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ekx0xeexvU2363kKk+kF3hHCeYYUrOFfp6NnSmsPzV6e:5kCOFUNnRs4e
                                                                                                                                                                                                                                      MD5:69DEDFF8DF221668D3C901EB656F5411
                                                                                                                                                                                                                                      SHA1:07402A18CFF64FAED058CAF1061B0EE192210C4E
                                                                                                                                                                                                                                      SHA-256:C82CDBE52633789FC60857DDC11D82DF1D9881659CB30911FA4B176211EBF334
                                                                                                                                                                                                                                      SHA-512:C42B247DD00FC4CDE90EF48F0F32501378C240C6B6963FDE54CB727C99232C981FBF05FD47DDC869DD138AE447CE2644C0AB9AC2E6BFC4AC4209ECDA6214A1F8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>....<head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\custom-checkbox.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ss-toast-variants.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-ss-toast-variants-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_we

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ss-toast-variants.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15842
                                                                                                                                                                                                                                      Entropy (8bit):5.048082538667245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:pBhtOz/WohfMaTGrTaTe1GXoK+iJIZ4t8g8BbLHLXDK:nOyoiammeYokJIZm8g8BrzK
                                                                                                                                                                                                                                      MD5:230FD93014FDBF20FE89B6DAC9876B01
                                                                                                                                                                                                                                      SHA1:1BBFC1B16AD6EC7CDDB71E2A1289ECCBFAFBFC7E
                                                                                                                                                                                                                                      SHA-256:0784E8120BD1EB1E4DF5EF1B4B88E9D7AEC27BBF831446ADF2CBA3B6C020DE3E
                                                                                                                                                                                                                                      SHA-512:DED202FA6F18AB4983A048859B5F5DB1F5DA28B5BB15D83B49E12800468953E6E85F67D003864EDAF3459FCFB133BD341E8B11C5C318CBDE208777E7EA811DAD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:./* Accept Extension UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.... ui.accept_extension = function () {.. var $el = {.. cardImage: $(".card__image"),.. cardContent: $(".card__content"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. checkboxQuestion: $("#checkbox-question"),.. checkboxInput: $("#set-secure-search-checkbox"),.. doneButton: $("#done"),.. toast: $(".toast"),.. setSecureSearchLabel: $("#set-secure-search-label"),.. closeIcon: $("#close-icon"),.. labelDiv: $("#label-div"),.. };.... var variantsMap = {.. // Toast variation phase 2.. 1: {.. InfoTitle: "TOAST_VARIANT_1_TITLE",.. InfoText: "TOAST_VARIANT_1_INFO",.. Question: "TOAST_VARIANT_QUESTION"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-bing.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1677
                                                                                                                                                                                                                                      Entropy (8bit):5.18513436315057
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:UviN/rqfueEfu3kskCl8uGSq1lPDgrertqIKV5bZ066v0z98XQge:UvitOoWrJkSqbb9AIKV52jY9Gk
                                                                                                                                                                                                                                      MD5:2396BF484CDC6FD8FA5AFF6F6C936D88
                                                                                                                                                                                                                                      SHA1:3D4199754481211BB844DE51EAC3EC5EA0A47BDA
                                                                                                                                                                                                                                      SHA-256:C72B1AD2769F740660CCAD6AD49EA03CC1DEC56EE09B60E5EAA991A2FFF7E168
                                                                                                                                                                                                                                      SHA-512:BE07C1DECCF59E955021E726A0880DF71EBFB827A24FA4AE897253CA382DEF080F70240B677A967C05D0D6AED2A73987A5A08ED17E615F15C5AF91C20A3D8328
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px 10px 10px 10px;.. font-weight: bold;.. font-size: 15px;.. color: white;..}....#wa-sstoast-content {.. font-size: 11.5px;.. padding: 10px 10px 0px 10px;.. height: 142px;..}......#wa-sstoast-content table {.. font-size: 11.5px;.. height: 132px;..}....#wa-sstoast-content-caption {.. font-weight: bold;..}....#wa-sstoast-footer {.. padding-right: 5px;.. padding-bottom: 0px;..}....#wa-sstoast-content-check {..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-bing.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3058
                                                                                                                                                                                                                                      Entropy (8bit):4.764366004498787
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:x2skx0xdYk3WrVMzLKWrVMzQzVMzQXVMzQd1urVMzlbAVMzlizVMCy3juOB3+7qm:jkx0xT363kKk+kSChHhiKC8h3BTeeI
                                                                                                                                                                                                                                      MD5:D73CC8A250ACB9D323303CC465B960E3
                                                                                                                                                                                                                                      SHA1:27EC3931A08D253D9EBA944C8C4A96DFCBAF4739
                                                                                                                                                                                                                                      SHA-256:2A407EA27651B81F9644C5B012ED173D2D7446AB6B9C5A630EABD04F971E0EBA
                                                                                                                                                                                                                                      SHA-512:AA42E9065DE9DDDC807BE7EE744BB8B9D75DCF8C971B544BAEE0DF4B8FD05E21DC6B1D1FFE3D3B81ECBE5823F08C7716FEF19C586E77AE116CA87C194A93F343
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>SecureSearch Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-sstoast-bing.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-bing-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-ui-sstoast-bing.js"></script>.. <script type="text/javascript" src="file:///[WA_F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7450
                                                                                                                                                                                                                                      Entropy (8bit):5.105117402821277
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:OW0xXMHRMrola7b6xEgPGquAED+Y8AAoYE9Yl5hpeA8h9Y/5hbqe51E5T9565Cgd:OWlH2zFguf+c9Ug9K7aO9Y1b2wiZ
                                                                                                                                                                                                                                      MD5:DE2BAA68497400489C52148705C1533B
                                                                                                                                                                                                                                      SHA1:F50F8E385F009F630F4255CD596E85E12A73D625
                                                                                                                                                                                                                                      SHA-256:A374F11F1261EAB580DF90194E646494F3DCCC7E46DD5380EB160F56D9192E71
                                                                                                                                                                                                                                      SHA-512:5E8558BDB29C676715657A4AEE0AED4E08E6AFE81527AB9F65220C24A15C63FB822632827C34ED9A9C3F435AC304D4F15011C022DD30CB2D2A234581900A5BED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* version 2 3 */..* {.. padding: 0;.. margin: 0;.. border: 0;.. box-sizing: border-box;.. font-family: "Open Sans", "Poppins", Arial, Helvetica, sans-serif;.. font-size: 12px;.. outline: none;..}....body {.. color: #212934;.. line-height: 24px;..}..../* Parent container */../* version 2 3 */...toast2_3 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. background: #FFFFFF;.. overflow: hidden;..}.....toast2_3_larger {.. width: 761px;.. height: 565px;..}.....toast2_3_smaller {.. width: 761px;.. height: 500px;..}..../* version 1 */...toast1 {.. position: fixed;.. bottom: 0;.. border: 1px solid #ABB2C3;.. border-radius: 24px;.. overflow: hidden;.. width: 524px;.. margin-bottom: 6px;..}..../* version 2 3 */...card__content2_3 {.. background-color: #fff;.. margin-left: 297px;..}..../* version 1 */...card__content1 {.. background-color: #fff;.. margin-left: 150px;.. padding: 24px;..}..../* version 2 3 */...card__content .log

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4163
                                                                                                                                                                                                                                      Entropy (8bit):5.143740743073978
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:raaxLly363k3k5kabWhHZhuvT0/qUYoAxT75CZUea9S64hV2QXDUanjLSh:fbYhYGYoq75Heac7VfXDUanK
                                                                                                                                                                                                                                      MD5:A1CE70369834FDBBE1D7D2CCE1A5F815
                                                                                                                                                                                                                                      SHA1:B0A39034132A7F96A0587E19DA7B2639B753C1E2
                                                                                                                                                                                                                                      SHA-256:3DFDE9014C271F57994F3838283106FE431314F2D6222BD9B57DAF92E4DC7AF4
                                                                                                                                                                                                                                      SHA-512:929F49ECF7CEA532C38DD6EE7B901902E381FF43B13073E25ECA93E46CE6CCC7D6ACF7FC45C1A25704F899668A7BCC4630EED86F990266F830DE21F737EC4AC0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:<html>.... <head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link href="https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;600;700&family=Poppins:wght@400;600;700&display=swap".. rel="stylesheet" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/mfw\\packages_web_view\\webadvisor\\wa-sstoast-toggle.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/mfw\\packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast-toggle.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9943
                                                                                                                                                                                                                                      Entropy (8bit):5.154118609499005
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:TAf3m0aWPwT0JrrvhGzuLIhHQnJs1a85seo65DUyIrEzU6lgXg:8f4cGyDJgseoYIrasg
                                                                                                                                                                                                                                      MD5:BB10D141B88D6F7FF17FD2A7AB00B9B2
                                                                                                                                                                                                                                      SHA1:25B50436D6349DC11041C95A79E99C83C42BC474
                                                                                                                                                                                                                                      SHA-256:A459E27685B364CFDEC961382DFEC43ECA3939667A1DEADA2564D2D51A50591F
                                                                                                                                                                                                                                      SHA-512:0B1C47AFEC99D23BCA5AA7C187BCF00DE7231D34D595CC600E6E33AA5BAE93745E9B04313E33494B068BB95F7CCB9F6DA41507652D2DCFFDC29A0DE427BE3248
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {};.. var _window = wa.Core.Window;.. var _external = wa.Utils.External;.. var _instrument = wa.Utils.Instrument;.. var _settings = wa.Utils.Settings;.. const TOGGLE_COUNT = "toggle_count";.. var browser_code = "";.. var provider = "";.. .... ui.accept_extension = function () {.. var $el = {.. version2_3: $(".version2_3"),.. cardContent: $("#card-content"), // different css for different versions.. cardImage: $("#card-image"), // different css for different versions.. featureDisabledSection: $("#feature-disabled"),.. progressPic: $("#progress"),.. contentInfoTitle: $("#info-title"),.. contentInfoText: $("#info-text"),.. expiredSection: $(".expired__section"),.. expiredDivider: $("#expired-divider"),.. expiredLabel: $("#expired-label"),.. expiredName: $("#expired-name"),.. feature1Label: $("#feature-1-label"),.. feature1LabelContainer: $(".feature__1__label__cont

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2195
                                                                                                                                                                                                                                      Entropy (8bit):5.238575560954958
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UfqM+IFN0I4H0UJ0UY60uR60BFvUIFaSvU49xRstVOFwFLj:UfqMXm5R3F7aSp9O/
                                                                                                                                                                                                                                      MD5:D01ECBCDE38DE69FC802016704CD2478
                                                                                                                                                                                                                                      SHA1:EFBBBE4E521A22098D7D3D90C6BAC8F1B9E5D0BA
                                                                                                                                                                                                                                      SHA-256:00C3BFD394F9F3CDBC8E83C9C4AA8AF736005D68BF06331496136B12ED14EF25
                                                                                                                                                                                                                                      SHA-512:5C03CAE6A7E691AB491E6B038CA60DBFE8BEA608648D430403B20C54F64F2018C59543DFCC4814EF1DEA850785DE8708C206BA54F470D28AB810C291716AD3D6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:body {.. cursor: default;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....body :focus{.. outline: none;..}....#wa-sstoast {.. font-family: sans-serif;.. border: 1px solid #000000;.. background-color: #ffffff;.. height: 270px;..}....#wa-sstoast-logo {.. padding: 4px 0px 0px 10px;.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-top.gif);.. width: 100%;.. font-size: 17px;..}....#wa-sstoast-header {.. background: url(file:///[WA_FILES]/MFW/packages\\webadvisor\\inst-warningbackground.gif);.. width: 100%;.. padding: 10px;.. font-weight: bold;.. font-size: 16px;.. color: white;..}....#wa-sstoast-adblock-content-subheader {.. padding: 0;..}.....main-content {.. font-size: 12px;.. padding: 10px 10px 0px 10px;.. height: 118px;..}.....main-content table {...height: 108px;...font-size: 12px;..}.....main-content ul {.. padding-left: 13px;.. margin: 15px 0;.. padding-bottom: 10px;.. line-height: 17px;.. font-size: inherit;..}.....main-content

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-sstoast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5845
                                                                                                                                                                                                                                      Entropy (8bit):4.257206108102919
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:AkxeexbUy363kKk+kihHhiKC5h3ugfj2U+1:+q/an1
                                                                                                                                                                                                                                      MD5:A983C9757FA8A501362E3FDFB4EEAAB3
                                                                                                                                                                                                                                      SHA1:78AA46558097B9A39375119DBB2C3F2042CBBE1D
                                                                                                                                                                                                                                      SHA-256:23494DA44E48403FE479A024A1E9EF7DD64FCDFF8ECA5C630987E8697E84F059
                                                                                                                                                                                                                                      SHA-512:011E1173087C6180EC199CEECAFAAB6C9CE3C5CB1C4A131C4198C600DB5C29F5C6C73F6D5AD82ED892DD0C7C097EDB12CDE76C656E4335142EC39C4AF1254BD6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. .. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\custom-checkbox.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\wa-sstoast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-3.6.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-sstoast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\webadvisor\\w

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-av-report.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7884
                                                                                                                                                                                                                                      Entropy (8bit):4.7126591083785545
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:qkKi/9YE8TRrGQyvEy2oWp2Uop1VacU2/BPZnn41/qQvC:wCR5JBPNYCv
                                                                                                                                                                                                                                      MD5:2300D19D925BCF132421D60E59C2149C
                                                                                                                                                                                                                                      SHA1:AAF7928916704E474C24D8F87E205E91DC197996
                                                                                                                                                                                                                                      SHA-256:ED3DE5BF13921F3E0F41946EDFDD17AD8C379860ACF6D2D9A503BEF27D6A00A4
                                                                                                                                                                                                                                      SHA-512:0E9B8915A84110E12E204898C0120516B66EB73364D911721F88E1543E54021C885FC8EC5F51FE444715D1E95A4E6CB6F2CB669D2B7440E50288AAEB183A7D61
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.. _lrt = wa.Utils.Lang.ResType,.. _l10n = wa.Utils.Lang(wa.Utils.Lang.ResType.UT).get;.. .. ui.AvReport = function () {.. var settingUrlBad = _settings.get("upsell_url_bad_scan", "1");.. var settingUrlDefault = _settings.get("upsell_url", "1");.. var url = (settingUrlBad == '' || settingUrlBad == undefined)? settingUrlDefault : settingUrlBad;.. if(url == '' || url == undefined){.. url = 'https://www.mcafee.com/consumer/en-us/landing-page/direct/aff/WA_MTP_StaySafe.html?affid=1523&ccoe=direct&ccoel2=campaign&csrc=wa&cctype=mtp_test5&ccstype=mini_vulnerability_scan_91277'; .. } .. .. open = function () {.. var data = JSON.parse(_external.getArgument("report_data")); .. showReport(data);.. _window.show();.. },.... showReport = fun

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-dialog-balloon.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4537
                                                                                                                                                                                                                                      Entropy (8bit):4.720335976330073
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:+cAFwUkCTaVVPCxEeO0pv1xRsxIE3BXDXjZXGDq:hASUrTafjetptxRIXDXjZXGO
                                                                                                                                                                                                                                      MD5:529154E8B4A35679BF7B49FD627BD9EE
                                                                                                                                                                                                                                      SHA1:A6A731A7D826AB19AB20C4A1828036D4A82F4962
                                                                                                                                                                                                                                      SHA-256:1544ACE0943C70B36C73E3BF98E7F912DF9EA3CA4BE8458528FCE4026FD4C47F
                                                                                                                                                                                                                                      SHA-512:A12518BAC026261FC03A11F380189F39B775185FDE679D99B2CA6A86E160580EEB674EF72CD6B951DF439EBA692C44FCE5A2DDDB020179D1FAC41E2DAA6185DE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Accept Extension UI */..(function (wa) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument;.... ui.accept_extension = function () {.. var telBalloonType = '';.... show = function () {.. chrome.webview.hostObjects.wa_external.log("inside show");.. _window.ready(async function () {.. chrome.webview.hostObjects.wa_external.log("inside ready");.. var settings = JSON.parse(await _external.getArgument("overlay_data"));.... if (!settings.balloon_type) return;.... init(settings.balloon_type);.... await _window.show();.... // Send telemetry for dialog balloon showed.. browser_code = await _instrument.getBrowserTypeCode().. var telemetryEvent = new OnboardingBalloon().interaction_type("Impression").browser(browser_code).balloonType(tel

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-dwtoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:C source, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2708
                                                                                                                                                                                                                                      Entropy (8bit):4.980858893880424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:N45ikP03NTwwiIw0X+Zgleg0q3nwYfwR3AhYeYEfTiNAE1ed1RNA69Glkhe:RdUl3GsKirE0Sd9Wkhe
                                                                                                                                                                                                                                      MD5:9B5E65E23760BE613ECB6168930361B0
                                                                                                                                                                                                                                      SHA1:27BA841C5A44C7564BE9A8508463C3B36F8AD2AD
                                                                                                                                                                                                                                      SHA-256:FA15612596E04A4932980D4850D31E808DF0E21DBFCDA9E056A4CC0E9687D283
                                                                                                                                                                                                                                      SHA-512:54834B2BF1466BB85323BE99226A0481B42273B6388874960CB85FEA1EDB7F867E09ACB0ECAD8599578E565E096F84F980BB376520D71790BC75F23FEBDA577E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Download Warning Toast UI */..(function (wa) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window,.. _dw = wa.Core.DownloadWarning,.. _wa = wa.Core.WebAdvisor,.. _l10n = wa.Utils.Lang().checkList();.... ui.DownloadWarningToast = function () {.. .... show = function () {.. _window.ready(async function () {.. let domain = await _dw.getDomain();.. let fileName = await _dw.getFileName();.... document.getElementsByClassName("logo")[0].innerHTML = (_wa.getProductLogoHtml("file:///[WA_FILES]/MFW/packages\\builtin\\mcafee-logo.png"));.. //$el.status.append(_l10n("PP_STATE_TEXT"));.. document.getElementsByClassName("body")[0].innerHTML = (.. "<p class='content-header'>" +.. "<img width='20' align='middle' src='file:///[WA_FILES]/MFW/packages\\webadvisor\\warning-icon-toas

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-options.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23757
                                                                                                                                                                                                                                      Entropy (8bit):3.8947324393432465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:LravuBFTv2stTHDiF9ymq4pnU5rnXEBF15hZOmvYkydOergIEG:PavuB92qTHDdmRBU5rXEBF1VJy9EIEG
                                                                                                                                                                                                                                      MD5:CCF736E58F9FF952969CBC9C855EEC5F
                                                                                                                                                                                                                                      SHA1:917A1B1567B94036D29B5B3654EE187FA45ACB8E
                                                                                                                                                                                                                                      SHA-256:14713CBCFCA2C2166BEE32117FB825084388C1E1CC2F5B9B00C536CD0E280C5C
                                                                                                                                                                                                                                      SHA-512:8664EC9C42B70D7ED9F8C6E3347E7E0DF708BD9F64A3E3D82082FD620E911012F65EDBDAB2588EF6D75C95CE553902B77C1372FBDC5E0FCA28779C161A6A0C72
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* Options UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.OPTIONS).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml();.. _external = wa.Utils.External;.... var OptionsMenu = function () {.. var menuItems = [],.. el = {.. $menu: $("<ul id='wa-options-menu'></ul>").. },.... toggleContent = function (id, delay) {.. $("#" + id, el.$content).. .fadeIn(delay).. .siblings().. .hide();.. },.... itemSelected = function ($item, delay) {.. $item.. .siblings().. .removeClass("selected").. .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-sstoast-bing.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3213
                                                                                                                                                                                                                                      Entropy (8bit):5.16255334901329
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:84J7WFAUE+tg/eQKS8HJhMfNANKTBd5cgEXQ6c+dTYOYEfNg+cQBcZ1cxuOQAWI:YyDGhp6xz5clQSa7Ezl7QAWI
                                                                                                                                                                                                                                      MD5:887531106CB563F49BCA2D44538965E7
                                                                                                                                                                                                                                      SHA1:C49887CDFDB8BBF1203E3F6F58E2F394BCF1C120
                                                                                                                                                                                                                                      SHA-256:169C1072D7B3F7891196E0743D007CFEB8D8BA3FC7170338881920B3AD7907FB
                                                                                                                                                                                                                                      SHA-512:F71CB055747912AA3E5F24AE8B445A6D64EB833F8DDA1C7A92E8C90AFA92BEA3E67A2018846DB7AF769F6F99E301A6440C601247B6284813C2B803C542E92ED4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Toast UI */..(function (wa) {.. let ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _window = wa.Core.Window;.... var browserCode = "(unknown)";.... ui.SecureSearchToast = function () {.. .. show = function () {.. _window.ready(async function () {.... _window.setHeight("294");.. let productLogoHtml = "<div class='logo'><img src='file:///[WA_FILES]/mfw\\packages\\builtin\\mcafee-logo.png' align='middle'/>";.. let lang = wa.Utils.Lang(wa.Utils.Lang.ResType.SSTOAST).get;.... document.getElementById("wa-sstoast-logo").innerHTML = productLogoHtml;.. document.getElementById("wa-sstoast-header").innerHTML = lang("SEARCH_TOAST_HEADING");.. document.getElementById("wa-sstoast-content-subheader").innerHTML = lang("SEARCH_TOAST_SUB_HEADING");.. document.getElementById("wa-sstoast-content-caption").innerHTML = lang("SEARCH_TOAST_BODY_TEXT");.. let subfooter = document.get

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-sstoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14386
                                                                                                                                                                                                                                      Entropy (8bit):4.956394882069799
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:bEO/vVN2LiepMLoN07fVLE09/6H6HnHSl:bJ/vOLWL57FE09/E
                                                                                                                                                                                                                                      MD5:8B4FB9167F02E78A74D4CF0524202F19
                                                                                                                                                                                                                                      SHA1:BFFA2DBB3BCE17AD7AFDF5EC8254336F6EB4D770
                                                                                                                                                                                                                                      SHA-256:51569EB3FB9B3EB44727086DEE914A3D897C89FC5C6F6D717C3A5E448BDBAA17
                                                                                                                                                                                                                                      SHA-512:9C63ED727D1C4935764FA02A13023E0796D70952DC7F292F521CF176BEEF085992FABB7667C6963859933E7AC2705E8B2FC3E709736B4444F77D2D447D72C42C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:/* SecureSearch Toast UI */..(function (wa, $) {.. var ui = (wa.UI = wa.UI || {}),.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings,.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. browserCode = '',.. provider = '',.. metadata = 'render=web_view';.... ui.SecureSearchToast = function () {.. var $el = {.. header: $("#wa-sstoast-header"),.. logo: $("#wa-sstoast-logo"),.. mainContent: $("#wa-sstoast-content"),.. mainAdblockContent: $("#wa-sstoast-adblock-content"),.. mainMavContent: $("#wa-sstoast-mav-content"),.. subHeader: $("#wa-sstoast-content-subheader"),.. subHeaderAdblock: $("#wa-sstoast-adblock-content-subheader"),.. subHeaderMav: $("#wa-sstoast-mav-content-subheader"),.. caption: $("#wa-sstoast-content-caption"),.. captionMav: $("#wa-sstoast-mav-content-caption"),.. label: $("#wa-sstoast-content-label"),.. labelAdblock: $("#wa-sstoast-adblock-content-label"),..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-upsell-toast.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2797
                                                                                                                                                                                                                                      Entropy (8bit):5.2437907468207285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3Xxtxc/4363kKk+krhOCe4T+DSSqor5beIwEeIYuAOb:X8ztb1B
                                                                                                                                                                                                                                      MD5:48C805803BF9BFBA0666861496312EE4
                                                                                                                                                                                                                                      SHA1:C9B4C0FE8B2470F3D2D43EB302036C72A35F528D
                                                                                                                                                                                                                                      SHA-256:D9D77D386785B7A9CCF37FA9E2DE40BCD06AB88CB694CE498E97AE0C083B3F1F
                                                                                                                                                                                                                                      SHA-512:05D0A493DD87FE4468259C779A31A2274CAD69CB1A8F541F396CC2F576436712DF5680E05BDFAC256D365ADB532CD16F8D247922CDC4D67175FAAD4713778DAD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>Download Scanning Toast</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="file:///[WA_FILES]/MFW/packages\\webadvisor\\wa-upsell-toast.css" />.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-upsell-toast-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/jslang\\wa-res-shared-[loc].js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="file:///[WA_FILES]/MFW/packages_web_view\\builtin\\wa-core.js"></script>.. <script t

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-upsell-toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15936
                                                                                                                                                                                                                                      Entropy (8bit):5.109504251999366
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:+0/Pf4lTvqz3NbDdvSNOsxyVcNvKTvY6TdR/OsxTtwXMT2OpU0g/0/:zPf4lTvECBxyuNvKTvY6TjBxWcTRxj
                                                                                                                                                                                                                                      MD5:C5E8C67CF2548A53BB80370BABD2A9A4
                                                                                                                                                                                                                                      SHA1:1B9D11D0544D22FCF6393721A0A9594F0725E802
                                                                                                                                                                                                                                      SHA-256:6D144EBD075E1487AC6416A0DFF422D7FAC602271D5D51B53F978D2FB8960674
                                                                                                                                                                                                                                      SHA-512:80A1D6B7BD4B4E08E056A198F24AF3F5D8F30A6DFFFA6BB9EC56D7EB17ED05B5D9D5528D9EF1D7DB55C470FD89D30689FBB83ACA23968182E32A9B29D15D1C53
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _window = wa.Core.Window,.. _external = wa.Utils.External,.. _instrument = wa.Utils.Instrument,.. _settings = wa.Utils.Settings;.... ui.createUpellToast = function (toastData) {.. if(toastData.campaign && toastData.campaign !== 'none') return new ui.CampaignToast(toastData);.. .. if (!toastData || (toastData && !toastData.cohort)) return new ui.AvScanToast(toastData);.... switch (toastData.cohort) {.. case 1:.. case 2:.. return new ui.DirectUpsellToast(toastData);.. case 3:.. return new ui.GtiUpsellToast(toastData);.. default:.. break;.. }.. };.... ui.extend = function (Child, Parent) {.. Child.prototype = Object.create(Parent.prototype);.. Child.prototype.constructor = Child;.. }.. .. // ----------------------------.. // Base Toast Object definition.. // ----------------------------.. ui.UpsellToast = function

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6413520
                                                                                                                                                                                                                                      Entropy (8bit):6.444560384990914
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:ZCex3L2w5wQXqY1bvdwN4WOmQ9GAZoCqMZr6IjYvJHEt6QD2yyTjK/HR3cwmq2PT:fYqi7K/xME48v7HHvY9hMqVL
                                                                                                                                                                                                                                      MD5:02B1A23AD3418C300F3DFECCA3EFA4C5
                                                                                                                                                                                                                                      SHA1:784ACC4AB3CDFC17761681BB992D493907FF2A65
                                                                                                                                                                                                                                      SHA-256:2AD0071B73253068C7989E756C3744D15926D330CCB6314E804BF46EAD7C16DD
                                                                                                                                                                                                                                      SHA-512:14892A15121048D9F6431FA665B9AABC48E55CAAC5CBA25DBD3C512470BDAFE051426FD00DAF41053363DF332DE3C390D6E3BBEADD93FCD18E76383D2249C119
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.................................Y..................-......................................3...'.......c.......&.......&.......r..............................,...............,.......w.......w.......w./.....w.......Rich............................PE..d....j1e.........." ......H..........;A.......................................a.....*.b...`A..........................................Y.T.....Y.@....p`.p.....]..G...._.......`.@z...R.p.....................R.(.....M.8.............H.8...H.Y......................text.....H.......H................. ..`.rdata..8Z....H..\....H.............@..@.data........PY......:Y.............@....pdata...G....]..H....\.............@..@.didat..p....P`......R_.............@..._RDATA.......``......T_.............@..@.rsrc...p....p`......V_.............@..@.reloc..@z....`..|...Z_.............@..B........................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticscontextconfig.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2847
                                                                                                                                                                                                                                      Entropy (8bit):5.514384237722885
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:TsOmHLD71uGMX0A7tCOCGcmwo+AauFCGLjMo+hOQnL80kIXzoO9MlBa5E5HPB6R7:rWFTAJC913AauRM3hOB0kIXzr9MlwE50
                                                                                                                                                                                                                                      MD5:3929A3BA59A1580459FDB9B4B0F50EC8
                                                                                                                                                                                                                                      SHA1:BE7A6E0B90A1B2F2A59BDE2C68358B5CE3773BF5
                                                                                                                                                                                                                                      SHA-256:EFEBBAA78ED42EA5ACFF80C20A506412DF6D0A9CC3840720BCE15A231E08E700
                                                                                                                                                                                                                                      SHA-512:63ED1DFC84CB605840A48517C48B01CA8FA54CB88F7E3F1EFB1D629F53E009B6E1F46E9B2D15E14B390927EABD0A204F0C5AC1098F9CFABE9CD90863DC7356A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........0.>3.-.3...3...:...3...:...3...3...:...3...:...:...3...:...3...:...3...3...:...3...:...:...3...3...:...3...:...:...3...:...3...:...3...:...3...3...:...3...:...:. .3.!.3.".:...3.#.:...:.$.3.%.3.&.:...3.'.:...:.(.3.).3.*.:...3.+.:...:.,.:...5./.4./.H....context_config.contexts....user_account_id....key.account_id.setting_name,CloudSDK.cache: GET /account/v1/details.handler.AnalyticsWPSSetting....db_name.vso.handler.WSSSetting.property_name.accnt_id.hash_id.IDENTITY....setting.context_user_account_id.handler.AnalyticsWssWps.product_productkey....key.product_key.setting_name1CloudSDK.cache: GET /subscription/v1/details.handler.AnalyticsWPSSetting....db_name.vso.handler.WSSSetting.property_name.product_key.hash_id.IDENTITY....setting.context_product_productkey.handler.AnalyticsWssWps.product_package_id....key.package_id.setting_name1CloudSDK.cache: GET /subscription/v1/details.handler.AnalyticsWPSSetting....db_name.vso.hash_id.IDENTITY.property_name.package_id.handler.WSSSetting.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswpssetting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1281
                                                                                                                                                                                                                                      Entropy (8bit):5.708701964310632
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:HMnJqaQ63dSl1PmIyE6TNCfzMIZRH3GD/TxlovL953K4J1JTRdDGul:HMnJqapN0eE6TN8ggRHK1+vLPa4J3TRJ
                                                                                                                                                                                                                                      MD5:E11DFC3FAB38D35E34E5F0EF13FA94D0
                                                                                                                                                                                                                                      SHA1:BD70D6527B8B4874891D32BF971EBF0EB8D44EFB
                                                                                                                                                                                                                                      SHA-256:0D68FAEE3B9586C1C9D2614842AF850A911C414C909E03FE869E37761CF7F9FC
                                                                                                                                                                                                                                      SHA-512:2ED1389513A4B0855941E667363EA3ED3CD12C6ECFCF7D71DF50DA8FD96E88AABE126A3AF09781CE47CCDAB2C655EB7D72B45D72B5842FEA4E917D70BB77554F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........P....T...%...H...4.......7.......>.......T...4...7.......7...%...>...%...H...........T.-.4.......>...4...7.......7...%.......$...>...4...7.......'...)...>...4...7.......7...%...>...4.......>...D...4...7.......7.......%...4.......>...$...>...B...N...%...6.......T...6...4...7.......7...%...4.......>...$...>...4.......@...,AnalyticsWPSSetting: value returned is .NO_WPS_KEY. = .pairs,WPSSetting: parse succeeded. Json keys:.decode.json_parser%WPSSetting: wps json setting is .tostring.NO_WPS_SETTING WPSSetting: wps nil setting.info.log.core.get_setting.wps_utils.NO_INPUT_SETTING........H..........."4...7.......7...%...>...+...7...)...+...7.......T...+...7...+...........>...+...7.......T...4...7.......>.......+...7.......>.......H..........format_output.lower.string.lower_case.key.setting_name+AnalyticsWPSSetting get_context_string.info.log.coren.......4...7...........>...1...1...:...1...:...0...H.....get_context_string..format_output..new.ContextHandler.........4...%...>...4...%

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticswsswps.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1308
                                                                                                                                                                                                                                      Entropy (8bit):5.555240500179305
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:RCdga9Mnjr4dpenfKAdoCsqXRb7UcVzoFsqXRAKJDMOrDMM1QmJ1HasHOKDWQ:RCdga0r445oeXRJ1oLXRnJDMO3MADJ8c
                                                                                                                                                                                                                                      MD5:55A3F518235EC84983CFE8F1D6313601
                                                                                                                                                                                                                                      SHA1:A97F0ABF1FB1DCD75FE12BCF4180123E14F98C26
                                                                                                                                                                                                                                      SHA-256:814D010212DE3EDD8363E3E0668137DF6835724ECBCDC6F3911900E953F1C294
                                                                                                                                                                                                                                      SHA-512:F152FD38ACFFC1097A6069F3272DCCEF0EDA4D4C01AFA4166E9603AD99A6E9AACAF753A1A1F1C4A781ED493A2776BEB5FFCA2389BCDFC3BFF3DF79CCFF63B6D2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........m+...7.......7...%...>...%...4.......7...>.......T.0.+...7.......7...%...>...+...7.......T...+...7...7.......T...4...%...+...7...7...$...>.......T...7...+...+...7...)...>...7...>.......T.=.+...7.......7...%...>...T.6.+...7.......7...%...>...T./.+...7.......7...%...>...+...7.......T...+...7...7.......T...4...%...+...7...7...$...>.......T...7...+...+...7...)...>...7...>.......T...+...7.......7...%...>...T...+...7.......7...%...>...H.........]AnalyticsWssWps: Expecting wss subconfig and wss handler in context config, but got nil.:AnalyticsWssWps: Nil wss context handler encountered..wss*AnalyticsWssWps: WPS is not installed]AnalyticsWssWps: Expecting wps subconfig and wps handler in context config, but got nil.:AnalyticsWssWps: Nil wps context handler encountered..err.get_context_string.new analyticstelemetry.context..require.handler.wps&AnalyticsWssWps: WPS is installed.is_wps_installed.wps_utils.$WssWps: main get_context_string.info.m_loggerR.......4...7...........>...1...:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\browserinformation.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4159
                                                                                                                                                                                                                                      Entropy (8bit):5.854237386324809
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:/LdYNlo4+7L9/FbBD+ZV4vJ2j5DXHyqeIhkgpe:/Lr17LNFbBD+ZV4vwdDXHTqR
                                                                                                                                                                                                                                      MD5:75691F87C5212F0F69A15C15E934E7CD
                                                                                                                                                                                                                                      SHA1:455D775EB3D29AF6F818C0595ED762EC17CC342C
                                                                                                                                                                                                                                      SHA-256:035B7B989B00B7FE7C52E04DCDF36DFEEF63CEA2A6FBE6FAD79CB3C1B8A39757
                                                                                                                                                                                                                                      SHA-512:26C93A299C00BF85C647705C40394D78BF000C5C519F0F4162012132CAFC0558F2CD500DC0FEB95A5D4B043CAF97A67ABB0FCD2F025C90B2B50F4CC683BA5B4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........(4...7.......7...%...>...3...3...:...3...:...3...:...5...4...+...>...D...+...7.......4...6...7...4...6...7...>...4.......7...)...+.......$.......>...B...N...G..........SetOption.settings.value.key.get_browser_version.pairs.reg_info.ed....value.version.key(Software\\Microsoft\\EDGE\\BLBeacon.ff....value.CurrentVersion.key%Software\Mozilla\Mozilla Firefox.ch.......value.pv.keyNSoftware\\Google\\Update\\Clients\\{8A69D345-D564-463c-AFF1-A69D9E530F96};Inside Browser Information set_browser_version_setting.info.log.core........-4...7.......7...%...>...3...5...4...+...>...D...+...7...4...6...)...>...4.......7...)...+.......$.......>...+...7...4...6...)...>...4.......7...)...+.......$.......>...B...N...G............SetOption.settings"get_supported_browser_version.pairs.browser_ints....ff...ch...ed..CInside Browser Information set_min_max_browser_version_setting.info.log.core........<4...7.......7...%...>...+...>...+...>...3...+...:...4...+...>...D...7.......T...2...9...)...7.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\browserversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1072
                                                                                                                                                                                                                                      Entropy (8bit):5.8238642342853
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:BEKsrPMp0jMFgeRWv8KD8RY7o7dOfB7ojKR3jb9e3pSWH03/C6Tq:s0paMHR0jD8y85OfB8jO3P2HMq1
                                                                                                                                                                                                                                      MD5:F8D120548CF01226D7A58B9DC00F3A05
                                                                                                                                                                                                                                      SHA1:38F3B4DACD5D619B8568655014FEEE9E71C3A756
                                                                                                                                                                                                                                      SHA-256:8E5CA08FFF5E5E8E8F962666ED22B36465542105FC0CC411801999A5F0EC4F07
                                                                                                                                                                                                                                      SHA-512:03D0AD7D90C256991F81AF90EF3F066265BD516EDD67C76F04623E45A5B5F2046D8BF77A88BC3E1DE2791FDEE8290B3B596533B1D8D6A8288FD63F5189B47349
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........Q2.......T...2...3...;...3...;.......T.......T...2...3...;.......T...2...3...;...3...;...3...;...3...;.......%...4.......>...T...4...7...7...7.......'...7...>.......7...>.......T.......7.......>...........T...4.......T...T...A...N...%.......T...4...7.......%...>.......T.......T...4...7.......7...%.......$...>...4.......@....tostringMCould not determine browser version. Returning default value. Browser = .err.log.%d%.%d.match.string.0.0.verion.QueryValue.IsValid.options.root.Registry.Win32.core.ipairs.....options.....root.HKLM....options.....root.HKCU....options.....root.HKLM....options.....root.HKCU....options.....root.HKLM.ie....options.....root.HKLM....options.....root.HKLM.ffj.......%...4.......7...........>.......T...4.......>.......H....tostring.GetCurrentBrowserVersion.utility..........4...%...>...2...1...:...1...:...0...H...."get_supported_browser_version..get_browser_version.mfw.core.Win32Helper.require...//61D08F43D1F34751D6F3BF193C7CF7746923D0D2BB87E8974479C0A3F3

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\contexthandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):422
                                                                                                                                                                                                                                      Entropy (8bit):5.255191646880291
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:504LqtAomX8latlQlQUQGmUwhq4Tf9q4Tf9qyHl/QqfTPSAlZtSk2UcS1kPnL5Qo:iUMlgQKht3TPzlbSk2FSuPnLOohSWll
                                                                                                                                                                                                                                      MD5:C142010A93030F1EFCC025653C75BC0A
                                                                                                                                                                                                                                      SHA1:F699468FC565CCA9D074E75785393EBC3415BBE9
                                                                                                                                                                                                                                      SHA-256:CBDE2113190D9A37D4E5D2FF608837DB54E845507AFF4664BEE60907A4B1C6F3
                                                                                                                                                                                                                                      SHA-512:0A9330839462F395A8B6E220A19C2D53CB387FA4DA284D30919F84C4F957E263E92E9A1824FA07F4C33C61D3C4497B07FDF7A023905A710DAF6102F235752F48
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..@.......4...%...>...G...'get_context_string not implemented.error........+...H.............,...G.....x.......2.......:...1...:...1...:...1...:...0...H.....set_context_config..get_context_config..get_context_string.m_logger;.......2...5...4...1...:...4...0...H.....new.ContextHandler...//46D12BD8B5929DEB728E4415170BA1991A2DBCA03AA8A41253813C6E2BD0803E7657D2104238478E01EBE5CAAD82F9D323DFE2563F2D9B8034F251C2CD03E5FA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\externalutilityfunction.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):897
                                                                                                                                                                                                                                      Entropy (8bit):5.586345929562101
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:LTuQyxqRopU5aedVf507iDaXU0XlLFMYQGJ1MBV6MEags:L6ZxyVf5Coj2F3/Jk6A
                                                                                                                                                                                                                                      MD5:B78BED4A2A8C199004BA9629D3141920
                                                                                                                                                                                                                                      SHA1:8F65591D952D621730E044C679DA707929F330C2
                                                                                                                                                                                                                                      SHA-256:0FFCBEC07791E6113E422F81A03935D4B97524DD46F67B33261EB44FE53C73B5
                                                                                                                                                                                                                                      SHA-512:1CA0830C90527C2868DA621694C7A25DDB7ACE98214D6FAF16BBE69BB37BE2EB5B71B06BB7B632B41BBFBB4B7D120329F9DA419192306CECA88B8C092560321D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........>+...7...>.......T...7.......T...7.......T...+...7.......7...%...>...%...H...4...7...).......T...7...6.......T...+...7.......7...%...7...%...$...>...4...7...@...........>.......T.......T...+...7.......7...%...7...%...$...>...4...7...@...4.......@.....7) return invalid result. Returning default value...tostring0) does not exist. Returning default value. External utility function (.utility._G.defaultQInvalid configuration supplied to external utility function context handler..err.m_logger.func.default_no_value.get_context_configR.......4...7...........>...1...:...0...H.....get_context_string.new.ContextHandler.........4...%...>...2...5...4...1...:...4...0...H.....new.ExternalUtilityFunction.analyticstelemetry.context.ContextHandler.require...//92FDF3FFDEB4AFB110E239B54B6B6C06E3A2C353C88C888884CFE640B2AA4A6D9E9344921C1D3C38F952E337FCFC15FEEE12C87E349D1E98413FFD87D2427857++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\featuretrackingfeature.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8106
                                                                                                                                                                                                                                      Entropy (8bit):5.5732776873126575
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:V/NSyEtMTnv9O5xDclSiBDbEfFwE+0aH1zatOH+CnaLe1:lNSbMTvgxDgDNmFz+FWe1
                                                                                                                                                                                                                                      MD5:8EB5E0B9919635B10100C3EF85A41682
                                                                                                                                                                                                                                      SHA1:24133CA0B7FF58CC8F65A7CA7D590BD8132846D9
                                                                                                                                                                                                                                      SHA-256:65A8BF5B420E05D9AEBA36B0CF4C635F812C6CA6F6982F138789B0EFDEC1F737
                                                                                                                                                                                                                                      SHA-512:906F223597F6E9461DF0E60D62002025C8CF8DD542F35CB40440008E019681305210FD885C5F2DDF35246DA4D87CE9AB333467ED7DF49925A109E9D28AE3E766
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..V.......+.......,...+...+...6.......T...+...+...6...+...+...+...6...6...F...G..........d.......2...4...+...>...D...........9...B...N...4...7.......>...'...1...0...H.......sort.table.pairs.........P%...+...>...T.I.%...'.......'...I.>.6...7...6...7...6...7.......T.......T.......T...4.......7...4...4.......7...........%...>...=...4.......>...=.......T.......%...$...T.......%...$...T...6...7.......T...+...7.......7...%.......%...$...>...T...+...7.......7...%.......%...$...>...K...........%.......%...$...A...N...H........=2) was detected when processing FTF dimension..Invalid information for (.err%) when processing FTF dimension.'Skipping version information for (.info.m_logger.version.0.1.GetOption.settings.tostring.IsMatch.regex_helper.enablementCriterion.enablementSetting.scope..,.........4...7...........>...4...7...1...1...:...0...H.....get_context_string..FTF_Registry.FeatureTrackingFeature.new.ContextHandlerj.......+...7...6.......T...'.......'...I...6...7.......T...6...7...H...K

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\hashedmachineid.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):896
                                                                                                                                                                                                                                      Entropy (8bit):5.731768822796376
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:waNW9zZWTAfCnzkRFtWCkyYFLlyfyGJ1E89euI:wK4zZmnSnM6JyAev
                                                                                                                                                                                                                                      MD5:88139CC385591F24536598CEED7AE95E
                                                                                                                                                                                                                                      SHA1:0B1B91E30DCBEA2E84CE61A1E6440D1174F660F7
                                                                                                                                                                                                                                      SHA-256:3E3A5D1D3D0571E6191AAF42AC4BFB50D3E1933FCB347AC3F37E59048B0FBDB3
                                                                                                                                                                                                                                      SHA-512:52758563D4C6532E128230E0A26CD671E6C830872EC6F3B2F4966ABF4EAAC82D6CB93EA57C4F863ECEC22A4D06C9D1F2E18C400DAFB02519A2B8C7FF730FB42B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........R4...7...7...%...%...'...(...>...%.......7...>.......T...4.......7...%...>...=...........T...%...%...4.......7.......>...........T...+...4...7.......'...'...>...4...7.......'...'...>...4...7.......'...'...>...4...7.......'...'...>...4...7.......'...'. .>...%.......%.......%.......%.......%.......%...$...4...7.......>.......H......upper.}.-.{.sub.string.MD5Hash.utility.MachineGuid.QueryValue.tostring.IsValid.$Software\Microsoft\Cryptography.HKLM.Registry.Win32.core...w.......4...7...........>...%...1...:...0...H.....get_context_string%d41d8cd98f00b204e9800998ecf8427e.new.ContextHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.HashedMachineID.mfw.core.Win32Helper.analyticstelemetry.context.ContextHandler.require...//128B5C1E1C2FB5527ADD2A085148E40FBFB7CC9180CEDFD5678482CE5FD2B2844C1AFCD5992201FF19D37911504B5C8ABBA1B4F8DFF95B51B6064587D083334E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\samrecoverable.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):847
                                                                                                                                                                                                                                      Entropy (8bit):5.745126211992888
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:pUEYQTxkwMDwaLvpV53SqMKQXJ15twhVkbO:p7YQEwaLvpX3DX0JjtNq
                                                                                                                                                                                                                                      MD5:82047E49417067DFDC8B11C1658324E2
                                                                                                                                                                                                                                      SHA1:BE45CB9A63581901945D083EC19DE11337C8DF17
                                                                                                                                                                                                                                      SHA-256:BF0D0644D63C63C3F74CF906738EDFBB2E40EB3F527FFA61FC605EA1BD62EF24
                                                                                                                                                                                                                                      SHA-512:116E002DD07B3797B54034092DC235FE70A7C2B8547DD5A4F9F59EEA106EBF4CA114C0A9DFAD878A0E880E65717ECA105D0F3421F9FDD85A491A2C8CBFE2DB21
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........;'...4.......7...)...%...)...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...)...>.......T.......T.......T.......T.......T.......T...'...4.......@....tostring.oem_recovery_v2_disabled0*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WA_INSTALL3*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL4*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_ACTIVATION0*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_EXPIRY.*ShowSearchSettings.GetOption.settings.R.......4...7...........>...1...:...0...H.....get_context_string.new.ContextHandlery.......4...%...>...2...5...4...1...:...4...0...H.....new.SAMRecoverable.analyticstelemetry.context.ContextHandler.require...//03B06278A0DC3CB554BCDA368A77E1893A03E5CB026754E1FE9AB8431D46145A7BD2C703716D1BFB144D1DD04E050A29972199E4328E80BA194129438F17B71D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\sequencenumber.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):520
                                                                                                                                                                                                                                      Entropy (8bit):5.502102281106645
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:jRbkhToUoP9icHJXOefcM5oDGlbLnrWjJWJJKMhoxt6InNn:jRIhcU+9icp+ekMKQrWjJ1M66InN
                                                                                                                                                                                                                                      MD5:D8189D2E48B289AEEE5AD9E3AE3BAF04
                                                                                                                                                                                                                                      SHA1:553BDFCCB4A0FCF79DCBC54AB82487179BD34DB8
                                                                                                                                                                                                                                      SHA-256:499B04C97B396E3770B794B75CDC0155F3DAF1F8C7E3E6084B74D5E166BB44AD
                                                                                                                                                                                                                                      SHA-512:DBA4885A1EDE60E74C25BCD37FC0BAEDC2A05B75C94843BDF8E8CDDA40DC9737B8FC2BD8715C75F215EB2F749F74C4B15088F8F07739245AEAC4ABB04ADDDE0E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...)...%...)...>.......T...%...H...4.......7...)...%...'...>...4.......@....tostring context_product_sequence_id.0.*AnalyticsSequencingOn.GetOption.settings.R.......4...7...........>...1...:...0...H.....get_context_string.new.ContextHandlery.......4...%...>...2...5...4...1...:...4...0...H.....new.SequenceNumber.analyticstelemetry.context.ContextHandler.require...//60446B936C77AAE13B489B605C877AB7957ACBEEEDA642F83E918AC287261FBEF70BBE7AF9F0D76C6F95C0CEC0B34C8A24D793A613F2F8D318F8F2E2E31ED2E2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptionexpirydate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):594
                                                                                                                                                                                                                                      Entropy (8bit):5.635624057174678
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Mnl+qrqWSpHtDmkkkkkaTzobM5PstGlbLPRIJ+KoHtTrngEgdVlid:MVrsYkkkkkNbM+tQ+J1oNTrngEgm
                                                                                                                                                                                                                                      MD5:1179A7CFC7BBDB8E10CF4AC1BDA1652F
                                                                                                                                                                                                                                      SHA1:F3D30659D7527E6AC39BB87DDB8F145607E0B623
                                                                                                                                                                                                                                      SHA-256:5B2D9BD8FE945D21C2406E50F485769579259F0157043D47634F804DB0A89C78
                                                                                                                                                                                                                                      SHA-512:440A2E4A3690CF0357289CBD2DA00D53F0C7DF099985D62D70399863EE6AECCF434FD85584C412D2CE25FD337BB4D2188F93902F499721A50F08B3020282BF69
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........&+...7.......7...%.......$...>.......4...7.......%...>.......T...4...7.......'...'...>...%...4...7.......'...'...>...%...4...7.......'...'...>...$...H......-.sub.^(%d%d%d%d%d%d%d%d).find.string+SubscriptionExpiryDate: input date is .info.m_loggerI.......4...7...........>...1...:...0...H.....format_output.new.WSSSetting}.......4...%...>...2...5...4...1...:...4...0...H.....new.SubscriptionExpiryDate*analyticstelemetry.context.WSSSetting.require...//7C1A4993611911C76FC38C941E872939462F74AE99C2CDA140995E56E6C633B57EEC4B64F72B711DDD9A088ECEEB9F3EA529E799F1A5740BA7928288BC3F36FA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptionstatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1088
                                                                                                                                                                                                                                      Entropy (8bit):5.515446395224515
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:bwEX9j1RXQmU3PZ4o2gq8FlKCzO3F2yfpzJJvUJ1mocdHhvHkMxQ:3JQvhq87KCzE2eFJ8JQocdHNHkMe
                                                                                                                                                                                                                                      MD5:A294AEFA1BFEE73A32D2BE178B7D32AD
                                                                                                                                                                                                                                      SHA1:3CD7D0F251917803ED4DF9094C2B6CE9864729BF
                                                                                                                                                                                                                                      SHA-256:B2D9D41B2FCB9B3CD1ABAE059C3427BAEE7E58CD015E62F02E5D357AA8B31967
                                                                                                                                                                                                                                      SHA-512:A954C908274A6668C77638B19A67862FC420B3B39A3B49B16731BF0C9798C3B6D7A00269E732354E4B7E03DBAF527FDFD1353AD3D8E171BC4A4E91D3A17BD1A0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........J'.......T.......T...4...7.......>.......T...4...7.......%...>.......T...'...H...4...4...7.......'...'...>...=...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...7...3...:...:...:...>.......H....day.month.year....hour...time.os.sub.tonumber.%d+.match.len.string..4.......4...7...4...7...%...>...?....!*t.date.time.os.........+...7...%...%...>.......T.......T.......T...H...+.......>...'.......T...%...H...+...>...%.......T...%...T...%...H..........expired.active..INVALID_DATE.UNSPECIFIED.NO_APP.NO_SUITE.settings.vso.get_sub_db_setting{.......4...7...........>...4...7...........>...1...1...1...:...0...H.....get_context_string...WSSSetting.new.ContextHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.SubscriptionStatus*analyticstelemetry.context.WSSSetting.analyticstelemetry.context.ContextHandler.require...//F03A153A558288A54B09A7B37406E04FA169C0D71A

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\subscriptiontype.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):538
                                                                                                                                                                                                                                      Entropy (8bit):5.531883646664102
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7KTIOnEKXZQ43i1g039R5gflvJJvUJWJJKxa2YDJUBirnDr1s:7Kk01tWyfJJJvUJ1xu1ZO
                                                                                                                                                                                                                                      MD5:CC975420BD8F1CD4CBAA58D0AFABD19C
                                                                                                                                                                                                                                      SHA1:E1405DBC6E5525898CD1AEA23BE79BB2233AB9B7
                                                                                                                                                                                                                                      SHA-256:94A093D55904944B869A077872E4564F1F934083AD33E0B425904EDE78CC5991
                                                                                                                                                                                                                                      SHA-512:A143245E70E4BCA2509D53A6347C024DA4F8F7693BEDAA57E35863E54EAEB42DAC61477D0CA9D0382F6B0FDA3D378B1F979619E45A34A69C3F0045457F359F9D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..l.......+...7...%...%...>...%.......T...%...T.......T...%...H......paid.0.1.free.trial.vso.get_sub_db_settingq.......4...7...........>...4...7...........>...1...:...0...H.....get_context_string.WSSSetting.new.ContextHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.SubscriptionType*analyticstelemetry.context.WSSSetting.analyticstelemetry.context.ContextHandler.require...//C65E5DC45BBB9CAA051D26D33E25699CB515CF45654AE2474E29B807951A48F0D7F17EB04C72527B11F2A6B03E08801D940D97E73F77EE235AF4219BFDF99BDC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\suitestatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):857
                                                                                                                                                                                                                                      Entropy (8bit):5.62046062931636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:9IvnI+FDmvqaV9q8ReFYfaHSSTXyfuvn6pxgXvt/tM5oyKOzmik239R5gflXQxLc:myyWXSPyfuugXl/tMCys2yfuxAGJ1SB
                                                                                                                                                                                                                                      MD5:1388EE6027B50978501E7D39968420E4
                                                                                                                                                                                                                                      SHA1:6A96C697BA42488E76256A609D57F7EA54D082B8
                                                                                                                                                                                                                                      SHA-256:3E5BE7E22ACEA7613CEF6AF18E6024EAEC6726762BD60001312630E6BB728389
                                                                                                                                                                                                                                      SHA-512:A86960CBA8281C036EB3B66ABB729CB66CB40F53C447E14BDA2DA59CFD630E5053736C657BA01ABC8DF367273810523254D73AB20F42936453332E94E63C9D20
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........&'...4...7...7...%...%...'...(...>.......7...>.......T.......4.......7...)...%...)...>.......T.......4.......7...)...%...)...>.......T.......4.......@....tostring.*Freemium.*Orphaned.GetOption.settings.IsValid5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core......Y.......+...7...>...4.......>...........T...)...H...)...H......tonumber.get_suite_status..&.......+...7...@......get_suite_status.........4...7...........>...1...:...1...:...1...:...0...H.....get_context_string..is_suite_installed..get_suite_status.new.ContextHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.SuiteStatus.mfw.core.Win32Helper.analyticstelemetry.context.ContextHandler.require...//E61CD0B63979890E2D5212C7DC4834E138030937DA4FE2E70892A0D5E47A064DA49DB8AFE48316DFD52EB270D7F1530FF6DD5355B5C068B9539405BA176F5677++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptionexpirydate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):472
                                                                                                                                                                                                                                      Entropy (8bit):5.60004845040712
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:IOPm3KkBM5PsvcRu30GlbLMrJ0NRu3pK1SKkCwzW:DPRkBM+Z30Q+J0NRu3kbizW
                                                                                                                                                                                                                                      MD5:601ACBF5C5A7991CDE5EDEEF05BCF0BB
                                                                                                                                                                                                                                      SHA1:B6B1981A587C755AE96A5893F5A6E1D66D106633
                                                                                                                                                                                                                                      SHA-256:5EDFEC8524F90FCC6A4A12C6312FB0E75660B414B4A361FD8DFF7D7684EF452E
                                                                                                                                                                                                                                      SHA-512:25046F3BDBCC135D0667089BEC1542B9CC6888DDA4EFB7627B5276D224DE0989DEE252A412A038FD076C681407178205C4BE6215250B5F724666078F876DA54F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..m.......4...7.......%...>.......T...4...7.......'...'...>.......H....sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.stringR.......4...7...........>...1...:...0...H.....format_output.new.AnalyticsWPSSetting.........4...%...>...2...5...4...1...:...4...0...H.....new.WPSSubscriptionExpiryDate3analyticstelemetry.context.AnalyticsWPSSetting.require...//144C502691AFBF8B4ACA0A00BD6395CEF86744E2D59E65237134A4826AF49A1826E5CB972FA27BFD090A405AC9F3FDCCAB163D6BA4C3127EBF50E2B91E47CC7E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptionstatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):498
                                                                                                                                                                                                                                      Entropy (8bit):5.590424669892403
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:+lc9gmEtW+NG9kM5PsvcRu34GlbLb1J0NRu3pKeffpnnsEkcbKATO:+e9KtW+UaM+Z34Qb1J0NRu3keXJnXhO
                                                                                                                                                                                                                                      MD5:98D28F7C9EC12B6F0F6BCF2916AE84F3
                                                                                                                                                                                                                                      SHA1:F9E2A7B14A5DFCB9AC9CD48C9D0818244D233D6E
                                                                                                                                                                                                                                      SHA-256:0BE328D97C1ECAC0F5F6F8380F80287C7DB7CB11A09511DD3347986E4CB3A970
                                                                                                                                                                                                                                      SHA-512:3BD66A50CD7122A1CBEB722E4F5DDFA91D35D417725ABEA512AF432A9CD4C77FE17B3667D54C1A70481517359E86143C54425D537C1C995868C091481A7D5109
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...............T.......T...%...H...T.......T.......T...%...H...T...H...G....expired.Paid-Expired.Trial-Expired.active.Paid-Active.Trial-ActiveR.......4...7...........>...1...:...0...H.....format_output.new.AnalyticsWPSSetting.........4...%...>...2...5...4...1...:...4...0...H.....new.WPSSubscriptionStatus3analyticstelemetry.context.AnalyticsWPSSetting.require...//CF5F50DB9D65EBC53550C157DF2280054C09B3D5F80ADA39C20CB76F6D9B25046D6BC810A5CED6C8EE4587A3DC687BAFB94AC40516C3129FD4C753C64CFF7143++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptiontype.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):492
                                                                                                                                                                                                                                      Entropy (8bit):5.587751249830657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:ilc9C29IQ7WRi9G9kM5PsvcRu3uGlbLSYJJJ0NRu3pK4lnFYGRbi:ie9Cd+OikaM+Z3uQSWJJ0NRu3k4jvRbi
                                                                                                                                                                                                                                      MD5:DB37331D67F33A6B4A38C0FFA5DB4131
                                                                                                                                                                                                                                      SHA1:20CFEEEF3E6A3BC0562753975813B3065D26626C
                                                                                                                                                                                                                                      SHA-256:415F7C067CCD1B831C90FB524E70B9BEEBB7C0DC913E427018A47D610F24BFD1
                                                                                                                                                                                                                                      SHA-512:EE535E98409E48F6F8C3A98520762E13FF7724FEC1C59A218EC5FD06E7ACF4DB3991F620DCDE4A4531073E703ED1CE34A1251771E1ACC5BA5BBDBCFF9F98E7CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...............T.......T...%...H...T.......T.......T...%...H...T...H...G....paid.Paid-Expired.Paid-Active.trial.Trial-Expired.Trial-ActiveR.......4...7...........>...1...:...0...H.....format_output.new.AnalyticsWPSSetting.........4...%...>...2...5...4...1...:...4...0...H.....new.WPSSubscriptionType3analyticstelemetry.context.AnalyticsWPSSetting.require...//579D13043596F7DCECEBD1692AC5A38C84B7B85726B3347C5CFB13ABE308DC432429F64D463B27CE51421E34A328FF5D8495721AC59008308E31B387E36679C8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wsssetting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1244
                                                                                                                                                                                                                                      Entropy (8bit):5.806046090193304
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:DJHrK4xBwRf8FlNXqzngq4oxlOHbhNYSOaQrmAENhRxMCyjBmwkQAJmJnWgO:DJLlxBCU7ZuglqY7sSHAElxyBmwk3J+k
                                                                                                                                                                                                                                      MD5:790512EA3BA0ADB3D44EF3D93869ED8A
                                                                                                                                                                                                                                      SHA1:A5656777C957A50C6EED2656BA6BD47D773EEBC9
                                                                                                                                                                                                                                      SHA-256:AEA1F1721A86433348627B9781849FCD35B0EEB09D29EE9330C096F0B01F8AFE
                                                                                                                                                                                                                                      SHA-512:D97434063A12D970623BFD9A5DBC04A53E3C99F27E7A2F30EFFFE97AA86B88E19E370D634C2E7237C8347DAF105A497F642D7B12C46860F2F02C19F90B38BB21
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........H...........=%...+...7...>.......T...7.......T...7.......T...+...7.......7...%...>...H...+...7...7...7...>.......T.......T.......T.......T...7.......T...7.......T...4.......7.......>...........T...+...7.......7...%...>.......+...7.......>.......4.......@......tostring.format_output?MD5 function incorrectly hashed data. Using default value..MD5Hash.utility.MD5.hash_id.UNSPECIFIED.NO_APP.NO_SUITE.get_sub_db_setting>Invalid configuration for the WSSSetting context handler..err.m_logger.property_name.db_name.get_context_config.UNKNOWN........(%...+...7...>.......T...%...H...4...7...7...%...%...'...(...>.......7...>.......T...%...H...4.......7...........>.......T.......T...%...T...4.......>.......H......tostring.UNSPECIFIED.GetProperty.subdb.NO_APP.IsValid#SOFTWARE\McAfee\MSC\SubManager.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed.............4...7...........>...1...:...1...:...1...:...0...H.....get_sub_db_setting..get_context_string..format_output.new.SuiteStatusr.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wssversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):644
                                                                                                                                                                                                                                      Entropy (8bit):5.663122685050077
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:euuPgonhXPZqFRPYXxFvO3M5+QT39R5gflfA01JzKnFYi+aWhP:euuPgohRqzPQxFIMTTyff1JmFYi3e
                                                                                                                                                                                                                                      MD5:82010E13851109F7738A006401B9827F
                                                                                                                                                                                                                                      SHA1:5B2156E2C7ACDFB69653CD29B5708F42561D167F
                                                                                                                                                                                                                                      SHA-256:B194056B2C0F949B97C8DFE06F20C757E07AEA144E8102FD0CD66808F8E526B3
                                                                                                                                                                                                                                      SHA-512:B3497B66E0C82C6D56E8C1266244D7FCD28BED65092F0254170D484966CEFB1A8DA13C7B1C352968B97118C9677F5E63AE003888650A319C4567EF8437E09D55
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........#+...7...>.......T...%...H...4...7...7...%...%...'...(...>.......7...>.......T...%...H.......7...%...>.......T.......T...%...H...4.......@......tostring..ReleaseName.QueryValue.no_ver.IsValid.SOFTWARE\McAfee\MSC.HKLM.Registry.Win32.core.no_suite.is_suite_installed...O.......4...7...........>...1...:...0...H.....get_context_string.new.SuiteStatus.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.WSSVersion.mfw.core.Win32Helper+analyticstelemetry.context.SuiteStatus.require...//2FC2956DAC191BCC015C27823A356449ED234E197FDE489B4ADEA1C6066010B6AFB7C6C48B8EE18B31D9C7D23D749FECD758F5055CA13F792119EA04F2F40435++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2311
                                                                                                                                                                                                                                      Entropy (8bit):5.599391872787595
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:dqAt8sOzFU/BQJwyXJ/kRthJviCgscly3AZEhV6RhiJAOtXiBXjM:Ft8FqQtXdkRhngscw3FV6RhyAOtXiBXw
                                                                                                                                                                                                                                      MD5:56E0B81B5C1012E663524B6842239CAC
                                                                                                                                                                                                                                      SHA1:63D93D14753E129793FDCD9847D4C67F9FE4F5FA
                                                                                                                                                                                                                                      SHA-256:4FD01B16C17A91A7BA2430D8401178B7BD68EED01184B16174D5C02D93CF82E5
                                                                                                                                                                                                                                      SHA-512:091E2F3B3EA112DC240C1201FFFB9250A64A30397433C73024771E24D41EFCD9E619CA7C1AED961BA87CB6BD2D147A805F43D862B7354587EFC33D7719853F03
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........%...4.......7...)...%...%...>...........7...%...%...>.......4...7.......%...>...T.......T...)...H...A...N...)...H....([^,]+).gmatch.string.%s+.gsub.analytics_deny_list.GetOption.settings.........M4...7.......7...%...>...4...%...>...4...7.......7...%...>...4...7...>...D.7.+...7.......7...%.......$...>.......T.%.7.......T.".7.......T...4...%...7...$...>.......T...7...+...7.......>...7...>...4.......7...)...7.......>...T...+...7.......7...%...7...$...>...T...+...7.......7...%.......$...>...B...N...G.....4Invalid configuration supplied for the context #Nil handler found for handler .err.SetOption.settings.get_context_string.new analyticstelemetry.context..setting.handler.Processing context .m_logger.contexts.pairsgIn AnalyticsEventHandler's process_context_attributes before for .. pairs(context_config.contexts)6analyticstelemetry.context.analyticscontextconfig.require:In AnalyticsEventHandler's process_context_attributes.info.log.core........+...H.............,...G...........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticseventsconfig.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6421
                                                                                                                                                                                                                                      Entropy (8bit):5.486076446397746
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:wRFnBRzIk1BErj+w0qw92kCtczF1hEqM7MztF5CFJFDV:6dBqCuP9VyzFgqGcgFHZ
                                                                                                                                                                                                                                      MD5:72E2885D357F853CD2A7A7A0D041907B
                                                                                                                                                                                                                                      SHA1:CB70E98AC769BBAD8894B07842429B56B928243A
                                                                                                                                                                                                                                      SHA-256:BDE237747E668E0D5803B58682E766BCE2CB6A0B7E407CE079D344050F718B68
                                                                                                                                                                                                                                      SHA-512:8732F19B4227E19B03BD0EFF5D53CD8169EC0054F90052439F309715A45CD8BA5914286F8B7B192C0341319979980B2E002FF209EDCB0593A2D3F0EB48082CBA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...1.........3...3...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...3...:...2...3. .;...:.!.:.".3.#.3.$.:...2...3.%.;...3.&.;...3.'.;...:.!.:.(.3.).3.*.:...2...3.+.;...:.!.:.,.3.-.:...3./.:.0.3.1.:.2.3.3.:.4.3.5.:.6.3.7.3.8.:...2...3.9.;...3.:.;...3.;.;...:.!.:.<.3.=.:.>.3.?.:.@.3.A.3.B.:...2...3.C.;...3.D.;...3.E.;...3.F.;...:.!.:.G.3.H.3.I.:...2...3.J.;...3.K.;...3.L.;...:.!.:.M.3.N.3.O.:...:.P.3.Q.3.R.:...2...3.S.;...:.!.:.T.3.U.:.V.3.W.:.X.3.Y.:.Z.3.[.:.\.3.].:.^.3._.3.`.:...2...3.a.;...:.!.:.b.3.c.3.d.:...2...3.e.;...:.!.:.f.3.g.:.h.3.i.:.j.3.k.:.l.3.m.3.n.:.o.2...3.p.;...:.q.:.r.3.s.3.t.:.o.2...3.u.;...3.v.;...3.w.;...3.x.;...3.y.;...3.z.;...3.{.;...3.|.;...3.}.;...3.~.;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...3...;...:.q.:...3...3...:.o.2...3...2...3...;...3...;...:...;...:.q.:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticshandleonnavigate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):439
                                                                                                                                                                                                                                      Entropy (8bit):5.454995550876983
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:17jDBid/FPpPjGlbLpCCDiEiMJsYJJKxZeGhxbap:1/DBid9P9QpHDiEvJsPxc
                                                                                                                                                                                                                                      MD5:6915CB341073FB0333B92D25DC20FF1E
                                                                                                                                                                                                                                      SHA1:B829C7FEB95CFE4525BB20B04D4216A6CD972B1A
                                                                                                                                                                                                                                      SHA-256:7684D6B5DB9E5D043139535868D0A550A2C342AE512764BD656B39A7C8CA00B0
                                                                                                                                                                                                                                      SHA-512:DFEE051B61F4B56F75730DB1EDE516674F06628D3CB3203A63788123D2564424E32D9E4F87AC45D64B60EA5D60B82C3F9D2176E64198AC0B45BBC9B7BB5B0723
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..>.......4...%...@...)handle_on_navigation not implemented.error_.......4...7...............>...1...:...0...H.....handle_on_navigation.new.AnalyticsEventHandler.........4...%...>...2...5...4...1...:...4...0...H.....new.AnalyticsHandleOnNavigate4analyticstelemetry.events.AnalyticsEventHandler.require...//C6033701521C03C6B8C2A236F0B78D1612421EC6338A8082244B659E34CCA10E19B248E67DA4D96B5AD4E90671B0479AF5DB0C749D938DA04CE3CCB48E87B4B0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticstelemetryhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2050
                                                                                                                                                                                                                                      Entropy (8bit):5.655013472159574
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:bGqjTnzJ8UtVtiHJG0JbXS9mf+ZS9oFGtQt6MEKQVkJLr+b:XjB8ebipfRiYd+QFBk1Kb
                                                                                                                                                                                                                                      MD5:263807144F7F9D4114A1531C4B7B1E29
                                                                                                                                                                                                                                      SHA1:6699E2B97795AAF40582D8F22A51909436E0CF0A
                                                                                                                                                                                                                                      SHA-256:03CB349E795910A01F61D339F562D18DA3428C955BFB0E3B21835745DBADE849
                                                                                                                                                                                                                                      SHA-512:547E2C2CAE7EAF90A418F32F7BBE81C16966F043FD014D9A5E1BF7BCD10E20720ABC87A178B4B1576FCC0C1FD4CDF65B6FEB00EFDDE99A8AB45306D16DDF1B11
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........64...7...6.......T...6...H.......7...%...>.......T.......7...%...>.......T...%.......$...4.......7.......%...>.......T.......T...)...9...H...4...7...'...>...%...4.......>...$...4.......7...'...7...7.......>...)...H....currentline.short_src.Log.utility.tostring%Failed to load package. Error: .getinfo.debug..include.external.mfw..^core%..^mfw%..find.loaded.package......!...4...7.......7...%...>...4...7.......T...4.......T...4.......T...4...7...'...>...%...4.......7...'...7...7.......>...'...H.......T.......T...4...7.......7...%...>...'...H...4...7.......7...%.......$...>...4...7.......'...)...>.......T...4...7.......7...%.......%.......$...>...'...H.......T...7.......T...4...7.......7...%...>...'...H...4...7...7...6.......T...4...7.......7...%...7...$...>...'...H...7.......T...4...7.......7...%...7...$...>...'...H...4...%...7...$...>.......T...4...7.......7...%...7...%...7...$...>...'...H...7...4...7...........>...7...>.......T...4...7.......7...%. .7...$...>...'...H...'...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\blockpage.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2086
                                                                                                                                                                                                                                      Entropy (8bit):5.7237748509717274
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KeirvSzqyINuERXTDdL5wFip2GdQj14j6Q9RRRhQ00MuhXuS5g+i5BkJ0+KJyDo:zyvSzyDdL56LGSjWb9RRRC0ns3diA031
                                                                                                                                                                                                                                      MD5:F679FFD2B6FD34F3D42BB7A3D9FDFD9D
                                                                                                                                                                                                                                      SHA1:F473F2069C6E130189DBFF014380B24493B256D8
                                                                                                                                                                                                                                      SHA-256:721B218BEA71AAE61361D0DC28E05A8DA69FBF84236C1CD5F5B305BF92A4DC17
                                                                                                                                                                                                                                      SHA-512:5FF19792B1E93B2D4A2818F4198C364F6FFFBE306A9561380D6219FB9E509AB1BFF6B973EA447B5BCB7306686989A73531722322B45894043523D404BA60A2CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...)...%...'...>.......4.......7...)...%.......@....SetOptionInt"*AnalyticsCounterPagesBlocked.GetOption.settings.........%)...4.......7...)...%...)...>...........T...)...H...7.......T...7.......T...4.......7...%...@...T...7.......T...4.......7...%...@...T...)...H...G....msad.ads.blocked.Frame.msad.sites.blocked.PublishMessage.wssEventSender.Top.level.Typosquatting._event_name.*AnalyticsSendWss.GetOption.settings......).|+...7...>.......T...+...7.......7...%...>...)...H...7.......T...+...>.......T...+...7.......7...%...>...+...+...>.......T...+...7.......7...%...>...7.......T.(.%...:...7.......T...%...:...7.......T...%...:...7.......T...%...:...7.......T...%...:...T...%...:...7.......T...%...:...T...7.......T...%...:...T...%...:...T...%...:...%...:...7.......T...%...:...T...%...:...3...7...:...7...:...7...:...7...:. .7...:...7.......T...7...:.!.7...:.".7...:.#.7.%.....T...%.&.:.$.+...7.'.....>...+...7.(.@............transmit_analytics_event.set_analytics_event.de

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\browsernavigate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2017
                                                                                                                                                                                                                                      Entropy (8bit):5.603431850176971
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:NJheQtT4vddnM2HJdULzkDeNnru5Xt9HiKf/BeAJ3GTbJe:NTeQh4vI2HALzkDSq9C0A03sb0
                                                                                                                                                                                                                                      MD5:70EC6BB5DAD57C3E0296EA8569465FFD
                                                                                                                                                                                                                                      SHA1:4FB213DA0F6ADD082756EC758EA6EC8C7E554ABA
                                                                                                                                                                                                                                      SHA-256:0C366DB8980FEB5851D8E7A9EFD9F2A189E223EF182AC64D046EF4827DD2FBED
                                                                                                                                                                                                                                      SHA-512:AE9C73D252E5216482C11D7F0636FA40E9CE2488A3547CF104799E723754C7740EED9D1379A0F5BFF560CFB4C539F73A8C67D523DE0CBFAEBCFE297F8B5432DC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........*4...7.......7...%...>...+...7...>.......T...+...7.......7...%.......%...7...$...>...)...H...7...+...7...........>...7...>.......T...+...7.......7...%.......$...>...H.....'Failed to handle analytics event: .handle_on_navigation.new.handler. Handler: BBrowser Navigate handler does not exist for analytics event: .err.m_logger.get_analytics_eventIIn Analytics BrowserNavigate Handler's process_registration function.info.log.core........04...7.......7...%...>...4.......T...+...7.......T...+...7.......7...%...>...G...4...4...7...>...D...)...7.......T...4...%...7...$...>...........T...7.......T...+...3...:...:...9...B...N...G........config....handle_on_navigation.analyticstelemetry.events..require.handler.events.pairseA global analytics configuration mapping analytic events to event handlers has not been defined..err.m_logger.g_analytics_configSIn Analytics BrowserNavigate Handler's build_navigation_registrations function.info.log.core.........4.......7...)...%...'...>.......4...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\commonlogicloader.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1419
                                                                                                                                                                                                                                      Entropy (8bit):5.817255116338556
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:BJkJ1pQBwRdS0ZSFtGT7QwAmwk6mT/eB+kJRiuWeTSKUZSFgbM6A3sU5WRPe02H:MpawRdS0ZSTGTUwTwkrTGB+2CKUZSmY7
                                                                                                                                                                                                                                      MD5:64B0BB4595A3177810B46ED539FE53C3
                                                                                                                                                                                                                                      SHA1:7D49EA2A3B1C203FD5EF944173B3F675C9CACF09
                                                                                                                                                                                                                                      SHA-256:BE9310AC36349CAAB9F380422101F873AD66B760D3103B5D2EC149FDAD44EF07
                                                                                                                                                                                                                                      SHA-512:B430AE4746B5708E74E3E2A2B9EF1176F1330B0F27B0D9DFCF67EA7CD15C1B8FA0F95B80DFC8BFC33DDC4DD00F58CD57802A1C550667BC7AB58C116C1D15602A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...6.......T...6...H.......T...)...4.......7...............>.......T.......T...)...9...H...4.......'...>...G....error.include.external.loaded.package.........4...7.......7...%...>...3...%...4.......>...T...4...4...........>...A...N...G....requireFromLogic.pcall.ipairs.\logic\.....MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.type_tag_utils=Inside Analytics's CommonLogicLoader's requireLogicFiles.info.log.core........]4...7.......7...%...>...%...4.......7...>.......$...4...7...%...'...>...4...7...%...>...4...7...7.......%...$.......>...7.......T.5.4...7...8...7...>...'.......T.-.Q.+.....7...%...%...>...4...7.......7...%...........$...>...4...4...........>.......T...4...7.......7.......>...4...7...7...........>...........T...4...7...8...7...>.......T...T...4...7.......7...%...>...G....loadSSProvidersCode end.FindNextFile.err.requireFromLogic.pcall.Loading script: ...luc.gsub.cFileName.string.handle.*.luc.FindFirstFile.Win32.WIN32_FIND_DATA[1].n

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailycounters.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2602
                                                                                                                                                                                                                                      Entropy (8bit):5.86343317228234
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3WDj/EJhJ2TqHsZHNJeB50RmWnhFDm1rpy5t7CjXyOI0B2gzZ9IBlJEDQJkgSDt:3E/eh4TqH4zeMRmWhlmppKCjiVgsEEuT
                                                                                                                                                                                                                                      MD5:183E6EF0F1342B3A1FEA5A1D12C3F370
                                                                                                                                                                                                                                      SHA1:8F0E7D4BE660B30D430F5271D67424015B0B403C
                                                                                                                                                                                                                                      SHA-256:E81746A89C87B11BA0C31E51E93C9C32A72029F15F75A46524329A7A7A71721F
                                                                                                                                                                                                                                      SHA-512:0959FB22BDEBC32B9EC2F46E6161A8D3AEF3C6606F83BE8CEFBD1A156A40DEF2C61AA3125A9188154C190EB79F0FE75CCE875AC7577BEB64F2CC7675E25D9A3C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........d4...7.......7...%...>...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...7.......T...)...7.......T...4...7...>.......4.......7...........%...7...%...4...7...7...>...$.......>.......4.......7...........%...7...%...4...7...7...>...$.......>...)...H......SetOption.lower.string._.GetOption.settings.tonumber.default_no_value.in_context.prefixQAnalytics Daily counters handler called with an invalid event configuration..Analytics_DailyCounters.get_analytics_configBAnalytics Daily Counters handler was passed an invalid event..err.m_logger.triggerType.browser.get_analytics_event;Inside Analytics Daily Counters handle_analytics_event.info.log.core.......%...4...7.......7...%...>...+...7...>...)...'...)...%...3.......T...7.......T...7.......T...7.......T...7...........T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailyping.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2554
                                                                                                                                                                                                                                      Entropy (8bit):5.570854057069968
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:X8QEBx2Qh6/IHQ+OJdxrLz+mzLSDRN9Wh2h9lNKZFpjF3JAB9JPLJs4Cm:X1E6Qh6rvZLz+qmjpNKdjfwTqrm
                                                                                                                                                                                                                                      MD5:C7B160855B71C76228156917A0A4DEF2
                                                                                                                                                                                                                                      SHA1:B3670FC42B6932473361A08A9F32EA829276A99C
                                                                                                                                                                                                                                      SHA-256:21AB9A238676F8A79D96B31E4CAF18D701A5830AA65C9ED140B5442A3C84DD3E
                                                                                                                                                                                                                                      SHA-512:11CF5686F769EA9D2CE1416B6DC7E05AB496FFFA69ABA55F69952606847FFE8747ADC7B43EBEBEEAC471A85A71A498CCAFA31565CB174FBB5BB02400E2030A3E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........(+...7...>.......T...+...7.......7...%.......%...7...$...>...)...H...3...7...+...7...........>...7.......>...+...9.......T...+...7.......7...%.......$...>...H.......XTelemetry 3.0. Daily Ping's process_registration failed to handle analytics event: .send_on_ping.new....handler. Handler: CTelemetry 3.0. Send on ping handler does not exist for event: .err.m_logger.get_analytics_event.........2...4...+...>...D.......T...7.......T...7.......T...7...6.......T...7...7...9...B...N...H......metric_value.ping_metric_id.pairs.........4.......T...4...7.......T...+...7.......T...+...7.......7...%...>...G...4...4...7...>...D...)...7.......T...4...%...7...$...>...........T...7.......T...+...3...:...:...9...B...N...G........config....send_on_ping.analyticstelemetry.events..require.handler.pairstTelemetry 3.0. A global analytics configuration mapping analytic events to event handlers has not been defined..err.m_logger.events.g_analytics_config........$+...+.......T...+...,...+...7.......7

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingbrowsernavigationcount.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1145
                                                                                                                                                                                                                                      Entropy (8bit):5.907625019311047
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:wdy/QQrhZmwQgFThjClvVvgP0VvAFBiLKE1JdID0Vv+vJ/vJ5NY9WKc3jR:OQrDmOF0EAAFBC3cscJXJg0KijR
                                                                                                                                                                                                                                      MD5:A4B738411A6753B05285862E6F85B894
                                                                                                                                                                                                                                      SHA1:B3A4A0435776AA688B64D5997365102548EF33A1
                                                                                                                                                                                                                                      SHA-256:765BCE04CE2B84A317F31FB7FC1AC3FF5165F4E31582ABF5197C18743CBB6811
                                                                                                                                                                                                                                      SHA-512:C4B6ED9CF6EF37C058823531F31DFC8E43055838FC98BD6161E57F28D2800B95E4DC33097E6EBC3E4339891307DA579524FEEFEC840EB86C126E44FC805CCDE6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........?4...7.......7...%...>...+...7...>.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...2...4...+...>...D...4.......7...)...4.......$...'...>...9...4.......7...)...4.......$...'...>...B...N...7...:...4...4...7.......>...=...:...)...H........encode.json_parser.tostring.metric_value.ping_metric_id.SetOptionInt4ANALYTICS_BROWSER_NAVIGATION_COUNT_TODAY_PREFIX.GetOption.settings.pairs\Analytics DailyPingBrowserNavigationCount handler called with an invalid configuration..err.m_logger.ping_label.get_analytics_config:Inside DailyPingBrowserNavigationCount's send on ping.info.log.core.........4...7...............>...%...5...3...1...:...0...H.....send_on_ping.....ch.ff.ed4ANALYTICS_BROWSER_NAVIGATION_COUNT_TODAY_PREFIX+Analytics_BrowserNavigationCountToday_.new.SendOnPing.........4...%...>...4...%...>...3...5...4...1...:...4...0...H.....new$DailyPingBrowserNavigationCount....send_on_ping./analyticstelemetry.events.SettingsDBLookup)analyticstelemetry.events.SendOnPi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingbrowserused.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1385
                                                                                                                                                                                                                                      Entropy (8bit):5.653044652159739
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:fQUzw/owJFF/xo2VwU3kPwEy/QQrhz1NZbsJYlvV3HVEJBi8ISSEkVV6vJ/vJ5LL:xwJnYJzQrp1NZbs6eJBPzJXJx
                                                                                                                                                                                                                                      MD5:E7AA2F615C432CDACDC8B0A1C9BAC623
                                                                                                                                                                                                                                      SHA1:86E51CB557D358855581EDF2CA6BA9D474FFB92C
                                                                                                                                                                                                                                      SHA-256:645CCAE980461DE87C1B37C7A680CBDFF52325E2B7351834E9CD5010397E7842
                                                                                                                                                                                                                                      SHA-512:3966DA91F317E364BA33355744B34957D8B05CB66845B748DCE2AB2A669121E6202225E4739F54B1779534F89AD13383C68C98E0971E8CE8B111309F7ED2113F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........'4...7.......7...%...>...4...7.......>.......3...5...4.......7...4...6...>.......T...4...7.......7...%.......$...>...)...H...+...7...)...+.......$...)...@........get_setting$Process is running for browser .IsProcessRunning.utility.browser_processes....ff.firefox.exe.ch.chrome.exe.ed.msedge.exe.lower.string9Inside DailyPingBrowserUsed's get_browser_used_today.info.log.coreD.......4.......7...)...+.......$...)...>...G......SetOption.settings........34...7.......7...%...>...+...7...>.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...2...4...+...>...D...+.......>...9...+.......>...B...N...7...:...4...4...7.......>...=...:...)...H............encode.json_parser.tostring.metric_value.ping_metric_id.pairsNAnalytics DailyPingBrowserUsed handler called with invalid configuration..err.m_logger.ping_label.get_analytics_config/Inside DailyPingBrowserUsed's send on ping.info.log.core.........4...7...............>...%...3...1...1...1...:...0...H.......send_on_ping....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingmetriccounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1533
                                                                                                                                                                                                                                      Entropy (8bit):5.602525066998951
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:UuQRu0UeI7FcfXlvVulvDJNngnF3US2Pd3nimkctcXlvV54SGXgBiaxJmEDzfOBz:FagBHJNnQES2Ri1kSGQBlJjDaJEw
                                                                                                                                                                                                                                      MD5:04B119EA4E47D803B073706E3F0CA591
                                                                                                                                                                                                                                      SHA1:1F977FA5DF79E70F00824AA9B1467ADED4645B44
                                                                                                                                                                                                                                      SHA-256:8E51392E1AC69088A8AED6106E48F2CDA30F2B4A93822F73C893E5E785AA16D6
                                                                                                                                                                                                                                      SHA-512:9DE01BA228E9CBDC3FB080CFCE93A4735630875D1DE80B15D0655E4AB97B21EC9A07C2A73046631E7E7F7208B8FD8A1F2A14229F974064C682695FE55B1DF834
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........C+...7...>...)...'...4...7.......7...%...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7.......T...)...7.......T...4...7...>.......4.......7.......7.......>.......7.......T...7.......T...7...4.......7.......7.......@......SetOption.max_value.GetOption.settings.tonumber.default_no_value.in_contextSAnalytics DailyPingMetricCounter handler called with an invalid configuration..err.m_logger.setting_name.ping_metric_idAIn Analytics DailyPingMetricCounter's handle_analytics_event.info.log.core.get_analytics_config.........O+...7...>...)...'...).......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7.......T...)...7.......T...4...7...>.......7.......T...7.......T...)...4.......7.......7.......>...7.......T...7.......T...7...7...:...:.......T.......T...4.......7.......7.......@...T...)...H...G......SetOption.metric_value.max_value.GetOption.settings.reset_count.tonumber.default_no_value.in_co

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\domainnavigatedcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2990
                                                                                                                                                                                                                                      Entropy (8bit):5.858737800821815
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:N8nwvzod7Tdj/F01AwQ4B8i+TdJ8ZeKIk7kyNcZcjCHDuJ1QOG:CnczaxjdQPQY+f8ZeK4y+ZcGHaztG
                                                                                                                                                                                                                                      MD5:80A284B86E17C5C2383C544EE8D038AF
                                                                                                                                                                                                                                      SHA1:39B7D157C3B2074336C8475F4B4A59F568251017
                                                                                                                                                                                                                                      SHA-256:2B6BABE98DFE24846170F9007441C3C9CA4762BD9D8EF51182CAB0E45BEEB3D3
                                                                                                                                                                                                                                      SHA-512:1B15E89F988D33970BC7D5B803D629EE4E2697B108429574A14BF90EAC90713E31732DFE3A1611B72FBD8CCF8A02D107371234A78B440BA25D6DA6B044182C9C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..n.......4.......>...D...4...7.......7...>.......T...7...H...B...N...)...H....domain.urlMatch.match.string.pairs........)...H...........=+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...+...7.......7...%...>...)...H...)...'...+...7...+...>.......T...)...H...4...7...+...%.......%...7...$...>...4.......7...............>.......4.......7...............>...)...H............SetOption.GetOption.settings._.lower.string^Analytics Domain Navigated Counter handler was supplied a malformed event for processing..err.url.browser.get_analytics_eventOEntering Analytics Domain Navigated Counter handler's handle_on_navigation.info.m_logger.........D+...7.......7...%...>...)...'...)...3...'.......'...I.4.'...+.......'...I...4...7...+...%...+...6...7...%...6...$...>...4.......7...............>...'.......T...3...+...6...7...:...6...:...:...+...7.......>...+...7...>.......T...4.......7...............>...K...K...)...H..........SetOption.transmit_analytics_event.set_analytics_event.hit_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\downloadscan.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1661
                                                                                                                                                                                                                                      Entropy (8bit):5.662599418994416
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:nDu3jiHHXVWJuEflaCHo3EbRj2AZGrZ+8JzBJJeBJMsu:CjiH3V8aCiEbRjY40heBqsu
                                                                                                                                                                                                                                      MD5:F4680A0D76F266946D1E1E57787AE290
                                                                                                                                                                                                                                      SHA1:0F1771C55194FB0FEDE113C26767E26FDAB8540B
                                                                                                                                                                                                                                      SHA-256:0C235CB3A288F7E2465B076CE1D431AC370074FF6A6C23A2FCC39D2286A87A40
                                                                                                                                                                                                                                      SHA-512:DFFCD0A7528D5FC666D296EE30E105973ED28162C693630F9A077A6FC800E66D422C495E64BDB3CCBDE65B299CD8090E3DC447494551CAAC81C4ACF338F66324
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..X.......4.......7...)...%...)...@...&*DownloadScanSendProcessTelemetry.GetOption.settingsU.......4.......7...)...%...)...@...#*DownloadScanSendFileTelemetry.GetOption.settings........7%...)...7.......T...7.......T...4.......7...%...>.......T.......H...T.$.7.......T...7.......T...%...4.......7...%...>.......T...4.......7...).......'...>.......4.......7...)...........>.......T.......H...T...)...H...G....SetOptionInt.GetOption.settings.msad.files.blocked&*AnalyticsCounterDownloadsBlocked.Blocked.msad.files.safe.PublishMessage.wssEventSender.AcceptRisk.interaction_type.DownloadBlock.name..........B+...7...>.......T...+...7.......7...%...>...)...H...+.......>.......T...+...7.......7...%...>...7.......T...+...>.......T...%...:...7.......T...+...>.......T...%...:...2...7...:...7...:...7...:...7...:...7...:...7...:...7...:...7...:...+...7.......>...+...7...@............transmit_analytics_event.set_analytics_event.ui_type.hit_label_24.colour.hit_label_23.hit_label_22.hit_label_21.browser.h

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\heronerrorslog.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2413
                                                                                                                                                                                                                                      Entropy (8bit):5.751917441648925
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qT4t/7WpvjcfRzxIrPAaPpJ5JjWJCL7XYGjQJPUmQrMBSmJXRgAnDMJD39:qaiQRajJHJSCHXYGjHqXSgQH
                                                                                                                                                                                                                                      MD5:6456F2183ADD99474020ED498531C407
                                                                                                                                                                                                                                      SHA1:9678A3EA175B1F63A051A7BE61F7D893B1D1467B
                                                                                                                                                                                                                                      SHA-256:181A5656F036117846125133003C99F43DFBD1A69C9935EDC20703286A924B09
                                                                                                                                                                                                                                      SHA-512:CF55D6392F41A19059DC91FFE12287DF98049A6AB0E7178741293376893B239623C1BF028C953A028367A64126C16CB75DF70DBCAB610619637667BB5FA68BFB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........#...4...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......7...%...>...)...H...+...7...>.......T...+...7.......7...%...>...)...H...)...7.......T...7.......T...)...%...7.......T...7...4.......7...)...+...)...>.......T...+...7.......7...%...>...)...H...4.......7.......+.......>.......T.......T...%...T.......%...$...%...7.......T...%...7...%...$...%...7.......T...%...7...%...$...%...7.......T...%...7...%...$...%...7.......T...7.......T...7...%...7.......T...7...%...7.......T...7.......T...%...7...%...$...%.......%.......%.......%.......%.......%.......$.......%. .....%.!.$...4.......7.".....+.......>...)...H..........SetOption.}.{.,"metadata":.,"line_number":.,"error_code":.,"error_type":.,"function_name":."file_name":.metadata.error_code.".null.,.[-HeronErrorsLog heron telemetry disabled..GetOption.settings.default_no_value..in_contextGHeronErrorsLog handler called with an invalid event configuration..get_analytics_configPAnalyt

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\installedextensions.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1319
                                                                                                                                                                                                                                      Entropy (8bit):5.7216700075493465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:lFaWr5tiHRqBSCjsVudhKxQ6FF9K6FXyvjSBibq+rV+l3JDzfW1J5ZFVdUNEWVx5:lJ5tiHRqBSCjoqhqK3jSBSqKwbD6JzFU
                                                                                                                                                                                                                                      MD5:432C56CC5D6E640A55858F4B6582DED7
                                                                                                                                                                                                                                      SHA1:7FAD59D8AB1607F79444DE2A0D0D350043AE2EB6
                                                                                                                                                                                                                                      SHA-256:F39FECA59F9CC8EC013AC5E0736994ABFF11A427C7578269B9F4445E5A0C71DC
                                                                                                                                                                                                                                      SHA-512:601F589DB29E835E2545153299083B320A597642E64E5A0A7771F87BC9F9D70E176E930309B7A24D7D97E94FD5AEFDD91876A47518772C19846621DF63132AF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........)...H...........V+...7.......7...%...>...4.......7...)...+...'...>...4...+...>...D.B.4.......7...)...+.......$...'...>.......T...+...7.......7...%.......>...T./.4.......7.......>.......T...+...7.......7...%.......>...T. .+...7.......7...%.......%.......$...>...3...:...:...:...+...7.......>...+...7...>.......T...4.......7...)...+.......$.......>...B...N...G............SetOptionInt.transmit_analytics_event.set_analytics_event.hit_label_21.hit_label_20.hit_label_19...._event_name.wa_installed_extensions. is *extensions json payload for browser: ANil installed extensions payload so not sending for browser .get_extensions_info.browserSettings8Ver_to_send <= ver_sent so not sending for browser .pairs.GetOption.settingsHEntering Analytics InstalledExtensions event handler's send_on_ping.info.m_logger.........4...7...............>...%...%...3...1...:...1...:...0...H.....send_on_ping..handle_telemetry_event....ED...CH..1Analytics_Installed_Extensions_Version_Sent_3Analytics_Install

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\lowsearchusertargeting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3237
                                                                                                                                                                                                                                      Entropy (8bit):5.671190217775351
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:ZFo6qfgkI9Dszs2fDseVqrA5i/pH9ksapGGjwyPCr06d7L9C7/70OBCJrD2kJAnS:ZXDfOz0cqroi/pas+5ahLK70jr6k6nS
                                                                                                                                                                                                                                      MD5:0E018E77C844A549B3E415D2A90E7AD5
                                                                                                                                                                                                                                      SHA1:08E97716DFD91CAC66C9EFB8C6DE8DDF2FC5CB48
                                                                                                                                                                                                                                      SHA-256:273CC302B4C9111373C1503957E552FF334F1B3DE5E7816D4B319EE39713999A
                                                                                                                                                                                                                                      SHA-512:57D24EA4AA971EA36D6901EA57CBF2E72CCBC5587DAC13665B62BF4A43CBBF5BCA525A75BD4383767DDF5D58AD2C3E45BD51913F6A73C8047ACCB626AC34E02E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........0...4...7.......7...%...>...%...4...4.......7...)...%...'...>...=...4...4.......7...)...%...'...>...=...4...7.......7...%.......%.......%.......$...>.......T...4...7.......7...%...>...G...4.......7...)...%...)...>...4.......7...)...%...)...>.......T...%...T.......T...%...4...7.......7...%...4.......>...%...4.......>...%.......$...>.......T...4.......7...)...%...'...>...4...7.......7...%...4.......>...$...>.......T...4.......7...)...%...'...>...4...7.......7...%...4.......>...$...>...4...4.......7...)...%...'...>...=...4...7.......7...%.......$...>...4...4.......7...)...%...)...>...=.......T...G...4.......>...4...7.......7...%...4.......>...$...>...4...4...7...%. .....>...=...4...7.......7...%.!.....$...>...3.".:.#.:.$.:.%.:.&.:.'.4...7.......7...%.(.>...+...7.).....>...4...7.......7...%.*.>...+...7.+.....>...4...7.......7...%.,.>.......4...7.......7...%.-.....$...>...4.......7...)...%.......>...4...7.......7...%./.>...G.....9send_low_search_user_targetting_telemetry() exitin

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\navigatedtoday.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1396
                                                                                                                                                                                                                                      Entropy (8bit):5.579183931915572
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:jqHLCBuhF2pg49WdJs1bWWSAJWIKY7jJTMKJNzBibIvJvJZHrRDzf52vJsKH4UYC:GOwhXdcb3VA7Y3JTrJ1BSoJv3LRDeJ1R
                                                                                                                                                                                                                                      MD5:A2A28B6544E599C17C7E60E976884249
                                                                                                                                                                                                                                      SHA1:E197AF92405917AD9AE02131C195314425AB1E99
                                                                                                                                                                                                                                      SHA-256:6C1077FFD5E9F4715684ACD43BD4B5F276508C92B678729BBF2DC6F93D2B4566
                                                                                                                                                                                                                                      SHA-512:94F716023AD468690D78BD5D21B213DDA816ED55D1143077D5DB261447D5C7E470064E7D37AD2D3D6CE3D5E395FCE370132449BD1A55CA11CFED46B6CDC2B44C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........M4...7.......7...%...>...+...7...>.......T...7.......T...4...7.......7...%...>...)...H...4...7...7...>...5...4.......7...)...+...4...$...)...>.......T...4...7.......7...%...>...)...H...4.......7...)...+...4...$...'...>.......4.......7...)...+...4...$.......>.......T...4...7.......7...%...>...)...H...)...H.........aNavigatedToday Telemetry 3.0 handler unable to increment BrowserNavigationCountToday setting.SetOptionInt.GetOptionXNavigatedToday Telemetry 3.0 handler unable to set BrowserUsedToday setting to true.SetOption.settings.lower.stringXNavigatedToday Telemetry 3.0 handler was supplied a malformed event for processing..err.browser.get_analytics_eventAIn Analytics NavigatedToday Handler's handle_analytics_event.info.log.core..........4...7.......7...%...>...+...7...@......handle_analytics_event?In Analytics NavigatedToday Handler's handle_on_navigation.info.log.core.........4...7...............>...%...%...1...:...1...:...0...H.....handle_on_navigation..handle_analytics

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\pushnotification.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2990
                                                                                                                                                                                                                                      Entropy (8bit):5.64832248381332
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3ve3xKEKVwvdyJEZ6M3jYBjjWb8TBSif4PyVteSZrlMWuar7uLnU/XajyBSfJFWT:3vgKEKVwvdyA6Mqj48FpflteK5MxnUoC
                                                                                                                                                                                                                                      MD5:F81799F5E9DA604D046FF750CA8AF496
                                                                                                                                                                                                                                      SHA1:F4EE2AA82872B52CDB8A9CA9F567283906DC44FD
                                                                                                                                                                                                                                      SHA-256:ACE064A33E924480326215796496C7FDE558EFCE8785E89783176AD956AA356D
                                                                                                                                                                                                                                      SHA-512:F70ADF1F5DF9686A82100C966A434A9A77B6809CD385DFE5AE35930FC214A230B89925A3194272665FC7C87985CB6768A0351E56E027DC1FFDABA7BB493C96ED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........$4.......7...)...+...'...>...4.......7...)...+...'...>.......T...+...7.......7...%...>...)...H.......T...+...7.......7...%...>...)...H...)...H.........EAnalytics PushNotification ver_to_send < ver_sent so not sendingEAnalytics PushNotification ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......4.......7...)...+...'...>...4.......7...)...+.......>...G........SetOptionInt.GetOption.settings.........%...4.......>...T.......%...4.......>...%...$...A...N.......T.......7...'...'...>...........%...$...H....].sub.",.tostring.".ipairs.[........('...2...4.......>...T.......7...%...>.......7.......>.......7...%...>.......7...'.......>...........T...4...7...........>.......A...N...+.......>...........F......insert.table..:.sub.//.find.ipairs.w.......3...:...:...:...H....hit_metric_0.hit_label_21.hit_label_19...._event_name.wa_push_notifications.hit_label_20.ch^.......+...............>...7.......>...7...@......transmit_analytics_event.set_analytics_event.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\remapattributes.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1236
                                                                                                                                                                                                                                      Entropy (8bit):5.582895413037037
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:suOX0Rh2oyys12w+A9YOayYBKzYjbvEWYHht698eS69g5BidlJaQTJsPFn9F:dOXIXs12wd9YnyYkzYjLAme+g5BCJamk
                                                                                                                                                                                                                                      MD5:7ECF19552AEE19EF9B40077A28765FCF
                                                                                                                                                                                                                                      SHA1:711ABE165B26046D17978152EC8351F5921A05BD
                                                                                                                                                                                                                                      SHA-256:1939F2FF5E83566B7AB9F7E913A6E499FE13C2880CDB8DE6EE16638D9EB301FC
                                                                                                                                                                                                                                      SHA-512:32A8FA69C4F354ADF46EC128CEC2E2A87944DBCEB2C787F886A4843B97A612C3413DA67B2F8062E104333D6E15141DC6651090E0C4A28DDAFED06011917E7741
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........r+...7...>...+...7.......T...+...7.......'.......T...4...7.......7...%...>...)...H...7.......T...7...:...3...7...:...7...:...7...:...+...7...........T...7.......T...+...7...8...:...T...+...7...8...:...+...7.......T...'...+...7.......'...I.(.+...7...6...........T...4...7.......7...%...>...)...H...+...7...6...8...6.......T...4...7.......7...%...>...)...H...+...7...6...8...+...7...6...8...6...9...K...+...7.......T...+...7...:...+...7.......>...+...7...@........transmit_analytics_event.set_analytics_event.hit_screen8Malformed event passed into RemapAttributes handlerNRemapping part of config passed into RemapAttributes handler is malformed.remapping._event_name.Impression.hit_label_20.browser.hit_label_19.hit_label_18....name.interaction_type.action_type9Malformed config passed into RemapAttributes handler.err.log.core.event_names.get_analytics_event..a.......4...7...............>...1...:...0...H.....handle_analytics_event.new.AnalyticsEventHandler.........4...%...>...2...5...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchreset.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3304
                                                                                                                                                                                                                                      Entropy (8bit):5.524361602493551
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:iEvgKkKVwvdFHl10Hj2bdIWjRN5RlDNx1INjOI26VNPNEwixtPJP5:iEvgKkK+vjMKFPbx1IPHI/
                                                                                                                                                                                                                                      MD5:AE9D595CF445C0FC75ECBDEA470C7E61
                                                                                                                                                                                                                                      SHA1:3AD8B5FA1D78A85353417756F4C2DB8CABE4C8A3
                                                                                                                                                                                                                                      SHA-256:C27A87859D0DB75FC07923987408BCB1A6A9A10C1165487C2B66AA2E5468EA0E
                                                                                                                                                                                                                                      SHA-512:BA7807A912B47283C10E33E7A3FF1588B13E6F8ECC906CE8FCA84B2A96C775598686F052C5A51A5F629FBF924967C5A05DC0B448063D18BBD7AD008DC30108A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...4...7...%...>...=...4.......7...)...+...'...>...'.......T...'...H.......H......GetOption.settings.!*t.date.time.os........$4.......7...)...+...'...>...4.......7...)...+...'...>.......T...+...7.......7...%...>...)...H.......T...+...7.......7...%...>...)...H...)...H.........<Running processes ver_to_send < ver_sent so not sending<Running procceses ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......4.......7...)...+...'...>...4.......7...)...+.......>...G........SetOptionInt.GetOption.settings..........+...7.......7...%...>...4.......7...)...+...)...>.......T...)...H...+...7...>...,...+...7.......T...4...7...4...7...%...>...=...4.......7...)...+.......>...4.......7...)...+...'...>...)...H...4.......7...)...+...'...>...+...7.......7...%.......$...>...+...7.......7...%...+...7...$...>.......T.O.+...7.......T...+...7.......T...+...7.......T.C.+...>...'.......T...+...7.......7...%...>...)...H...%...+...>.......T...4.......7...>...........T...+.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchsuggestcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1597
                                                                                                                                                                                                                                      Entropy (8bit):5.817213114950578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:MrIZD16awmNbNSj2S0czDB+JJEDxJMQ6A:Mu1BJPSj2QkJEN2Q
                                                                                                                                                                                                                                      MD5:939F914D907EE211614743D6C6337C4E
                                                                                                                                                                                                                                      SHA1:724D0E6C8938AC2D42FCD000577968C259635C17
                                                                                                                                                                                                                                      SHA-256:3424796D0F81752B4C38705DA954CD06B496E42DF5474CB0CA8A7B58E6A07C14
                                                                                                                                                                                                                                      SHA-512:D492C3A4CEC0D4AA26DC0872DFAA0376994FADD5EBAB653C7E6A17EEEDA53B0B4307AFA555FE619F7EE8E0D69E4380AB432A5E9D2E0F2EE6C9B7E5DA30033CFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........A+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...)...'...4...7...+...%...7...%...7...%...7...$...>...4.......7...............>.......4.......7...............>...)...H........SetOption.GetOption.settings._.lower.stringHAnalytics SearchSuggest Counter handler was passed an invalid event.err.search_type.interaction_type.browser.name.get_analytics_eventDEntering Analytics SearchSuggest Counter Handle Telemetry Event.info.m_logger.........J+...7.......7...%...>...)...'...)...3...3...3...'.......'...I.8.'.......'...I.3.'.......'...I...4...7...+...%...6...%...6...%...6...$...>...4.......7...............>...'.......T...3...6...:...6...:...6...:...:...+...7.......>...+...7...>.......T...4.......7...............>...K...K...K...)...H........SetOption.transmit_analytics_event.set_analytics_event.hit_metric_0.hit_label_21.hit_label_20.hit_label_19....hit_label_18.SearchSuggest._event_name.wa_sea

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchterm.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4745
                                                                                                                                                                                                                                      Entropy (8bit):5.6884647749952135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ufJXUKbNOxIfjoc1pKtk8LhEPeLLscemPwH1ebhua+qJmzJ:ufGK18W8txPdemPwH1+BJoJ
                                                                                                                                                                                                                                      MD5:10F6C5567EBCB4F4A95AA76AEE90D475
                                                                                                                                                                                                                                      SHA1:07F6A0C8736981AE9C485B29A58DED126A77D665
                                                                                                                                                                                                                                      SHA-256:6F09CD02909B884EFD38DCDD07AB46A01807B4BA19EED8367B59B2424DAA115D
                                                                                                                                                                                                                                      SHA-512:1E19FA1D43957DAE2B48BF74DE775356D567ADE66B3E0C01AAEBDF20190F6BDCCDB5E1D177051E5012333E2E7C46031464C51F3175A9E9D30F0AA869582A8CFE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..8.......4...7...4.......'...>...?....tonumber.char.string+...........7...%...+...@......%%(%x%x).gsubc.......4.......>...D...4...7.......7...>.......T...H...B...N...)...H....urlMatch.match.string.pairs........04...7...........>...5...5...4...7.......4.......>...4...7.......%...>...5...5...4.......T...4...7.......'...4.......>.......+.......>.......4...7.......%...%...>.......4...7.......>.......H......lower. .+.gsub.first2.last2.&.sub.first.last.find.string.2.......+.......+...6...7...@........firstIndicator........F%...4.......>...T.>.)...4...7...>...T...)...4.......>...T...4...7.......%.......%...$...>.......T...)...T...)...T...A...N.......T...)...T...A...N.......T...4...7...>...T...4...7.......%.......%...$...>.......T...)...T...A...N.......T.......T...7...T...7...%.......$...A...N...H.... .category.exclusion.%f[^%w_].%f[%w_].match.string.inclusion.ipairs.........)...H.............+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\securesearchhit.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7894
                                                                                                                                                                                                                                      Entropy (8bit):5.69583977985513
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:GU5S4WUWw2t6H2oQ5IEi6e7P51JLpkA86Z7dRQ198Hxkh0thr39whPujUKU1Kp3V:GEcLaVbc98HxkhKrNwGy4C6B6aAkaY
                                                                                                                                                                                                                                      MD5:890CEEBD023A4813824278F62EAE291C
                                                                                                                                                                                                                                      SHA1:9DE0EE870880F797CE157F0A3118B27C116232A3
                                                                                                                                                                                                                                      SHA-256:42E364CE2AF6FDCBA50D9BA040357052EB1675B5DE1E2A52189A38685FB431E4
                                                                                                                                                                                                                                      SHA-512:105A1C85A6019F6129F04DE779B9000557AEC5EFFE31C5B50BE28CE375A47BEEFD4464C9DF4B0681B877671E7F52D59826D31F23841BEAB05C12DE918C6AC4F1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........4...4.......7...).......'...>...=...4...7.......7.......%...4.......>...$...>.......4.......7...)...........>...G....SetOption.tostring. - count: .info.log.core.GetOption.settings.tonumber.........$4...7.......7...%.......$...>...7...7.......'.......T...Q...........T...4...7.......7...%.......%.......%...7...$...>...3...:...:...7...:...H.......day., day: ., month: /Secure search hit add_month result, year: .month.year-Secure search hit add_month, num_month: .info.log.core..........!4...7.......7...%...>...4...7.......>...4...7.......>...4...7...........>...4...7.......7...%.......%.......%.......$...>.......H...., difference:., target_time: /Secure search hit days_until, start_time: .difftime.time.os!Secure search hit days_until.info.log.core...........~4...4.......7...)...%...'...>...=...4...7.......7...%...>.......T.f.4...7...%.......>...+.......'...>...+.......'...>...4...7...+...........>...=...4...7...+...........>...=...4...7.......7...%...>...4...7...>...4...7.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\securesearchtoast.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2738
                                                                                                                                                                                                                                      Entropy (8bit):5.773377646751177
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:GnNu1RNBjl20TH6TyDFFkKPuE/XMXjjQJjULso2X16RRwBrJ8v08WvJV1h:3dIquE/0jciL6IU8v07v7b
                                                                                                                                                                                                                                      MD5:1E3633511877B135BEBBC44D8596F3BA
                                                                                                                                                                                                                                      SHA1:F1B032B185FCC38D99431CA211FCA9BE9D02ACDB
                                                                                                                                                                                                                                      SHA-256:E139A0F3B0E6B0FF72462260501BEEA9FB1F1DB3519A58725F4D7A25BAB4EAEC
                                                                                                                                                                                                                                      SHA-512:89A4C8DD376FE966A843C1FB662D7B7C77DAE84977691C66A2DB0E3D904D2F668A301BD23F0023E6B4EE6729D9FBE719D9179D4F35CA0F1336B07EAB31DEA24C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ........>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...%...%...7.......T...7.......T...7...7.......T...7.......T...7...7.......T...4.......7...)...+...7...$...7...>...T...7.......T...7.......T...7.......T...4.......7...)...+...7...$...%...>...:...4...7...>...+...7.......7...%...4.......>...$...>...4.......7...)...%...)...>.......T.A.4.......7...)...%...'...>...'...%.......T.#.4...7...........>...4.......7...)...%...'...>...+...7.......7...%...4.......>...%. .4.......>...$...>.......T...+...7.......7...%.!.>...%.".....T...%.#.....$...T.......%.$.%.#.....$...+...7.......7...%.%.....$...>...%...7.......T...4.......7...)...%.&.'...>.......T...4...7.......>...'.......T...4.......>.......4.......7...)...%.&.'...>...T...4.......7...)...%.&.....>...3.(.7.'.:.'.7...:.).7...:.*.7...:.+.7...:.,.:.-.7.......T...4.......>...:...4.......>...:./.+...7.0.....>...+...7.1.>...+...7...>.......T...7.......T...7.......T...+...7....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\sendimmediately.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):571
                                                                                                                                                                                                                                      Entropy (8bit):5.39472540540094
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:guSXZf/f9emfvlauFkQySj3d2kuBid/9J+PdGlbL5IRMJsYJJK6ok4LXcEjDmv5:guEXB9NkOj3MHBidlJaQ5tJsP44Lfj45
                                                                                                                                                                                                                                      MD5:CC179A65526BA23300A9BFFA42D7D908
                                                                                                                                                                                                                                      SHA1:84F2129E1DDAF1FB31B062060E452325EFE4E58D
                                                                                                                                                                                                                                      SHA-256:72542691C7BF941C41FCAC21ED59ECDC25A8E046CCC5F0A209FD7C3CF0189E01
                                                                                                                                                                                                                                      SHA-512:B00D672B9CDF04816DF9CAD681DE0A91E1059EAC541C20DDE016E0E1D14EEC00C0F200B67C2B224D413B3E5D88143DBD23E2783CBA0B85B9ECDC11FCEF09F9A2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........+...7...>...7.......T...)...:...7.......T...)...:...7.......T...)...:...+...7.......>...+...7...@......transmit_analytics_event.set_analytics_event.flags.timeout.analyticsSDK.get_analytics_eventa.......4...7...............>...1...:...0...H.....handle_analytics_event.new.AnalyticsEventHandler.........4...%...>...2...5...4...1...:...4...0...H.....new.SendImmediately4analyticstelemetry.events.AnalyticsEventHandler.require...//E9D65996B65D174FE17F767DC4552D02BDDB62379B6B62B681CA7C09822503D6C456768148CC77B0D229AD8DEEA9C67E07455FB3F0FB2C33CB212E61D314B881++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\sendonping.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):407
                                                                                                                                                                                                                                      Entropy (8bit):5.477433384171874
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:5hBid/DNP9GlbLzFQMJsYJJKpFnbWHYCgpo:3BidLQzFZJsPjaH3gW
                                                                                                                                                                                                                                      MD5:C6BB8732688D68F6664569D21C89BF2D
                                                                                                                                                                                                                                      SHA1:E3C4EE7AFD06E6B27ED7C53135719FA83300F7BA
                                                                                                                                                                                                                                      SHA-256:A12D3E02F4355C78A5E3281FEAD0A25F5E4653958ACFED88D82F54EA7DB74E61
                                                                                                                                                                                                                                      SHA-512:D7B0E5FAD5C09A5729FD9391D9C9412EA5A0DA582190CA5F7076F49184E5431EEF2AD9A3CDEBE7BBE53C7A6CF37CDF4D3C5959EBB2CE9D0D4816B1DE60520106
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..6.......4...%...@...!send_on_ping not implemented.errorW.......4...7...............>...1...:...0...H.....send_on_ping.new.AnalyticsEventHandler{.......4...%...>...2...5...4...1...:...4...0...H.....new.SendOnPing4analyticstelemetry.events.AnalyticsEventHandler.require...//34593D090E6C32B38D72A536256813B343C06C42CED1D7743AF11EC1F8D895A14081FBB20ED7A5BB68F7A7C7DD961B94FF83ACD1185B8CA9ABE514946F4B8AA7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\settingsdblookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                                                      Entropy (8bit):5.536368643039731
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:5gPyr0iO0jRjRmzSAXmZcWRNRYvTooOH620gaAyXGVAdzhlJ2ygZgkREdS9dH/jB:aq3xmm+W3RYvfOH6eaAQ8mzl232E90g
                                                                                                                                                                                                                                      MD5:4C3AA1900EBE84EB9A1B946474FEF016
                                                                                                                                                                                                                                      SHA1:2AEF35F153E6D941682FBEADEE65A6409E52E4C8
                                                                                                                                                                                                                                      SHA-256:6E0BFCEEC8BB9E3FDA25F50391F48B7DBA4EF592E46083B4780AAC216949E8FB
                                                                                                                                                                                                                                      SHA-512:1DC1B9B045FA5768777C991A2DBE0455A7AAAAE25B75DA6FF0F4596DF6310CEB70032064F542957062BAC22DB895EF5B538838A9CF4496C07966441FEF16AAFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ...........%.......T.......T.......T...4...7.......7...%...>...T...4.......7...............>...........T...%...4.......@....tostring.GetOption.settingsAInvalid parameters supplied for get_setting helper function..err.log.core.(.......2...1...:...0...H.....get_setting...//4D8C8739D58D327ED5C7CD446D3BEB0D28D1CB9557CDDA824A0D5351E270D6ED92A3DC95487749A983F6A00B57FFFC0C9848B0288F111A0CFE654EC6970C6B85++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\smareputationcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1647
                                                                                                                                                                                                                                      Entropy (8bit):5.833674174075441
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:y6V/NtwIgf3Naf46Kj09dXoizDB+JJKD+kJ+t+h:V/NtRgfEw6Kj6dXzkJKrCI
                                                                                                                                                                                                                                      MD5:EF70C5B9C740F6B42E17310E05255436
                                                                                                                                                                                                                                      SHA1:8F3273D436893B7B4EA7676EAC1A6AE46B0548C9
                                                                                                                                                                                                                                      SHA-256:FD3676543FB7F0AB576AF48CAB893D90CFF492C5F2A33A7D48B46DC794C2E65A
                                                                                                                                                                                                                                      SHA-512:CBEC18FC2519EDE7BDD787CB469C5B24E1A5EFCB4751D3C2DBDD193C1D22C24529D5E5883BC73ADC58B53C81050907793202020366E10C31D514F7132B5128E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........C+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...)...'...%...4...7...+...%.......%...7...%...7...$...>...4.......7...............>...7.......4.......7...............>...)...H........SetOption.GetOption.settings._.lower.string.defaultFAnalytics SMA Reputation Counter handler passed an invalid event..err.count.color.site.browser.get_analytics_eventEEntering Analytics SMA Reputation Counter Handle Telemetry Event.info.m_logger........Q+...7.......7...%...>...)...'...)...3...3...3...3...'.......'...I.>.'.......'...I.9.3...6...:...6.......7...>...:...)...'.......'...I.".4...7...+...%...6...%...6...%...6...$...>...4.......7...............>...6...9...'.......T...).......T...4.......7...............>...K...+...7.......>.......T...+...7...>...K...K...)...H........transmit_analytics_event.set_analytics_event.SetOption.GetOption.settings._.lower.string.hit_label_20.upper.hit_label_19...._event

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\wssanalytics.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):856
                                                                                                                                                                                                                                      Entropy (8bit):5.566845685454563
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:ZUFEIGeDQTSJ9AnuZ+nzwEmwBihQlJg/QBtJsPGjOmPq:Z40TSJMuZ+zzmwBRJmktJ7lC
                                                                                                                                                                                                                                      MD5:D4633D1CF750BE19C2804321F1CDEE65
                                                                                                                                                                                                                                      SHA1:835E728276CAE648FF257A23B0FBF5E45B3A0E2F
                                                                                                                                                                                                                                      SHA-256:A7387553A9F16FCCE800235AB5198F103CC81B8E90606E40CEED82B8C1A9F0DD
                                                                                                                                                                                                                                      SHA-512:B53854B5EB2286B69B3847EADE03156B6B7080DEEBC565CE07C34891994A05D8BAAB130B00C99E25AB11A9182734BFD8C7B8BB7A93B42DB6BC416959EE0771BF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........0)...4.......7...)...%...)...>...........T...)...H...+...7...>...,...+.......T...+...7.......7...%...>...)...H...+...+...7...6.......T...+...7.......7...%...>...)...H...4.......7...+...7...@..........PublishMessage.wssEventSender>Invalid message passed to WSS Analytics analytics handler.messageQEmpty analytics telemetry information returned when processing WSS Analytics.err.m_logger.get_analytics_event.*AnalyticsSendWss.GetOption.settings.........4...7...............>...3...1...:...0...H.....handle_analytics_event....msad.files.safe..msad.sites.safe..new.AnalyticsEventHandler}.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSAnalytics4analyticstelemetry.events.AnalyticsEventHandler.require...//0D57CCAC4A0EC5184AB156150D86485469E5CBCE84F64D1B64AA81DE2636BCB288A4BABCB25FAC8109F1806D9AE858D2BBAD913EBB9EA49CAB57A03D09B575FE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\wssanalyticsraw.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):705
                                                                                                                                                                                                                                      Entropy (8bit):5.574294022810492
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:n+oUk4lj/Cx6WfEFyi9AnuyzRu+nGpIjbpZIf0NBid/9J+PdGlbLOoMJsYJJKgk5:RUFj/Ycyi9AnuZ+nzwcNBidlJaQORJsN
                                                                                                                                                                                                                                      MD5:EC12756315F35D496B0C4279FD498247
                                                                                                                                                                                                                                      SHA1:B887DDAB929A6697569C41A7EA46B8CA3FA58F82
                                                                                                                                                                                                                                      SHA-256:04412CFB4A01B472C05DD51EC2F1684DFD20880C33147EF6102762E9502A6FFC
                                                                                                                                                                                                                                      SHA-512:7D12A911E1B1DE877B3408B9EB97A10E98A3041DC1EBF7222E88AE1E1D0DABF7645B9B10467AF87F61AB89642A0B321A231B4A3A88DCAD6D1211E3ED9358420A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:.LJ..........")...4.......7...)...%...)...>...........T...)...H...+...7...>...,...+.......T...+...7.......7...%...>...)...H...4.......7...+...7...@........message.PublishMessageRaw.wssEventSenderQEmpty analytics telemetry information returned when processing WSS Analytics.err.m_logger.get_analytics_event.*AnalyticsSendWss.GetOption.settingsa.......4...7...............>...1...:...0...H.....handle_analytics_event.new.AnalyticsEventHandler.........4...%...>...2...5...4...1...:...4...0...H.....new.WSSAnalyticsRaw4analyticstelemetry.events.AnalyticsEventHandler.require...//22BE2655D9EF7025EFF4FBA17E30091D84414044CAC293A219391477412AFEFA11EAC89761472930A6623954144CF343C57E84FD67DE0EE23BD1417463BB0534++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\browserhost.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3907520
                                                                                                                                                                                                                                      Entropy (8bit):6.420718802860094
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:1BPIOnx10wSUTZiPBbY/mLxYFrzmUtSXoEUrQW/iPkJSDzMORNOJ3RFoM74/2wfz:LPpXvSDzMUsJ3RFo0K2buAKDIIcA
                                                                                                                                                                                                                                      MD5:F413A954CA8F508D9E3BE2B9D8CB866C
                                                                                                                                                                                                                                      SHA1:2CE2FB3F5C3442AE7A6AA887B15345DD8BA4A3ED
                                                                                                                                                                                                                                      SHA-256:37E262FDAF125C0EA9BC312F6615F3400B02C0702FA6D4CE4F26C2AB3598BCA4
                                                                                                                                                                                                                                      SHA-512:86D88E5CF6C633ED4A5FE71C2E60A1A86BFCA13D19B8E51BF5C30DF364CB869AAB6019CECDFD620ADE0482B0ED0C4FBDD0D142D69B7EE7F530625BD566EBAC35
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......~.{.:..]:..]:..]a..\1..]a..\...]h..\)..]h..\0..]\..]8..]h..\T..]a..\/..]a..\8..]...\;..]...\<..]...\;..]a..\+..]:..]...]...\{..]...\...]...];..]...\;..]Rich:..]................PE..d...Ij1e..........".......+..<........&........@............................. ;......#<...`..................................................4.......:...... 8.\Y...B:..]....:.Lm..@.1.p.....................1.(.......8.............+.......4......................text.....+.......+................. ..`.rdata...8....+..:....+.............@..@.data...T1....4.......4.............@....pdata..\Y... 8..Z...r7.............@..@.didat........:.......9.............@..._RDATA........:.......9.............@..@.rsrc.........:.......9.............@..@.reloc..Lm....:..n....9.............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5985656
                                                                                                                                                                                                                                      Entropy (8bit):7.997073443075553
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:98304:T+PQByUNM+wti12AJyTJs6mEzHohlciWocwyJ6TW9TFIfvxzNfuTeaFfPzemlu:i4ByU6+JyTKbEDoXciWoSdF+vhNf4TeV
                                                                                                                                                                                                                                      MD5:EFADC0D22983A99516DDBFBA3FD6F1A5
                                                                                                                                                                                                                                      SHA1:A64D75E07B8535FC7F71F33684CEB852E6784FA9
                                                                                                                                                                                                                                      SHA-256:B4F29215D91B81325283EA358CB73753D53392874637C501F3009F0718091461
                                                                                                                                                                                                                                      SHA-512:479F98D3D2C868F7189F09669A92F941979679F60525229F917F8B351BFCDEC8873E8D69D3153515F660A80D666E5F4A0DF8CC00F59EC1B423AE1DFD48C8B6E8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:PK............................app_launcher.js|Uak....._1..?.,r\...x.4.B.>..O.R......2;.+\.........Z.v.sfV^..... ...ww......Ow.........>.....{..-C^......<.7......#...!..j.:...G...`..........h....k.s.B...@q..@...HV...M.a'..~."E,'.N].."%.9[.O.R.O.....h@.j...,o',.9...../.^bLR.0i3.'.....)D........=K..M.V...B.;1.#`.Ta......3;;va...Hq..N...E..<.d.O%<...XX.2..`....FI.+W.H.t...`l3Fc.v6me.E....!1.5...O.e..c..]w.L.M........N.c.B.U...6.`..H...H.<D..&.S...1L."t. ..Q3zVg..k..A.-.X.....i'h.Y$..p:l..i/=. Y.i$B.]....Is&U.......H...I.....J.l....Q`.x.Gh......H.l..n|.!<u.....5...]b..T....F..W....u.7'......|-<s,.....p}.....&.?...;. ....@..%%T...v.[.jz........Tk..p.UA..T.P.jvu..T..**....:SU.|..2....../..4.X...\....w-.^;\...y.bPTR.Rz&.K..f...C._.v..|~....0Y.y...W......u......fC.~..}..i.vL.]...+.cS.s..s.(.P...Cxm..?.4.c..:j..\>..9Iz.\-...}.\!pT.,...W..Fw..K..*p(..P.}9..E.(..Hf..*M.UP'.\.OC._.rm..y.P.....~.....;.8....a...O.,.Xe:S\(.r.%..."y...Ynu...G...@..#VY.(.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):358
                                                                                                                                                                                                                                      Entropy (8bit):4.783729084285157
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:3FF2b4FPeee/KabRVdUvFFyFlLulkNCZDZKMjeQoFeNCBHu4H4WsNCHERN2l7Y:1YJKadislLAj+9QoFdBOKjkRN2l7Y
                                                                                                                                                                                                                                      MD5:4BCE68B8CBF044EB70958BC6018D0F01
                                                                                                                                                                                                                                      SHA1:46B4482884D6062CF15E618B8035BD1E675A3EA9
                                                                                                                                                                                                                                      SHA-256:FE5A9A409388CD8E5D6AF76E3FC8E8708F697F2577886BC3B826B4D591CB4306
                                                                                                                                                                                                                                      SHA-512:0F3E86AEB29E202E2E36E4E1859AFED3F17CE65246E90291CA8413287B94798A42309EB27E5CFB67A0B48A8C6D14174FBFC3F36EBE25B7BD8D7800BB78671047
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "webadvisor",.. "path": ".\\BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fdhgeoginicibhagdmblfikbgbkahibd/",.. "chrome-extension://dbghilognjpbmkdcpjgodiieiflmlaeb/",.. "chrome-extension://iiloambhgijcaodolaknfhmcficdnaca/".. ]..}

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\edge.com.mcafee.webadvisor_v2.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):357
                                                                                                                                                                                                                                      Entropy (8bit):4.7907114893123115
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:3FF2Eas4FPeee/KabRVdUvFFyFlLulkNCZDZKMjeQoFeNCBHu4H4WsNCHERN2l7Y:17aWJKadislLAj+9QoFdBOKjkRN2l7Y
                                                                                                                                                                                                                                      MD5:BEEC1609B6AA63B29247C7C4805CBF32
                                                                                                                                                                                                                                      SHA1:A9AF06A9D648857FDFBB8BD0D1B6A49840FF0232
                                                                                                                                                                                                                                      SHA-256:BFFE531435235BF8801946B9BC8654A79727FD6D591DBB7BE173BE9A55FC6974
                                                                                                                                                                                                                                      SHA-512:36BBB47F67D2B112AF77759E637318CD79560156B3B5A1007FEE0CB0A9FDE3E26C99D980D2160DF0A730304A43D3D16D2F28742E44A5303B81C0FEAE78A176FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "webadvisor",.. "path": ".\\BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fdhgeoginicibhagdmblfikbgbkahibd/",.. "chrome-extension://dbghilognjpbmkdcpjgodiieiflmlaeb/",.. "chrome-extension://iiloambhgijcaodolaknfhmcficdnaca/".. ]..}

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\eventmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4595760
                                                                                                                                                                                                                                      Entropy (8bit):6.483853360511586
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:ybwb+Xrrg7YaLYkZMz03fM/S0orrrst6U6smaljX24B02YQBLIKZK/+5a09wxqxE:ykEwz8/L1K/sa09wxA2uTsLlFi6L14z
                                                                                                                                                                                                                                      MD5:E5349043F8B5E10BACBEA38B81DFB67D
                                                                                                                                                                                                                                      SHA1:C8F4C47A6CC0C0CD6747781192473934BCF4AB70
                                                                                                                                                                                                                                      SHA-256:FEBC433A137F32EEC85C985ABCAA92B78C45ED7454E62B697E1281C6B71559D1
                                                                                                                                                                                                                                      SHA-512:938170BA5670D87A55ABD0F67E2CA53EDAA4A55DEA1537F9CBC8BB7EE01C56E6F2EA506E3728337E93D36791009204D9B26F5BB7B22C1B6AE80B3683B9487EB2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$......."R.Uf3..f3..f3..=[..k3..=[...3..4F..w3..4F..l3...\].e3..4F...3..=[...3...F..g3..rX..d3..=[..g3...F..g3..=[..s3..f3..g3...]..&3..f3...2...]..'3...F...3...F..g3...F_.g3...F..g3..Richf3..........................PE..d... j1e.........." ......4..........a........................................E.......F...`A.........................................+?.P...`+?...... E.`....PB.......D.0....0E.xe..,,;.p....................-;.(...`.7.8.............4.`....&?......................text...#.4.......4................. ..`.rdata..D.....4.......4.............@..@.data........P?..:...B?.............@....pdata.......PB......|A.............@..@.didat........E......&D.............@..._RDATA........E......(D.............@..@.rsrc...`.... E......*D.............@..@.reloc..xe...0E..f....D.............@..B................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.457062531070689
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLGVuDl9IbNk1O:7rrSOX8BC0Bj5dXEC0BjyKSgDlyhkE
                                                                                                                                                                                                                                      MD5:2C63B7AFFE088C01AB5F20D5104E15DF
                                                                                                                                                                                                                                      SHA1:A5D6C4711A285ECE7EBCE9D7E022424EC4EDB4B6
                                                                                                                                                                                                                                      SHA-256:12B993EF6A1E24A033F837365B81D23285A44B8A2D7B4997731A0A2DCDE66755
                                                                                                                                                                                                                                      SHA-512:DDD71C0266807E92102ADC5396BB423437D711E6379590B8337BD82500D8CB70A4E6CB1240C8364CE90311EC969229EA5634E79CB5443C4782E6A38C4CCC87B4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//C5F0B43E00F5627EEEC2393F31E84E03519AA4F8BE9244C8A03E876842E437D46962E9871B7250D7615D7E2D8C7B3DCA63A88B85E23EAD23B7BAFD1C9D3D9030++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.4575923167906515
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLEulWlnnxXn:7rrSOX8BC0Bj5dXEC0BjyKS9gYnxXn
                                                                                                                                                                                                                                      MD5:04D6CFD2351BAC10CA5425269D1A9E14
                                                                                                                                                                                                                                      SHA1:01834871494D9CFEBD7297492A059F3C81156B35
                                                                                                                                                                                                                                      SHA-256:4504952D3DE20C1432B1D83959A91B7D989525A0C3CD66A5D052F78308F487C9
                                                                                                                                                                                                                                      SHA-512:8E2A1F4D09B87C8F6DA1D0865B97031745059974EFDD5990A5EF142611DF16B5C5BDAA694E56B919ED4CC8ABE4A19BAA8CA7DC8C6E6256EDA10EE5B3B42C49DA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//3A9F3C8F649DBE1566697AD22AF502965914F54401D874EAEF5489E526632285BEC469E711E47D9D55E26DB98DD5D0D2A12283C734E4B14C13D1EE46E45F55B9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.452832655007357
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLs+uM3ySBvVf:7rrSOX8BC0Bj5dXEC0BjyKSOjf
                                                                                                                                                                                                                                      MD5:500CF042BDE44B7480537A73F638DA68
                                                                                                                                                                                                                                      SHA1:E8D3CAF416A35A25F2F9900BB075374911E04604
                                                                                                                                                                                                                                      SHA-256:D33C0A5A9F49A58F2F62062C416A7F7272D2FF086B097A333D680975C527448C
                                                                                                                                                                                                                                      SHA-512:D7D6858FAA9D01ADF2AAB289D7ECDCEA0FA13D8A4977A8239EF40E258105D37E743EE3DE43673D513392B44294ED605A5492E82AEE5D7215DEA25C25C2DDC9B1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//78E4B005F00091A9BBA8C6FF7B202C37FBD4266C883AB9C788C43B50F87A05F1CFDEEDA0A0AEBDBDDA5956F856573FFF6877D2A657A8EFA63B6FDB625F9CCEF8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.462269411923535
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLKbmzY51:7rrSOX8BC0Bj5dXEC0BjyKS3bm851
                                                                                                                                                                                                                                      MD5:8F2C476904096330DD804923C943804E
                                                                                                                                                                                                                                      SHA1:DDB93B41F6FB6C56B52C13A894838944D785F398
                                                                                                                                                                                                                                      SHA-256:1F97B352FE44C92136749ECDC03EDB66CD83B09F6C30A736FF07860322C9061B
                                                                                                                                                                                                                                      SHA-512:F3EC6C431ADC24A34368BBA37F1BB0B94C5E46FB31CB407E9BB2C292EA5E837B19F9F84648D6EA0BAD6ECBD10D4D32016757BC0B66D7E8E09C7FD11D03342EE0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//575E452AC777F6963BA6E75571831F65210C2B5E192738255AF348F79D560D4AF2C79E0D7E3EBC6E62A3B9B2B0583023E453C2D75865871FCBEDD822AB0A33FC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.473701209105896
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7rrSOX8BC0Bj5dXEC0BjyKSHB9Bu1yaZQ:um8BC0d5dXEC0dyKSHzmB+
                                                                                                                                                                                                                                      MD5:13145CF41E44DCAE7BE843F6459CC052
                                                                                                                                                                                                                                      SHA1:39BF1C0E6D766B98FA06FA72EC0476AEA6BB5AE8
                                                                                                                                                                                                                                      SHA-256:A99A8A6144D0C27262FF975D2812D3B44797B1A04D1D57E10D383FE00174BBFE
                                                                                                                                                                                                                                      SHA-512:78C6958E9A649B940128D0F301E4E63CA3E7AF822EE233BF4E8FC3CF8306C2717520CDE98E54C631B1EA06658539847AA89F8D6AA9A633E0A16381333C671069
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//C8455F814B99D9A0475379993091A75FC2FEC3B16242079C496D5C16E2CB9A301241450D01593C204EE51BF7612BF3E70367CA96938A2ED59AA3F8979D692D10++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.4630470056002
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLyrWbT0n:7rrSOX8BC0Bj5dXEC0BjyKSjrf
                                                                                                                                                                                                                                      MD5:19C4B9D0B3BA1F8BEBCCE744239C6279
                                                                                                                                                                                                                                      SHA1:BA2847C98B84A43DDB575CACD2772A2F72CCCF96
                                                                                                                                                                                                                                      SHA-256:F3E36C005C9F13B431C01B4D98258F1B20C4B88980E3BAD5122812B4B1099A63
                                                                                                                                                                                                                                      SHA-512:0257335899FB1B115EC1E6CF2FF1A491B5FC8841B1C97D26AEAFE2FC800C282000AFB8DA85BDBFC6CB9CEE96EE05ADE30E559A9319190167F8A7FD891567089A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//F48BC0A207AFEE2797A73472CC751017EF15E00F8048740C617860AD76482E2208EF125E640D1C32A597401131CAA66B07649B0932228194BE40D0AFD9880415++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.462475194813927
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLQIFedPjd0:7rrSOX8BC0Bj5dXEC0BjyKSfd0
                                                                                                                                                                                                                                      MD5:728642C239AC3AB08864A4FED48E0BE3
                                                                                                                                                                                                                                      SHA1:B7CD240F8F03A381C13D1D4A833CD1047373AB5F
                                                                                                                                                                                                                                      SHA-256:B3371A4CB58F38CDAD46970F86235B9C19E8BFE1A0CC5FAEA567ED63AB8DC4D6
                                                                                                                                                                                                                                      SHA-512:3FCDFAC5D821615AD19F41EC4D87CAFAC18AA25A66FA7A04EC3C900024D3C49B582CF388B273DCD5DF3F5601138C06A02556948B873AB6B5CD9EA391E240B80E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//AFAC4DFC424738537692DC290977E76C894A0B9B8454E9D750F0D6EFA0EB70396309537EBBD2B0C6E2757469944DBC3BE8EE9CC8782C83A4AF717645F50E4072++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.456221156174318
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL/urqJ4b9amK:7rrSOX8BC0Bj5dXEC0BjyKSLfZtK
                                                                                                                                                                                                                                      MD5:C47772370CE4F7FD7DEA27C8997796DD
                                                                                                                                                                                                                                      SHA1:51F4D16A252E735972CD87BBFF7D9C87085E9C88
                                                                                                                                                                                                                                      SHA-256:35E7FAEBB0702815F56EEA8148A1C7A4F85B5AB22F08DDA4E5B06B22DDEF9105
                                                                                                                                                                                                                                      SHA-512:4B1582E039003CBB8DAF0964EAC040360947AD1DC45F11BCC257F164848E539CF2C929922203AC03988BF7052ABA0C15CE40525B4D7677039763DC08C476D2AD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//0E64429E0A9F843E0EC94EB3DF37E06143B391C576B919A5395E75F74EBDFEF45DF80F64DFCC06C8E962624D4DEDBC6FCB7B620130EAC7FD7940FF1EE0E3B546++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.474008739615887
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLuaQphAi2lQ:7rrSOX8BC0Bj5dXEC0BjyKSDhRWQ
                                                                                                                                                                                                                                      MD5:F1861FE2D0AD22983F09B68B5C66CACB
                                                                                                                                                                                                                                      SHA1:FCD2E94221C50BD4F8A051575462A49EDB544F39
                                                                                                                                                                                                                                      SHA-256:432C7D6707C051A2A5B6E855B78FB553A53ACA791D55467F21E4AEE2E139E9CB
                                                                                                                                                                                                                                      SHA-512:21E2020C41F0D954892B375E506DFACFA9BF77FE694ADCC9052834B7CF05B8EBAAEEDFD671F9F6C2481C3324458ADF1654A6E6888324E0B318E6A16CE80989A1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//06149726A79AD878008A6A9C6F23B086B8E36B560078A242662D5F21F736BF6CBAC71737D30D70450B9A814C16FB5E53996D437DB5FEC423E700AE1A34435FDA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.469613160083841
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLnLRmUSmMO:7rrSOX8BC0Bj5dXEC0BjyKSs8LO
                                                                                                                                                                                                                                      MD5:F59FFF57B797C922AA64D787CC2D96E4
                                                                                                                                                                                                                                      SHA1:0BA7BE67DBAD03F28AB10B244BE34E2366053790
                                                                                                                                                                                                                                      SHA-256:20EB03721430FFEEB0A669B65FAECB976BFFC6677D19FA47FE7A52295D04EDDC
                                                                                                                                                                                                                                      SHA-512:8AEC3B5972B28299E14075E138D3773D269248490B02FE24F1C688EA0EE6B54A3509045C236963B03108909342ECE071F74DC3ABD2C881A50C07988AF776680A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//536AC09A599AF9058A45A141AC3F06DCB258565AA9D99D874CB155736D44A797036FDE73BB44CE6794038292C22F44044C6CE46B8427C23CB5B032C146F0EBB4++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.460552508045365
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLdkHZ/T+S:7rrSOX8BC0Bj5dXEC0BjyKSP5/yS
                                                                                                                                                                                                                                      MD5:3F4A2766A6F5059E345D7E014605812D
                                                                                                                                                                                                                                      SHA1:8A12BE294926F26F013C86527F2B0A2892CBF9E6
                                                                                                                                                                                                                                      SHA-256:C6646DE89EFA612EA7EA6B20A1A42EEDDA35B2DCBBD9B36270FE4A3AB35F189C
                                                                                                                                                                                                                                      SHA-512:CC9B7936CCA2A603883AC16615539FD561FB5CD0A6655FB314971B69C10A19137D9CE92A57E32EBAA1833CF18916DE162560EC771405025AB28453E506C9245F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//8C74BBBC4B532BBAB1E492E3FF63BF4A6DEF7F478F1649A7CF56EAC7925BADAA618D15B02648C3C0021895D4926E9DB9AE3B2C7D9F63A143A05A38C7A2C0390D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.446422453660456
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLET/RPOx/O:7rrSOX8BC0Bj5dXEC0BjyKS3/M/O
                                                                                                                                                                                                                                      MD5:114F00B91B0A839BC59C13EECD969417
                                                                                                                                                                                                                                      SHA1:426A629227A573AC60F103C20D54389FEE58B7CA
                                                                                                                                                                                                                                      SHA-256:730474FDA92C5D06034E02C8E0F2EFB44C517D02413E11D04D5C9DA7A877FFE6
                                                                                                                                                                                                                                      SHA-512:5C16321F03D21ECC761E2D8F46387A4344C2B150D0BDB76EBDEDADFF12F6E999925CEB28C3925E569B41EDD08F7C63A13E3677D4EF4ED454B0813C598D21A110
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//CAA56B8AE7AB8A7499EDD9F2142DB3BE9A06DAE61625B5A5B64E3A33C654F67535B67291956E9D6044537E02ADAB6EF521B6E6C2672C0CB30D885DC8903C56B9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.445285532002276
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLuMiROHO:7rrSOX8BC0Bj5dXEC0BjyKSbMiROHO
                                                                                                                                                                                                                                      MD5:A16523E679479EB2345EDB8A03F4B95A
                                                                                                                                                                                                                                      SHA1:CF59E8F308528CBDF3B3FB94C7307D1AC8096E04
                                                                                                                                                                                                                                      SHA-256:A42B6C56F808FE6EAE9F35914384351D33FA595BA337F1DA7B174FF9C75B5025
                                                                                                                                                                                                                                      SHA-512:A02B71348E1C7B6DB4BD845C1E70A6350C8497F3DD0D0EEDA5798AE31257891DBA3324B1CE675171A2806A5FCE2769E3108108F1D322BEA81E4512662CB8C512
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//D50D438293DDE09E773541733B3BE64F7A7EB539C47BB7ADBE15B33DE7E7538F5BC0291EF30D2BE3E15E5E01E9D2CDD0B6141C761F02ED076A5DE11885EC5269++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.459928138102989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLjNhCJcDF8lRZ:7rrSOX8BC0Bj5dXEC0BjyKSOWskRZ
                                                                                                                                                                                                                                      MD5:0A165A8316A9B5B7D83E48C26B103BE2
                                                                                                                                                                                                                                      SHA1:46CCBB4E5583B5D66DDE75B8200530A24EA39598
                                                                                                                                                                                                                                      SHA-256:21C0F6C158ED8E31920F694C9448CE1EF95280FBA9AA90C202701CB4E0D60500
                                                                                                                                                                                                                                      SHA-512:F3D13507002E72A77DA78E1AE7A98B9AEA0C1756C792CA8A8C18A250AFFF2A36FFB13E0FA0BE88795B3EB1B93EEAB5CAD482FFEDE9A2842DC38BF88E88367F12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//9CFA0EDD6F37124B5C22851C49378D9350F921D085C3E994E97C57EE2D4918B7064FC26CE05D4026F977CDEAFA81A4F323AED49271FAC19AC43EE419004DE791++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.457234851314495
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7rrSOX8BC0Bj5dXEC0BjyKSfLShM2yDvz:um8BC0d5dXEC0dyKSWM2qz
                                                                                                                                                                                                                                      MD5:C60AF0552109D9CB29C7F0F3BC970D1A
                                                                                                                                                                                                                                      SHA1:BEA15F85D7AFF354E24D7DFFFBDB7A88076EAFB9
                                                                                                                                                                                                                                      SHA-256:B2AE71EE2E866FB5969C7F201A54DA6E0FC96515EAA583478B5B9B78960CD978
                                                                                                                                                                                                                                      SHA-512:F7976EC5D34EA281F73A09CBDA798BC7C40F98375558E66133FBA273E5167A4E856174D326C6B73E02078DEADCD530FD4A7DC162E0CC1D3503A1FC02819472F9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//7F35BBE0E6B4A1C6D6F4FE1A195CCCC79F5C04955176167B814DD3F4ABB599AB7DB0CDCCE2A9F66B7A9363C717B9BA816DEE882664AECD4D77034C35B3E8D088++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.463598625431088
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLqEU1RxnM+7ZR:7rrSOX8BC0Bj5dXEC0BjyKSV/LM+7f
                                                                                                                                                                                                                                      MD5:759EA8276509D69039F7CFC0B8707E54
                                                                                                                                                                                                                                      SHA1:95CE60D56462475C90AC4EF368BDCBA8B425F02C
                                                                                                                                                                                                                                      SHA-256:18FD89870B46B749E5761917A41E678C89B810DD73EAE63F69F2029FA538032D
                                                                                                                                                                                                                                      SHA-512:EF8B2E9F9335D8C7831D8B1568E0219E01BB6572570241C0D904BF62BFCCDB346D3CAE7A9D8D9FA93C5E63159C8E3A0D1A1D5F3EE40CF82E0765407691439E06
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//FB114B24728C898322B0252E590EBCB476AB5994E0B69360F7AF80AAA4EA986BC979C031A432738D3229B59C26FDBBF25233F27E11D9FF93A83AF6B41845B0AB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.4635987817635145
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLf2YjE9b/xO:7rrSOX8BC0Bj5dXEC0BjyKSjYjEvO
                                                                                                                                                                                                                                      MD5:ED628036F94DA54EFB8878B690D91B9E
                                                                                                                                                                                                                                      SHA1:CAE90BD827A7FFBBBD7B040D0D85F381594BA5BF
                                                                                                                                                                                                                                      SHA-256:5CA2C20958F3DDE9F771ACDC2196824294D5B9CAB7FCD541ECF181DDF7A375BE
                                                                                                                                                                                                                                      SHA-512:D38B2C4EFC220DD097A88F260D7D89AD1C229BB0628F0164132978D51741A80E2FB32EE3C004478DE5468126F306C858FE48F16E8C46EF6DB3783B77FBFFC607
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//F243CBD9C21488EF7C5BA3449F85900E9BF92E17AD4DD0A92B957A0481131D1848C4DF01F3A1E27391D6F52F7EEBB017822E3CD28B0EABC60908C2138B443AF5++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.445197535901985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7rrSOX8BC0Bj5dXEC0BjyKSgBXUoLCLmid:um8BC0d5dXEC0dyKSgBXNL/id
                                                                                                                                                                                                                                      MD5:05B1C706A2D0A8EC4AAC0C0735F47E52
                                                                                                                                                                                                                                      SHA1:7BCE6B2DF4A5D15BC63676B19F2E75FD1769A742
                                                                                                                                                                                                                                      SHA-256:0EE26194AA0479683A945CEBC2461B35FFE61B7A76DE4C696134FFCBB8E0DA7C
                                                                                                                                                                                                                                      SHA-512:3DC0FEACDE82948BC4C59D42375A298A53BFFA1023358886925FEA6A8465D38DC660AC2A7975E21A630823B3876F550F7E1DD92A1708F98278ACD2ED3A87BBAC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//BA1DA56EB3A2607A32832CADED8BE3D26FEEB874FF9FD42F3D1E0E0A7AA2D984ACB31E27FCB9FE63B19F8E807B227AE6F363F5348996F0F8456C2C5CE8F6B74A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.46942216703476
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLMHwtKKYReWR:7rrSOX8BC0Bj5dXEC0BjyKSwKzJR
                                                                                                                                                                                                                                      MD5:56DA883ED1B29AFF30506655E2F1F923
                                                                                                                                                                                                                                      SHA1:16E41E7F64595FAEF4824556D91FBBBAAD5A2290
                                                                                                                                                                                                                                      SHA-256:2B0C004841479710CDBF4E1DC9219CAD1392914812CD00820B5DF860AC0C6AD3
                                                                                                                                                                                                                                      SHA-512:04C8DC7FF9931BE8CA3E52F882036D21FE24920069EFA7CEF3E4B8270538D55D3F2228F84603D0B689F20F7FD57488283086F5C6C124AA8B65744EB2AE95FBCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//5EC6745BD9B2304CD9346E8D43358153B0EC643FD6B3FC8A5583CF7D3F9FA4A82A0F5581A892A4E92BEE6DA6747D53F637E2850B5A66DC6B48B1676901F3D862++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.469574752733979
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLgA7B9+EvO:7rrSOX8BC0Bj5dXEC0BjyKSQ72t
                                                                                                                                                                                                                                      MD5:39FBC7A836C6A9A9BEF0AC58673D602D
                                                                                                                                                                                                                                      SHA1:6B5E20347FC819F8425F42903B3BC131574553E6
                                                                                                                                                                                                                                      SHA-256:BEC7BCB35131D24C8C375BB5D864B2C0B522720A6AA388382993CEF2D5C448D5
                                                                                                                                                                                                                                      SHA-512:35E7518C48AF05232BA3B33AAB4535BA1FDB2579F4C73A96660BC00D660E58FFEA856044206C8BC384178E26B8775522231187C6C75E6B66109BDA35D34112AA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//388F6AF6E65DBCE2C747549D5B4D46D5D931DA5D510F5933012A69DA6FDDE4AFF335B3791FC007C3AA5521E482B0361D75676F323A2B2CBB985DB2CD371168BA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.460896650516683
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynL/bRB+7s7mMyaI3W:7rrSOX8BC0Bj5dXEC0BjyKSWElII3W
                                                                                                                                                                                                                                      MD5:ED2BBB1D1DB33B6042CA25DD81C35018
                                                                                                                                                                                                                                      SHA1:AA6A74124BC820179AEB7CAE588D136BA6072045
                                                                                                                                                                                                                                      SHA-256:7A7C9DEA09769BC7E2D33E2A98BCBD0DB3372C48D5C5C625005CDD237E6A44E0
                                                                                                                                                                                                                                      SHA-512:086A9CBC42D2E6BA3DF55B1703693E926228BA53A9671C133881BCA1A5E8408863E40E9FE5BE622254A0624F634E07E486BA6E6D226F3C56C2A4BB1F261D0F9C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//EC996BEB3661F429D0B70CBC24E5962A961E1A3C8C93172B6409DA9C7D6EDFB5D73DAB02DA20375C3D260A53E5082531A2B01F8A5F8CC40DB2067FEA8FD27BBF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.467856883034622
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLO2EOTHHPMn:7rrSOX8BC0Bj5dXEC0BjyKSiPnPMn
                                                                                                                                                                                                                                      MD5:E973F3585B323F14B0BB4BF717C2C432
                                                                                                                                                                                                                                      SHA1:2C1F47252D9E7E994E5225ADDC1469BC7E67EA0C
                                                                                                                                                                                                                                      SHA-256:CCF0474C676C87709A1D98108332E95880DB5C1DF79C02C2B5852D648E02616A
                                                                                                                                                                                                                                      SHA-512:C5DCCD763E75EB8ECA819BC0CDAEE461BFEBA2F6E1172764CBBE7AE7E40343CB0D26F3578C86BAC8B10EC9314B8ADAEBB60F84D7F52ED10898BD7D061BE37381
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//F15F66D98C087AA4185915CF450FA38197D1E150AF0DFEFC0F6147610333DEE53EEF901C8BF177497DB3D7E0155DC36E7FFA61C2C7D2030D3477C23866F68EA7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.470593121533814
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLc0gxjhZnGKComO:7rrSOX8BC0Bj5dXEC0BjyKSMIGK95
                                                                                                                                                                                                                                      MD5:2DFC038F1F25EC961BD374CC4746688B
                                                                                                                                                                                                                                      SHA1:7075EA88276FC26B03D3611DBA9F015C9CF63F17
                                                                                                                                                                                                                                      SHA-256:0F75D819C2E9F9A4D4FB42278D3E5C8A9D06B5256D1C81DEF2EF9C3711FFEBAE
                                                                                                                                                                                                                                      SHA-512:A96A68810A701F1A763A5202E654123D2E9FAB02DE8238A188E663377BE5FE6D417B8CB8CCB63FC97806D9D8DF12A925964CC967E3DF247CE340DA7681A1D1A8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//1D77B7340250E588FDBFCB5F0E18877500FE6458EC824116297725BDDA4845449CC2E58D2F4CBD8FBC1666C492B41D501773CE2E65F777D7AE1FE1C55433A495++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.460028903608339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLf6JQVf6SgS51dZ:7rrSOX8BC0Bj5dXEC0BjyKSbeASldZ
                                                                                                                                                                                                                                      MD5:0D785342A25247CA9003B7B9D037E3FE
                                                                                                                                                                                                                                      SHA1:2943F21E6AA9A448947BDB24FEFE639F6B01EF70
                                                                                                                                                                                                                                      SHA-256:25299DBC1364EBC47C4E656F9C5B972C59F63A7F8F3CBF0B8F083A3423B20EB6
                                                                                                                                                                                                                                      SHA-512:ED3C0C6C98EBE353065B4DE19FA89E22257E734FA439CB16F5DE2E5BC771B935CFA1F1B76296D0CA475B300A2178347466F570E04F1B7D585A2A0FC4327D7729
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//60ACE245215226914E5DA484150FE797D0C333F017E544AC161161CF90AAAFF0369E4A633D10F2991BEA9862B09BED4C19572BDDF358D944E6A3D12EF171493D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.456037342077777
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLfCkrgkK+cc/:7rrSOX8BC0Bj5dXEC0BjyKSonrgFi
                                                                                                                                                                                                                                      MD5:B973EC23CFFB723FEA68F8561B6EA662
                                                                                                                                                                                                                                      SHA1:3B39CBE8153950F9C6DD1672AE8A0B6ED0997A1D
                                                                                                                                                                                                                                      SHA-256:FA43AEA3678EDE64162E431F8DD7D8FAEACECD58C5DC04B814291B1D6E428B22
                                                                                                                                                                                                                                      SHA-512:EA4D78E2F9902CFEAA00CB1670AC4B7435A39343BCC8D67BC5ADFD3A347AE2A4A64439645A4937AFE642C1DB6C98EB7D5CB3F13F07BE0DC10D647C37B92A8BF1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//B157263B6EA7B05AD27A98A5E4A4B269B610DCEED65B53C816681C5EB68CD063838FB8BDB21580794FA2AB7B03A4796B3FCE54BEFF2272273443D6BBB7C4DFB6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.455761366787283
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLQyDAOdHn5g2S0UgN:7rrSOX8BC0Bj5dXEC0BjyKSrbsZ7S0T
                                                                                                                                                                                                                                      MD5:907EDD42DF7B2041D7EDDEF4F8FC5D9E
                                                                                                                                                                                                                                      SHA1:AB9E9C28130CA7CDD64072F756F00EF24C749971
                                                                                                                                                                                                                                      SHA-256:21A84F5A3A4DD952E6A1BF79259A9D10C48C844FC9A1DF52B42D18D53BBF2CB5
                                                                                                                                                                                                                                      SHA-512:F9E1E561E4217F48F5D7DADF399C81A69DC97F5535EBAFBE453AD9DF4EED4ED1B4EE124381C0820E94FEC20A9261611367E0DDA3661867D05540E5913B98A524
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//CA2160C747D0CD707855805FCA47777CBA17E71830125AAA7FDF367A84F0AA8057C8357B68DBB615DA8E1BBCB0BFFC6910774DFC72B3A97051FBF89F1E4C1FD2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):803
                                                                                                                                                                                                                                      Entropy (8bit):5.4578324444250415
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7rBDjl+6mOX8BCNaBz3dumdjjECNaBz3duuqRcrSjynLX+j4WkWUB:7rrSOX8BC0Bj5dXEC0BjyKSj4R
                                                                                                                                                                                                                                      MD5:1C7F9452A0AF5E43BD088BF599A0CEA2
                                                                                                                                                                                                                                      SHA1:40DAC5BDC4DC1B11EB76E97707EE9CBB750C94F6
                                                                                                                                                                                                                                      SHA-256:CC3B5364B57E96E0C4882CB04DE6B882B1829C2C7C7277E4EB1B1F6DB06884DE
                                                                                                                                                                                                                                      SHA-512:68E719FE01634C3E80C056B80F4395033C15365FE83992EBB54D0627D25125BC172F94C5C2E627826E6666796C2669514FBEAC7E7F0D027FE5CF29715B7DC509
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrNewTabToast_ = {.. NEW_TAB_EXTENSION_HEADER_VARIANT_1: "New tabs just got safer",.. NEW_TAB_EXTENSION_HEADER_VARIANT_2: "A safer way to browse",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_1: "With industry-leading security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_CONTENT_VARIANT_2: "With McAfee security on every new tab, you can bank, shop, and browse with confidence knowing which sites you can trust.",.. NEW_TAB_EXTENSION_TOAST_ACCEPT: "Add extension",.. NEW_TAB_EXTENSION_TOAST_REMIND_LATER: "Remind me later",.. NEW_TAB_EXTENSION_TOAST_DECLINE: "No, thanks"..}....//34A9340FBF7EDAC6D0E6DA9B0BFC295557D59DC62F5A8F97FE81D7D6AC1DA8183752369A0AF90336258AB6AEE4EBF097B9E85972BDB981C1A77FBA42F19A0168++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5377
                                                                                                                                                                                                                                      Entropy (8bit):5.645379925283546
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:WQVBazY8QxuorbT6roQ/CZwmBrqtXNMDUaGCrW+NlaVy98ZDcT7ek81vY:WQvaz3AumireG6HYVygDcTqh1vY
                                                                                                                                                                                                                                      MD5:D3854AF68405E344A52E1DD70EDDA7E2
                                                                                                                                                                                                                                      SHA1:8DEEF7F53E82257C1B02D9EA4ADB21C78B3D2F72
                                                                                                                                                                                                                                      SHA-256:01EDBC10FC72B557758CA88301D2CC0815FD771E39F7E2182B7C8E2B312C83F2
                                                                                                                                                                                                                                      SHA-512:DFE3B660A4271B3F5D96617F320646130430C277B0D79F85FD1FD5597C758B2FA4139B47C989C57279135B1766F6751B0F55552D400325823C60480BE8E0DE99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Prob.h. skenov.n..",.. DL_SCANNING_MESSAGE: "Soubor, kter. chcete st.hnout, pro jistotu skenujeme.",.. DL_BLOCKED: "Zablokovan. stahovan. soubor",.. DL_SCANED: "Skenovan. stahovan. sooubor",.. SS_ON_STATE: "Bezpe.n. vyhled.v.n.",.. SS_FIX_MESSAGE: "V.born.! Tyto zm.ny provedeme p.i p...t.m restartov.n. prohl..e.e.",.. SS_OFF_STATE: "Je vy.adov.na akce.",.. SS_OFF_MESSAGE: "Upozorn.n.! Ka.d. des.t. hled.n. obsahuje nebezpe.n. odkaz.",.. SS_OFF_DIALOG_HEADER: "P.idejte k v.sledk.m hled.n. hodnocen. rizika",.. SS_OFF_DIALOG_CONTENT: "Ov..te bezpe.nost odkazu d..ve, ne. na n.j kliknete.",.. SS_SEARCH_OPTION: "Nastavit slu.bu Bezpe.n. hled.n. jako v.choz. vyhled.va.",.. THREAT_OFF_STATE: "V.straha zabezpe.en.!",.. THREAT_OFF_MESSAGE: "Po..ta. je vystaven hrozb.m, ale m..eme v.m pomoci.",.. AVFW_DIALOG_HEADER: "Antivirus a br.na fire

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5126
                                                                                                                                                                                                                                      Entropy (8bit):5.344464090919931
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:uZb3Bdp2fhG5TrVo8Ybuoo/tFCld/lwrYeCEUVlku/TzmV9S9hSFmUihQI:QCfhwrrYbuoG4Z+VchgmQI
                                                                                                                                                                                                                                      MD5:07E32B603DA78CFCDCE561024A2519D3
                                                                                                                                                                                                                                      SHA1:EA6AF28663B342C6BEFEDA1A5D6C94C760B10AE2
                                                                                                                                                                                                                                      SHA-256:546D77880E140593D621EB3207FB152DD3A829D7CACDB54CDAF42BF6414CE4C9
                                                                                                                                                                                                                                      SHA-512:BCC4651A1EA923572BAF0B58F7DBEA7D358A79E74E998096490FBDBA8276C4D28BE737430D208B523660F2B8FB8E9D5A264788512C8C12FD7FC36A271BAD170F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scanner .",.. DL_SCANNING_MESSAGE: "For en sikkerheds skyld scanner vi overf.rslen.",.. DL_BLOCKED: "Download blokeret",.. DL_SCANED: "Download scannet",.. SS_ON_STATE: "Sikker s.gning",.. SS_FIX_MESSAGE: "Fint. Vi foretager disse .ndringer, n.ste gang du genstarter browseren.",.. SS_OFF_STATE: "Der skal udf.res en handling.",.. SS_OFF_MESSAGE: "Advarsel: 1 ud af 10 s.gninger indeholder et farligt link.",.. SS_OFF_DIALOG_HEADER: "F.j risikobed.mmelser til dine s.geresultater",.. SS_OFF_DIALOG_CONTENT: "F. at vide, hvor farligt et link er, f.r du klikker p. det.",.. SS_SEARCH_OPTION: "Brug Sikker s.gning som standards.gemaskine",.. THREAT_OFF_STATE: "Sikkerhedsadvarsel",.. THREAT_OFF_MESSAGE: "Din computer er i fare, men vi kan hj.lpe.",.. AVFW_DIALOG_HEADER: "Antivirussoftwaren og firewallen er ikke sl.et til",.. AVFW_DIALOG_CONTENT: "Ca. 864 millioner stykker personlige oplysning

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5366
                                                                                                                                                                                                                                      Entropy (8bit):5.336473915775586
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:F20O91pUKtemTKjnkGzgUIzeRF9DQ8YMLOeaTkHzp1E9Cm6uUUZSO:F29CKteQKjnkGzwzeRN8hA1EEtBaL
                                                                                                                                                                                                                                      MD5:158A6B86D6707871103F085B3D0AE85B
                                                                                                                                                                                                                                      SHA1:B902D937A574DB34064B497E256CB2249515ED35
                                                                                                                                                                                                                                      SHA-256:AE97E185EE4A53466EB6738AEAFB7DC9790A2603FAB6C51782B0495779601502
                                                                                                                                                                                                                                      SHA-512:FD6F5DD18AD614720BB19163711E582187D01BD9BA745D9721C0E9F9AB763DCC2ACFDDA0D5DB816F9718D8EC126B515B12705CF6CD0767F39BB61CE366C7933B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scannen...",.. DL_SCANNING_MESSAGE: "Wir scannen den Download zu Ihrer Sicherheit.",.. DL_BLOCKED: "Download blockiert",.. DL_SCANED: "Download gescannt",.. SS_ON_STATE: "Sichere Suche",.. SS_FIX_MESSAGE: "Sehr gut. Die .nderungen werden .bernommen, sobald Sie Ihren Browser das n.chste Mal starten.",.. SS_OFF_STATE: "Handlungsbedarf!",.. SS_OFF_MESSAGE: "Warnung! In 1 von 10 Suchergebnissen ist ein gef.hrlicher Link enthalten.",.. SS_OFF_DIALOG_HEADER: "Risikobewertung f.r Ihre Suchergebnisse hinzuf.gen",.. SS_OFF_DIALOG_CONTENT: "Erkennen Sie gef.hrliche Links, bevor Sie darauf klicken.",.. SS_SEARCH_OPTION: "Sichere Suche als Standardsuchmaschine festlegen",.. THREAT_OFF_STATE: "Sicherheitswarnung!",.. THREAT_OFF_MESSAGE: "Ihr Computer ist ungesch.tzt, aber wir k.nnen Ihnen helfen.",.. AVFW_DIALOG_HEADER: "Ihr Virenschutz und Ihre Firewall sind deaktiviert",.. AVFW_DIALOG_CONTENT: "Seit

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8385
                                                                                                                                                                                                                                      Entropy (8bit):4.97036429913225
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:BYz3hNXL4xrlON0pOqxptk2xgthUE6wfOhLQvvsy:ULXUlObqTC2xgwmOhcvvsy
                                                                                                                                                                                                                                      MD5:96170DEF81B1B8EE3572033B9D4F2059
                                                                                                                                                                                                                                      SHA1:4305BF5113AF76DBBF693284FBBB633AAE14F056
                                                                                                                                                                                                                                      SHA-256:F18D9C7A8162BC11CB58D635A30551127C9D6665223E4311E90CBD2A10E33F42
                                                                                                                                                                                                                                      SHA-512:D2354DB541849FD221AED327757111E61F7F4C175DDF49CE7922362C0C9F3B6041D58E58A9798EE6D717E77F4285D489FD4B9F6FC3494DBCDBD6B3F6E9415854
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: ".........",.. DL_SCANNING_MESSAGE: "......... .. .... ... ... ...... ..........",.. DL_BLOCKED: ". .... ............",.. DL_SCANED: ". .... ........",.. SS_ON_STATE: "....... .........",.. SS_FIX_MESSAGE: "......! ..... .. ....... .. ........... ... ....... .... ... .. .............. .. ......... ...........",.. SS_OFF_STATE: ".......... .........",.. SS_OFF_MESSAGE: ".......! 1 .... 10 ........... ........ .......... .........",.. SS_OFF_DIALOG_HEADER: "........ ............. ........ ... ............ ..........",.. SS_OFF_DIALOG_CONTENT: "...... .... ........... ..... .... .........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4755
                                                                                                                                                                                                                                      Entropy (8bit):5.330293493969292
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:uU3x9/eMjflrS5xsyoBkXqLB+Qz/Q1wU9pYOosphJM:3x9Jjf2Kkm8GQ1NPjVDM
                                                                                                                                                                                                                                      MD5:8452D886996EF223FF0526904ED7D55D
                                                                                                                                                                                                                                      SHA1:7E48B6B39087A37A1112F8F080FA0F49B6444F17
                                                                                                                                                                                                                                      SHA-256:42A40BE4ACF1B975B4358B220CD77F0B7A2F5AD1482C67722DC1845074E0B096
                                                                                                                                                                                                                                      SHA-512:57413DD7979F9EFE456870289A0021D27665B57C14F49C03F2148AA60C4ECC5CC97E0A36C43E57E9B6200E608423D248CCCFBD392820837FEDA111BAE79B46FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scanning...",.. DL_SCANNING_MESSAGE: "We're scanning your download just to be safe.",.. DL_BLOCKED: "Download blocked",.. DL_SCANED: "Download scanned",.. SS_ON_STATE: "Secure Search",.. SS_FIX_MESSAGE: "Great! We'll make these changes the next time you restart your browser.",.. SS_OFF_STATE: "Action needed!",.. SS_OFF_MESSAGE: "Warning! 1 in 10 searches contain a dangerous link.",.. SS_OFF_DIALOG_HEADER: "Add risk ratings to your search results",.. SS_OFF_DIALOG_CONTENT: "Know how dangerous a link is before you click on it.",.. SS_SEARCH_OPTION: "Make Secure Search my default search user",.. THREAT_OFF_STATE: "Security Alert!",.. THREAT_OFF_MESSAGE: "Your computer is exposed, but we can help.",.. AVFW_DIALOG_HEADER: "Your anti-virus and firewall are off",.. AVFW_DIALOG_CONTENT: "About 864 million personal data records have been compromised through data breaches since 2005.<br/><br/> Don't browse

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5193
                                                                                                                                                                                                                                      Entropy (8bit):5.289454543730624
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:dRey5rMscODKKai5iihhi6VnRSyLK3yAEK9WOM0CKAXk:dUWr+ODhai5SknRSkNKPM0VP
                                                                                                                                                                                                                                      MD5:EA1D149475B8DE595E7F6548C2849589
                                                                                                                                                                                                                                      SHA1:B996EDAB6AF11C53077AB301B47A28D553386D8B
                                                                                                                                                                                                                                      SHA-256:070D076E1FA2DA12B2AA741EE3B2B445BF8B00B3DC00783D92BE868735CA45B9
                                                                                                                                                                                                                                      SHA-512:CC920E7633C8817033C491E894E78F44D5279BFE676519A74D624A8415ECE9BFCA0B6719556F9FF8D32EE739DE936146ACC79DBCD2F4E8D0586BDEBC9AAC3B85
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analizando...",.. DL_SCANNING_MESSAGE: "Estamos analizando la descarga por motivos de seguridad.",.. DL_BLOCKED: "Descarga bloqueada",.. DL_SCANED: "Descarga analizada",.. SS_ON_STATE: "B.squeda segura",.. SS_FIX_MESSAGE: ".Genial! Aplicaremos estos cambios la pr.xima vez que reinicie el navegador.",.. SS_OFF_STATE: ".Debe tomar medidas!",.. SS_OFF_MESSAGE: "Advertencia: 1 de cada 10 b.squedas contiene un v.nculo peligroso.",.. SS_OFF_DIALOG_HEADER: "A.ada calificaciones de riesgo a los resultados de sus b.squedas",.. SS_OFF_DIALOG_CONTENT: "Conozca el nivel de peligro de un v.nculo antes de hacer clic en .l.",.. SS_SEARCH_OPTION: "Definir B.squeda segura como motor de b.squeda predeterminado",.. THREAT_OFF_STATE: ".Alerta de seguridad!",.. THREAT_OFF_MESSAGE: "Su equipo est. expuesto a riesgos, pero podemos ayudarle.",.. AVFW_DIALOG_HEADER: "El antivirus y el firewall est.n desactivado

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5216
                                                                                                                                                                                                                                      Entropy (8bit):5.317891684926424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:zyErLx7VO33aiG/qshhi6VnRfylmDiP2QuyMLii9j0OsKbPQg:zXrXO33aiiMknRfyp/Haiitfzzz
                                                                                                                                                                                                                                      MD5:F2FAE8DE64422C814C9296DF22F68889
                                                                                                                                                                                                                                      SHA1:5687D0E2C821783B5488374712FB688525A0E4EB
                                                                                                                                                                                                                                      SHA-256:F136E244990ACDFEE269269FD13AB68C1A685E5F036E2052B7728DEBA557C0F5
                                                                                                                                                                                                                                      SHA-512:510253E16EB1D298B73B3F1D14F38FFDCC2EA640297CBD78D6993E80E15BFBBEBCC836BDAEEFCBC2B5AD6EE886078EB4D02393CF230303D2987DA38FB89CD718
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analizando.",.. DL_SCANNING_MESSAGE: "Estamos analizando la descarga por motivos de seguridad.",.. DL_BLOCKED: "Descarga bloqueada",.. DL_SCANED: "Descarga analizada",.. SS_ON_STATE: "B.squeda segura",.. SS_FIX_MESSAGE: ".Excelente! Aplicaremos estos cambios la pr.xima vez que reinicie el navegador.",.. SS_OFF_STATE: ".Se requiere acci.n!",.. SS_OFF_MESSAGE: ".Advertencia! Una de cada diez b.squedas contiene un v.nculo peligroso.",.. SS_OFF_DIALOG_HEADER: "A.ada calificaciones de riesgo a los resultados de la b.squeda",.. SS_OFF_DIALOG_CONTENT: "Conozca el nivel de peligro de un v.nculo antes de hacer clic en .l.",.. SS_SEARCH_OPTION: "Establezca B.squeda segura como motor de b.squeda predeterminado",.. THREAT_OFF_STATE: ".Alerta de seguridad!",.. THREAT_OFF_MESSAGE: "Tu computadora est. expuesta, pero podemos ayudarte.",.. AVFW_DIALOG_HEADER: "El antivirus y el firewall est.n desac

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4959
                                                                                                                                                                                                                                      Entropy (8bit):5.3104739880659775
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5ZZ4vNUD1ns7pqxqkRKk/eFt+2jiLRQoYWzZ0pu96M1cNi:PZ4vNlq4kRKkGSRcpuw4ai
                                                                                                                                                                                                                                      MD5:9D38E74F684DB0F2CBD2D65EB56319BA
                                                                                                                                                                                                                                      SHA1:FCAD74DC426F0271EF3534CAEA293EF66F25D141
                                                                                                                                                                                                                                      SHA-256:FB08901885207A9FE74D5B15A4B8E1BA156062A73A5EF3882745F89C5EE27133
                                                                                                                                                                                                                                      SHA-512:9F2E1F1FC76E612DC6FD06ECE136D515D705B413B543C7492BC397CBC0401693DFF6B9D4248FF05E2D3C485EDAEE1EA6B04DF4BBB5C3559BBB897F6EA163744C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Tarkistetaan.",.. DL_SCANNING_MESSAGE: "Lataamasi tiedosto tarkistetaan varmuuden vuoksi.",.. DL_BLOCKED: "Lataus estetty",.. DL_SCANED: "Lataus tarkistettu",.. SS_ON_STATE: "Suojattu haku",.. SS_FIX_MESSAGE: "Hienoa! Muutokset tulevat voimaan, kun seuraavan kerran k.ynnist.t selaimen.",.. SS_OFF_STATE: "Toimia vaaditaan!",.. SS_OFF_MESSAGE: "Varoitus! Joka kymmenes haku tuottaa vaarallisen linkin.",.. SS_OFF_DIALOG_HEADER: "Lis.. hakutuloksiin riskiluokitus",.. SS_OFF_DIALOG_CONTENT: "Luokituksen avulla n.et ennen linkin napsauttamista, onko se vaarallinen.",.. SS_SEARCH_OPTION: "Aseta Suojattu haku oletushakukoneeksi",.. THREAT_OFF_STATE: "Tietoturvavaroitus!",.. THREAT_OFF_MESSAGE: "Tietokoneesi on alttiina uhille, mutta voimme auttaa.",.. AVFW_DIALOG_HEADER: "Viruksentorjunta ja palomuuri ovat pois k.yt.st.",.. AVFW_DIALOG_CONTENT: "Noin 864 miljoonaa yksityist. datatietuetta on jout

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5692
                                                                                                                                                                                                                                      Entropy (8bit):5.295808362799397
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:0MxyhGiDkpQQrrENOqplZuFfrYnWv6HScq48Ky6o9Q+W55fTskdSb:0ZhGVQQrrENOqYIH2V6o/W5DQ
                                                                                                                                                                                                                                      MD5:5F08B3BABF3AFFB2530ACA5B71625FDA
                                                                                                                                                                                                                                      SHA1:E4E774326597046E59392E318CEE47010A31B3F4
                                                                                                                                                                                                                                      SHA-256:A79D00BB5096EC39F7D652D199F024E8AB3F8B9F7FDFF78EA0DF622D9ACBA074
                                                                                                                                                                                                                                      SHA-512:F3D72B3A8F8A29BBD40A6507832F46C44181391C12C85478DDB11CD34F17EB765B17D0D6BAA1A4252B15D26DD3381A19E44BC2C47B27B159930A8C98B5255784
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analyse en cours...",.. DL_SCANNING_MESSAGE: "Nous analysons votre t.l.chargement par simple mesure de s.curit..",.. DL_BLOCKED: "T.l.chargement bloqu.",.. DL_SCANED: "T.l.chargement analys.",.. SS_ON_STATE: "Recherche s.curis.e",.. SS_FIX_MESSAGE: "Tr.s bien! Nous appliquerons ces modifications la prochaine fois que vous red.marrerez votre navigateur.",.. SS_OFF_STATE: "Intervention requise!",.. SS_OFF_MESSAGE: "Attention! 1.r.sultat de recherche sur 10 comporte un lien dangereux.",.. SS_OFF_DIALOG_HEADER: "Ajoutez des cotes de risque . vos r.sultats de recherche",.. SS_OFF_DIALOG_CONTENT: "Connaissez le niveau de dangerosit. d'un lien avant de cliquer dessus.",.. SS_SEARCH_OPTION: "Ajoutez Recherche s.curis.e . mon moteur de recherche par d.faut",.. THREAT_OFF_STATE: "Alerte de s.curit.!",.. THREAT_OFF_MESSAGE: "Votre ordinateur est vuln.rable, mais nous pouvons vous aider.",.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5621
                                                                                                                                                                                                                                      Entropy (8bit):5.315816147531431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:yp99a4ffmtaCS1mELq47byJXGUmytipUS22d9h+/ijfTE0eO5l:yXAaCpELq4Fr2c/2iuOj
                                                                                                                                                                                                                                      MD5:81A975890DD6BA6C9E6F4C723FBDB24E
                                                                                                                                                                                                                                      SHA1:1EE9656E2F64FA8B868398064FD7C39BA5B8CCC7
                                                                                                                                                                                                                                      SHA-256:FD90CDA5ED8FCB96DF09D0A1785959BDCCDE95E7C28BD6481952D940180F2EF0
                                                                                                                                                                                                                                      SHA-512:3324C59D8C17C25CCEF3D7109BB61425340CFD50C5BAF4C47844F09C5436F8BCEE980829A83CB0CDA62B12C000481387226D5D8E440D7083394E57028F868EC4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Analyse en cours...",.. DL_SCANNING_MESSAGE: "Par pr.caution, nous analysons votre t.l.chargement.",.. DL_BLOCKED: "T.l.chargement bloqu.",.. DL_SCANED: "T.l.chargement analys.",.. SS_ON_STATE: "Recherche s.curis.e",.. SS_FIX_MESSAGE: "Tr.s bien. Nous effectuerons ces modifications au prochain red.marrage de votre navigateur.",.. SS_OFF_STATE: "Mesure . prendre.",.. SS_OFF_MESSAGE: "Attention.! Une recherche sur dix contient un lien dangereux.",.. SS_OFF_DIALOG_HEADER: "Ajouter l'.valuation des risques . vos r.sultats de recherche",.. SS_OFF_DIALOG_CONTENT: "Prenez connaissance du danger que repr.sente un lien avant de cliquer dessus.",.. SS_SEARCH_OPTION: "D.finir la recherche s.curis.e comme moteur de recherche par d.faut",.. THREAT_OFF_STATE: "Alerte de s.curit..!",.. THREAT_OFF_MESSAGE: "Votre ordinateur est expos. aux menaces, mais nous pouvons vous aider.",.. AVFW_DIAL

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5041
                                                                                                                                                                                                                                      Entropy (8bit):5.414388669142387
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:W82DDbczNyMnf3MeFH+JDxk/zay9SIhFO8DF84sSbuoU0zDub9FONkd3V/u:W34zwMfceFHSDxa1FcZbLONslW
                                                                                                                                                                                                                                      MD5:C75EDCE73D115B5363F023A9F7364BE2
                                                                                                                                                                                                                                      SHA1:7F88D65886BD97ABEC3EE6976C4C9C8F52F588DE
                                                                                                                                                                                                                                      SHA-256:EAA39B3582B6D39ED56B6C376C3D1F2D45796F8FCE540890AF03D5245F0E9615
                                                                                                                                                                                                                                      SHA-512:1CB8539E03265DA7AC819936C261E0B76E03BB0228685E0F0E0F4667CC0F88764853F5433C2203272A65490CCC012A6BD2B5A0AD9B935D1AFE7439E917BD2E33
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Pregled...",.. DL_SCANNING_MESSAGE: "Pregledavamo va.e preuzimanje za svaki slu.aj.",.. DL_BLOCKED: "Preuzimanje je blokirano",.. DL_SCANED: "Preuzimanje je pregledano",.. SS_ON_STATE: "Sigurno pretra.ivanje",.. SS_FIX_MESSAGE: "Sjajno! Ove .emo promjene uvesti sljede.i put kada ponovno pokrenete preglednik.",.. SS_OFF_STATE: "Potrebna je akcija!",.. SS_OFF_MESSAGE: "Upozorenje! 1 od 10 pretraga sadr.i opasnu vezu.",.. SS_OFF_DIALOG_HEADER: "Dodajte ocjenu rizika rezultatima pretra.ivanja",.. SS_OFF_DIALOG_CONTENT: "Saznajte koliko je veza opasna prije nego .to kliknete na nju.",.. SS_SEARCH_OPTION: "Postavi Sigurno pretra.ivanje kao zadanu tra.ilicu",.. THREAT_OFF_STATE: "Sigurnosno upozorenje!",.. THREAT_OFF_MESSAGE: "Va.e je ra.unalo izlo.eno, ali mo.emo vam pomo.i.",.. AVFW_DIALOG_HEADER: "Isklju.eni su antivirusna za.tita i vatrozid",.. AVFW_DIALOG_CONTENT: "Oko 864 milijuna z

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5401
                                                                                                                                                                                                                                      Entropy (8bit):5.533606860200013
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cDlYr1MDbtVqXiZgRRGXtsXPG8sZT15INx7h6X9mwu9Dvymc+cE0AHBJ:hZYHqXiL8y5WzN6gwuBKmzP5HX
                                                                                                                                                                                                                                      MD5:0D78BCF3DED4DCE89E2C375ED9A0A0E3
                                                                                                                                                                                                                                      SHA1:791FE44B4D704A491A1093ACBA1DB041969E0649
                                                                                                                                                                                                                                      SHA-256:8177554F6D854115EA3800C4FC6E0C6ABB924EB71642C71FC1F3F31FD1BD9CF3
                                                                                                                                                                                                                                      SHA-512:CF7D0BCBFABFC20CFBBA4FD21EB5334E8C9A56888B38DD8D34B6E99651BC816D27210C54B23D05154417E7747BFF1FC7962EE7EC5E5F92969D83D9A972DC28C5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Vizsg.lat...",.. DL_SCANNING_MESSAGE: "Biztons.ga .rdek.ben .tvizsg.ljuk a let.lt.tt f.jlt.",.. DL_BLOCKED: "Blokkolt let.lt.s",.. DL_SCANED: "Megvizsg.lt let.lt.s",.. SS_ON_STATE: "Biztons.gos keres.s",.. SS_FIX_MESSAGE: "Rendben. A b.ng.sz. k.vetkez. .jraind.t.sakor v.grehajtjuk ezeket a m.dos.t.sokat.",.. SS_OFF_STATE: "Beavatkoz.sra van sz.ks.g!",.. SS_OFF_MESSAGE: "Figyelem! Minden tizedik keres.s vesz.lyes hivatkoz.st tartalmaz.",.. SS_OFF_DIALOG_HEADER: "Vesz.lyess.gi besorol.sok megjelen.t.se a keres.si eredm.nyek mellett",.. SS_OFF_DIALOG_CONTENT: "Ismerje meg a hivatkoz.s vesz.lyess.gi besorol.s.t, miel.tt r.kattintana.",.. SS_SEARCH_OPTION: "A biztons.gos keres.s legyen az alap.rtelmezett keres.motor",.. THREAT_OFF_STATE: "Biztons.gi riaszt.s!",.. THREAT_OFF_MESSAGE: "Sz.m.t.g.pe sebezhet., de seg.thet.nk.",.. AVFW_DIALOG_HEADER:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5110
                                                                                                                                                                                                                                      Entropy (8bit):5.230705876675504
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ZDrBAuuEnhYJMxwmH77265IcUNspZPBDNMTix+wwyHTd9H7pmC23G:drLnhYJ2wmHf2MIcUYQw1HJR74E
                                                                                                                                                                                                                                      MD5:CD92BB1767A07185687F10123505EABC
                                                                                                                                                                                                                                      SHA1:B6F7D7B49E1299AF540CE89FEB8B5547C01DFFAE
                                                                                                                                                                                                                                      SHA-256:41DFCDD11D9EAF0A08059686C19CCE5087F2499B56A1048215C839BB9424A871
                                                                                                                                                                                                                                      SHA-512:08710C05EA3E23211D98D2AE05DFF292F632C94EA0AC04D93BCE1AF7D6973780468BE54603E88D4AE456D85DA5D7A40F517EE3957E6AD5A8CFD0E48DF060FCE8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scansione in corso...",.. DL_SCANNING_MESSAGE: "Stiamo eseguendo la scansione dei download per verificare che siano sicuri.",.. DL_BLOCKED: "Download bloccato",.. DL_SCANED: "Download scansionato",.. SS_ON_STATE: "Ricerca sicura",.. SS_FIX_MESSAGE: "Perfetto! Apporteremo queste modifiche al riavvio del browser.",.. SS_OFF_STATE: "Intervento richiesto.",.. SS_OFF_MESSAGE: "Avviso. 1 ricerca su 10 contiene link pericolosi.",.. SS_OFF_DIALOG_HEADER: "Aggiungi le classificazioni dei rischi ai risultati di ricerca",.. SS_OFF_DIALOG_CONTENT: "Conosci la pericolosit. di un link prima di accedervi.",.. SS_SEARCH_OPTION: "Imposta la ricerca sicura come motore di ricerca predefinito",.. THREAT_OFF_STATE: "Avviso di sicurezza.",.. THREAT_OFF_MESSAGE: "Il computer . esposto a rischi, ma possiamo aiutarti.",.. AVFW_DIALOG_HEADER: "Antivirus e firewall sono disattivati",.. AVFW_DIALOG_CONTENT: "Dal 2005, circa

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6573
                                                                                                                                                                                                                                      Entropy (8bit):5.719649113632793
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:NTUsvaiozLJ9h9yY4smsT7h0O71Kw1JFk:esv4J9HyY4smsT7h0O7Pv2
                                                                                                                                                                                                                                      MD5:5028CEE2B1C580EC86752D9DD039412D
                                                                                                                                                                                                                                      SHA1:85F70C6670DB02B447A90642FB9AB14C50E8864D
                                                                                                                                                                                                                                      SHA-256:417AC3BC48126590E6CA3EF4DCBB8E11A4D5299339BCC90E99AD9B35B08A6596
                                                                                                                                                                                                                                      SHA-512:F2ACDED27C51169FE96E25F2723DBCBFB9FAC8343719920987D0DA471FF7218DAED046C36DB39C88EBDB9644942A43D5788CD660BFA4A12D8E8CC7282372739B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "........",.. DL_SCANNING_MESSAGE: "..................................",.. DL_BLOCKED: ".............",.. DL_SCANED: "............",.. SS_ON_STATE: ".....",.. SS_FIX_MESSAGE: "....................................",.. SS_OFF_STATE: "..........!",.. SS_OFF_MESSAGE: "... 10 .. 1 ......................",.. SS_OFF_DIALOG_HEADER: "...................",.. SS_OFF_DIALOG_CONTENT: "..........................",.. SS_SEARCH_OPTION: ".......................",.. THREAT_OFF_STATE: ".........",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5497
                                                                                                                                                                                                                                      Entropy (8bit):5.853952782359886
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:A4T4OfEAmKkUvLS/fDa8s9If8LNaSkXLwjk2XEgvR6z0O739OBqKkLHtNG:Bff7Jk3a8iNaSEKtODYBqKoNNG
                                                                                                                                                                                                                                      MD5:20FD128ADFD5827D4AF6E76577E4CB2B
                                                                                                                                                                                                                                      SHA1:A1B2AC6AADF10A24FDECCD67DFC5DD23F02A2E73
                                                                                                                                                                                                                                      SHA-256:4A1B1B06EC5449F219E59B266BCCADB24EDD5BA424E61010FC78E4BEC6319A8C
                                                                                                                                                                                                                                      SHA-512:D84C6AACC3AF312ED1276C597BAD59EB36E39A02D1DA6DAA96A43938D4892ED2F9FED7A7E82E623D543E79879FD734EA17C00C7EA8F7443F3D7AD72430EB09FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: ".. ....",.. DL_SCANNING_MESSAGE: "... .. ..... .. .....",.. DL_BLOCKED: "... ....",.. DL_SCANED: "... ....",.. SS_ON_STATE: ".. ..",.. SS_FIX_MESSAGE: "....! ..... .. .... .. ... ......",.. SS_OFF_STATE: "... .....!",.. SS_OFF_MESSAGE: "..! .. .. ... ... ... ... .. 1/10....",.. SS_OFF_DIALOG_HEADER: ".. ... .. ... .......",.. SS_OFF_DIALOG_CONTENT: ".... .. ... .... .. .......",.. SS_SEARCH_OPTION: ".. ... .. .. .... ..",.. THREAT_OFF_STATE: ".. .....!",.. THREAT_OFF_MESSAGE: "... .... ...... McAfee. .... . .....",.. AVFW_DIALOG_HEADER: "...... .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4937
                                                                                                                                                                                                                                      Entropy (8bit):5.330241853373416
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:iith6b8IIs/ySd0vgZwxwud8eWgwbYeCCVKduaN3z559JBhoAsUnxUqA:J36nR1swuD8boN951hvsUnx1A
                                                                                                                                                                                                                                      MD5:0C475C18B11902759BE24EA4D1D8A223
                                                                                                                                                                                                                                      SHA1:D4F9B9BFE267A6D278E9E081B86B153A6B58ABF6
                                                                                                                                                                                                                                      SHA-256:A06B0246170696C2325F363BD571141E6EBDA3BD2BEDB87C40A1115C389E3115
                                                                                                                                                                                                                                      SHA-512:04EB43F1B844A363A2D5CEC8286A54ECA6BFC9DEE5FB77BB1EA5998805FB1F66BF81E30E1598DAEF48D2EDF3D396CC075C721E94EF65FED9B443AC1BD159AAF5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skanner..",.. DL_SCANNING_MESSAGE: "Vi skanner nedlastingen for . v.re p. den sikre siden.",.. DL_BLOCKED: "Nedlasting blokkert",.. DL_SCANED: "Nedlasting skannet",.. SS_ON_STATE: "Sikkert s.k",.. SS_FIX_MESSAGE: "Flott! Vi skal gj.re disse endringene neste gang du starter nettleseren.",.. SS_OFF_STATE: "Handling kreves!",.. SS_OFF_MESSAGE: "Advarsel! 1 av 10 s.k inneholder en farlig kobling.",.. SS_OFF_DIALOG_HEADER: "Legg til risikovurderinger i s.keresultatene",.. SS_OFF_DIALOG_CONTENT: "Vit hvor farlig en kobling er, f.r du klikker p. den.",.. SS_SEARCH_OPTION: "Gj.re Sikkert s.k til standard s.kemotor",.. THREAT_OFF_STATE: "Sikkerhetsvarsel!",.. THREAT_OFF_MESSAGE: "Datamaskinen din er eksponert, men vi kan hjelpe deg.",.. AVFW_DIALOG_HEADER: "Antivirusbeskyttelsen og brannmuren er av",.. AVFW_DIALOG_CONTENT: "Omkring 864 millioner oppf.ringer med personopplysninger har havnet

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5046
                                                                                                                                                                                                                                      Entropy (8bit):5.305081256656471
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:IHFRCH1qpecUFhzJizV+kE1XGwRZYzg0u0Qu2OOkMCJuzXvu9odS+daUmh9:IHFRCVqpAFh4zV+kol56Q1EJ2vufCaL9
                                                                                                                                                                                                                                      MD5:138E807F274176682C3E98704DAEF5A2
                                                                                                                                                                                                                                      SHA1:14066A82DB202934E0F5A437BB6762ECE6D51578
                                                                                                                                                                                                                                      SHA-256:252D5C72B20209D5636DD206E6BB16FC190200E8BC9C08361DBDE9480031BA4E
                                                                                                                                                                                                                                      SHA-512:ADACCC5980C979A9174F3CE1A5EB60910A20211672C9CD723F845AA9826689F20159FBDB444E43CBE445088283175556CE58C2571E99DA31588C5932BB78E0A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Scannen...",.. DL_SCANNING_MESSAGE: "Uw download wordt voor de veiligheid gescand.",.. DL_BLOCKED: "Download geblokkeerd",.. DL_SCANED: "Download gescand",.. SS_ON_STATE: "Beveiligd zoeken",.. SS_FIX_MESSAGE: "Fantastisch! Deze wijzigingen worden ge.mplementeerd wanneer u uw browser de volgende keer opnieuw start.",.. SS_OFF_STATE: "Actie vereist!",.. SS_OFF_MESSAGE: "Waarschuwing! 1 op de 10 zoekopdrachten bevat een gevaarlijke link.",.. SS_OFF_DIALOG_HEADER: "Voeg risicoclassificaties toe aan uw zoekresultaten",.. SS_OFF_DIALOG_CONTENT: "Weet hoe gevaarlijk een koppeling is voordat u erop klikt.",.. SS_SEARCH_OPTION: "Maak Beveiligd zoeken mijn standaardzoekmachine",.. THREAT_OFF_STATE: "Beveiligingswaarschuwing!",.. THREAT_OFF_MESSAGE: "Uw computer is blootgesteld, maar wij kunnen u helpen.",.. AVFW_DIALOG_HEADER: "Uw antivirus en firewall zijn uitgeschakeld",.. AVFW_DIALOG_CONTENT: "Sinds 2005

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5241
                                                                                                                                                                                                                                      Entropy (8bit):5.561302759807539
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:qUIwsXVPIcXdt1qJZHybN1qfWl9my9bpE3TiYv5YTKSjzxj4dsd9DFsxee7Vv:q1wsXVgcHoZHu2OlqukURj4di5te7V
                                                                                                                                                                                                                                      MD5:479AE6D8929DB3584AD6793F13363A2D
                                                                                                                                                                                                                                      SHA1:DCDC48ABF0B5A31798BF9CB10DBC1540D5EF63C4
                                                                                                                                                                                                                                      SHA-256:9A3B1E6DD494965FF7877C2286570A73AC6CDB1E56F062BC731DF3E37814FFB6
                                                                                                                                                                                                                                      SHA-512:F0C0A6B45769265A1D9C6D5903388D314A20FEEC4A8D8B4E238F116C82B588490B1DADF210EEADF941F6D869EC6DF1945D6091DBC76A1F32BB81BD52ACEC800F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skanowanie...",.. DL_SCANNING_MESSAGE: "Na wszelki wypadek skanujemy pobierany plik.",.. DL_BLOCKED: "Pobieranie zablokowane",.. DL_SCANED: "Pobieranie przeskanowane",.. SS_ON_STATE: "Bezpieczne wyszukiwanie",.. SS_FIX_MESSAGE: ".wietnie. Zmiany zostan. wprowadzone po ponownym uruchomieniu przegl.darki.",.. SS_OFF_STATE: "Wymagane dzia.anie.",.. SS_OFF_MESSAGE: "Uwaga! 1 na 10 wyszukiwa. zawiera niebezpieczne ..cze.",.. SS_OFF_DIALOG_HEADER: "Dodaj oceny ..czy w wynikach wyszukiwania.",.. SS_OFF_DIALOG_CONTENT: "Dowiedz si., czy ..cze jest niebezpieczne, zanim je klikniesz.",.. SS_SEARCH_OPTION: "Ustaw Bezpieczne wyszukiwanie jako domy.ln. wyszukiwark.",.. THREAT_OFF_STATE: "Alert zabezpiecze.!",.. THREAT_OFF_MESSAGE: "Komputer jest nara.ony na zagro.enia, ale mo.emy Ci pom.c.",.. AVFW_DIALOG_HEADER: "Antywirus i zapora s. wy..czone.",.. AVFW_DIALOG_CONTENT: "Od 2005 r. bezpi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5076
                                                                                                                                                                                                                                      Entropy (8bit):5.3398082683156485
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:hzqsY64tGeMe1EjJDQYz8VMntBYv4tBg9Wq90QA:hWnjE7e1iJl44BgD9c
                                                                                                                                                                                                                                      MD5:14D41A9307377B803619CE920B6AA1AE
                                                                                                                                                                                                                                      SHA1:04CE72386D079C06A7D61BF86195E7A7041BBB6F
                                                                                                                                                                                                                                      SHA-256:7B7D203FDED99A8CC837895BEB62090CC90B389CAFBED9BB0E64C39CA20FD9C6
                                                                                                                                                                                                                                      SHA-512:C7D3282F6352546EFBD822B5D574CDF0D0C36FED20A26B5F1CBC05C1309E6BEA18B309736DC528AF527BC6C4C93C839F4C15E0DB3D30999951C5CF9F23EA9F46
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Varrendo...",.. DL_SCANNING_MESSAGE: "Estamos varrendo o seu download apenas por seguran.a.",.. DL_BLOCKED: "Download bloqueado",.. DL_SCANED: "Downloads varridos",.. SS_ON_STATE: "Pesquisa segura",.. SS_FIX_MESSAGE: "Excelente! Implementaremos essas mudan.as na pr.xima vez que voc. reiniciar o navegador.",.. SS_OFF_STATE: "A..o necess.ria!",.. SS_OFF_MESSAGE: "Aviso! 1 em 10 pesquisas cont.m um link perigoso.",.. SS_OFF_DIALOG_HEADER: "Adicione classifica..es de risco aos seus resultados de pesquisa",.. SS_OFF_DIALOG_CONTENT: "Saiba qu.o perigoso . um link antes de clicar.",.. SS_SEARCH_OPTION: "Tornar a Pesquisa segura meu mecanismo de pesquisa padr.o",.. THREAT_OFF_STATE: "Alerta de seguran.a!",.. THREAT_OFF_MESSAGE: "Seu computador est. exposto, mas podemos ajud.-lo.",.. AVFW_DIALOG_HEADER: "Seu antiv.rus e sua firewall est.o desativados",.. AVFW_DIALOG_CONTENT: "Cerca de 864

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5194
                                                                                                                                                                                                                                      Entropy (8bit):5.338736098046057
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:L60E2K+GRZAEbZoyh5Mj+WkfVptFa9GqDXyI3:L6SKhDAmlk+bVLFaXDj
                                                                                                                                                                                                                                      MD5:7283F039EC1083FB10D7C3D4B3E04E87
                                                                                                                                                                                                                                      SHA1:D536B515C66F77B960268E35EAA4ED4876A8B351
                                                                                                                                                                                                                                      SHA-256:2CDD0003ADC2F3592F1B9C82AC989BB28C80922C5A8A3498DAD09C7C448E3421
                                                                                                                                                                                                                                      SHA-512:1C6BB2C7002D389D6EC0CD6A49F17055D2A75A850DD75997CD1F07D65CE3FEACB5EE9AABC0661AD26DF31DABF19FDA86B915EA48834F3307233E241D481AA2CF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "A analisar...",.. DL_SCANNING_MESSAGE: "Estamos a analisar a sua transfer.ncia para garantir a m.xima seguran.a.",.. DL_BLOCKED: "Transfer.ncia bloqueada",.. DL_SCANED: "Transfer.ncia analisada",.. SS_ON_STATE: "Pesquisa segura",.. SS_FIX_MESSAGE: ".timo! Aplicaremos esta altera..es quando reiniciar o browser.",.. SS_OFF_STATE: "A..o necess.ria!",.. SS_OFF_MESSAGE: "Aten..o! 1 em cada 10 pesquisas cont.m uma liga..o perigosa.",.. SS_OFF_DIALOG_HEADER: "Adicione classifica..es de risco aos seus resultados de pesquisa",.. SS_OFF_DIALOG_CONTENT: "Conhe.a o n.vel de perigo de uma liga..o antes de clicar.",.. SS_SEARCH_OPTION: "Tornar a Pesquisa Segura o meu motor de pesquisa predefinido",.. THREAT_OFF_STATE: "Alerta de seguran.a!",.. THREAT_OFF_MESSAGE: "O seu computador est. desprotegido, mas podemos ajudar.",.. AVFW_DIALOG_HEADER: "O seu antiv.rus e firewall est.o desativados",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7499
                                                                                                                                                                                                                                      Entropy (8bit):4.996250397143976
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:tNl8/c1QdEytaXyRV2slXqooj0MZ88VijpNtOjQCPg79pKUvwU/lsGyVHv:J8/c1QuytDV2s488V+TtWHkWUIU9RyVP
                                                                                                                                                                                                                                      MD5:158D8DF08DBBB79B4B568222E234C508
                                                                                                                                                                                                                                      SHA1:3855A05E996578A85CF68B5C720080746EF361D5
                                                                                                                                                                                                                                      SHA-256:BE8E976059CC21EBCA477BE06E415CB8EDF8F8D8827568E4B6AED1C2114CC780
                                                                                                                                                                                                                                      SHA-512:A841582BDCD2E089B4B2047E989CD655A41AD4849A55ACF9203C1667BB811B043A1FEB1FB233C6BCA55D5900B99F194F7176EF1BF4FED22718A9C6F0CA46079C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "...........",.. DL_SCANNING_MESSAGE: "........... ............ .........",.. DL_BLOCKED: "............. ........:",.. DL_SCANED: "......... ........:",.. SS_ON_STATE: ".......... .....",.. SS_FIX_MESSAGE: ".......! ......... ..... ....... ... ......... ........... .........",.. SS_OFF_STATE: "......... ........!",.. SS_OFF_MESSAGE: "......... . ........... ....... ........ ...... .... ....... .......",.. SS_OFF_DIALOG_HEADER: "........ ....... ..... . .......... ......",.. SS_OFF_DIALOG_CONTENT: "..... ......... .. ...... ......., ......... ... .......",.. SS_SEARCH_OPTION: "....... ........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5398
                                                                                                                                                                                                                                      Entropy (8bit):5.648426306392097
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:jTm1b9h9okCKuoXx9byC6n+Ih6hXV7ILNadt6rDSczFk9HVXrcDJ:jTob/9SKuqbyC6nYhScSicBk5BcDJ
                                                                                                                                                                                                                                      MD5:584E297CAD7E1C80A8EEF2F76E9BB9FE
                                                                                                                                                                                                                                      SHA1:A1075569B7042BE5BDC05DFA2D191D4BCEA7C4ED
                                                                                                                                                                                                                                      SHA-256:05885EE719704755341A7242E24D4C16F3675072E689E10E93BA34C04DBA6B4B
                                                                                                                                                                                                                                      SHA-512:3ECA2B43A8CA2CF17087262F23DDFCDF73C222D82EF825308CCCB9F08F65A5653B2F626F772C14239D35A6434BA5AC4FF614DAC22C684205FC28C4497DCF97AD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Kontroluje sa...",.. DL_SCANNING_MESSAGE: "Stiahnut. s.bor sa kontroluje, len pre istotu.",.. DL_BLOCKED: "S.ahovan. s.bor bol zablokovan.",.. DL_SCANED: "S.ahovan. s.bor bol skontrolovan.",.. SS_ON_STATE: "Zabezpe.en. vyh.ad.vanie",.. SS_FIX_MESSAGE: "Skvel.! Zmeny sa uskuto.nia pri najbli..om re.tartovan. prehliada.a.",.. SS_OFF_STATE: "Treba kona.!",.. SS_OFF_MESSAGE: "Upozornenie: 1 z 10 vyh.ad.van. obsahuje nebezpe.n. odkaz.",.. SS_OFF_DIALOG_HEADER: "Pridanie hodnoten. rizika k v.sledkom vyh.ad.vania",.. SS_OFF_DIALOG_CONTENT: "Sk.r ne. kliknete na prepojenie, mali by ste vedie., .i je nebezpe.n..",.. SS_SEARCH_OPTION: "Nastavi. slu.bu Zabezpe.en. vyh.ad.vanie ako predvolen. vyh.ad.vac. n.stroj",.. THREAT_OFF_STATE: "Upozornenie zabezpe.enia:",.. THREAT_OFF_MESSAGE: "V.. po..ta. je v.ohrozen., ale m..eme v.m pom.c..",.. AVFW_DIALOG_HEA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5115
                                                                                                                                                                                                                                      Entropy (8bit):5.414410260111673
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:a7um49Rmkzg/G5dK+J8tkaUnSlBS2DFA4s+roJGEUuzvYb9NKNvt3w/yYu:3VNzgOWS8ttFFV/b3KNlgqYu
                                                                                                                                                                                                                                      MD5:56F8675629727A04771F4BF908FBF4EC
                                                                                                                                                                                                                                      SHA1:9E831F70B872EDA63AA24F886793892521E0977B
                                                                                                                                                                                                                                      SHA-256:50345CA9E5F00E69728101F3B04892A42E17A2BEEEFCAD37EAF7BF228AE27900
                                                                                                                                                                                                                                      SHA-512:2CA01383CCA61EA17A5E3B7E1EE72999D9E387CFCC2574C88AB311FD8D3895A1E7F786227D694BD6C69B204D223DE4BA7BB4C08D7F8FBE4B0AE982204C4628AC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Skeniranje...",.. DL_SCANNING_MESSAGE: "Skeniramo preuzeti sadr.aj radi va.e bezbednosti.",.. DL_BLOCKED: "Blokirano preuzimanje",.. DL_SCANED: "skeniranje preuzimanja",.. SS_ON_STATE: "Bezbedna pretraga",.. SS_FIX_MESSAGE: "Odli.no! Ove izmene .e biti unete kada slede.i put pokrenete pregleda..",.. SS_OFF_STATE: "Potrebno je preduzeti odre.ene korake!",.. SS_OFF_MESSAGE: "Upozorenje! Svaka deseta pretraga sadr.i opasnu vezu.",.. SS_OFF_DIALOG_HEADER: "Dodajte ocene rizika u rezultate pretrage",.. SS_OFF_DIALOG_CONTENT: "Saznajte koliko je neka veza opasna pre nego .to kliknete na nju.",.. SS_SEARCH_OPTION: ".elim da bezbedna pretraga bude moj podrazumevani pretra.iva.",.. THREAT_OFF_STATE: "Bezbednosno upozorenje!",.. THREAT_OFF_MESSAGE: "Va. ra.unar je izlo.en pretnjama, ali mi vam mo.emo pomo.i.",.. AVFW_DIALOG_HEADER: "Antivirusni program i za.titni zid su isklju.eni",.. AVFW

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4882
                                                                                                                                                                                                                                      Entropy (8bit):5.400058325197915
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:fl+hIZSmigy7tw5va0ZPYVhH9lSIkMKJU9xIGRQtVRRT:d+hIZC7twtn8HQJJUQGRIRT
                                                                                                                                                                                                                                      MD5:E98A674F14F43B9564EF46979F43DEBA
                                                                                                                                                                                                                                      SHA1:2883EEB6BAFBA0B4CB8FAFD65E9A6E75648A3427
                                                                                                                                                                                                                                      SHA-256:10A1A0C6A61C8FD2D7B1D5DF5D10723DA21BCF64B4ED26279D99A2227AE51A6A
                                                                                                                                                                                                                                      SHA-512:96DB668AE2583D2597F14DB52E926A4A99B88783D967727B2F5C1984ECCB3ADF08E597B7D3AB9E08D7186B731587AA20E762779A15A4AA7A19D787CCCEE77F4F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Genoms.ker...",.. DL_SCANNING_MESSAGE: "Vi genoms.ker h.mtningen f.r s.kerhets skull.",.. DL_BLOCKED: "H.mtning blockerad",.. DL_SCANED: "H.mtning genoms.kt",.. SS_ON_STATE: "S.ker s.kning",.. SS_FIX_MESSAGE: "Perfekt. Vi utf.r .ndringarna n.sta g.ng du startar om din webbl.sare.",.. SS_OFF_STATE: ".tg.rd kr.vs!",.. SS_OFF_MESSAGE: "Varning! 1 av 10 s.kningar inneh.ller en farlig l.nk.",.. SS_OFF_DIALOG_HEADER: "L.gg till riskklassificering i dina s.kresultat",.. SS_OFF_DIALOG_CONTENT: "Du f.r veta hur farlig en l.nk .r innan du klickar p. den.",.. SS_SEARCH_OPTION: "V.lj S.ker s.kning som standardalternativ f.r s.kmotorer",.. THREAT_OFF_STATE: "S.kerhetsvarning!",.. THREAT_OFF_MESSAGE: "Datorn .r utsatt f.r risk, men vi kan hj.lpa till.",.. AVFW_DIALOG_HEADER: "Antivirus och brandv.ggen .r inaktiverade",.. AVFW_DIALOG_CONTENT: "Cirka 864 miljoner personliga da

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5273
                                                                                                                                                                                                                                      Entropy (8bit):5.4897436303009
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:THxCtJRQDY8NoBGZOpo/n2ovqXm/IwjfdZ1zT4x9hEKHCnAzv2ms:7xCtANoBGnR/TdZJ4xEsv2ms
                                                                                                                                                                                                                                      MD5:9531B44A60CC26D2B631710D6CABCF51
                                                                                                                                                                                                                                      SHA1:D20611640A87812E697734CF6EE38B1293355CC9
                                                                                                                                                                                                                                      SHA-256:2AD65C0525AE3B99CDF02A0081765DF0C849ED01DFB1CB2625BE6C39D55CC2CD
                                                                                                                                                                                                                                      SHA-512:48D0979D427AB1C6FF70B758B2B24A849DCDF9C83EA4049E57903FAF83E189E9E3FBD40D9F11051D918E779FD45D1E1FD40B600BF7AEE63950A22D423D9009AE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: "Taran.yor...",.. DL_SCANNING_MESSAGE: "Her ihtimale kar.. indirmenizi tar.yoruz.",.. DL_BLOCKED: ".ndirme engellendi",.. DL_SCANED: ".ndirme tarand.",.. SS_ON_STATE: "G.venli Arama",.. SS_FIX_MESSAGE: "Harika! Taray.c.y. bir sonraki sefer ba.latt...n.zda bu de.i.iklikleri uygulayaca..z.",.. SS_OFF_STATE: "Eylem gerekli!",.. SS_OFF_MESSAGE: "Dikkat! 10 aramadan biri tehlikeli ba.lant. i.erir.",.. SS_OFF_DIALOG_HEADER: "Arama sonu.lar.n.za risk de.erlendirmeleri ekleyin",.. SS_OFF_DIALOG_CONTENT: "T.klamadan .nce bir ba.lant.n.n ne kadar tehlikeli oldu.unu bilin.",.. SS_SEARCH_OPTION: "G.venli Arama'y. varsay.lan arama motorum yap",.. THREAT_OFF_STATE: "G.venlik Uyar.s.!",.. THREAT_OFF_MESSAGE: "Bilgisayar.n.z savunmas.z ancak size yard.mc. olabiliriz.",.. AVFW_DIALOG_HEADER: "Vir.sten koruma ve g.venlik duvar. kapal.",.. AVFW_DIALOG_CONTENT: "2005'ten

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4673
                                                                                                                                                                                                                                      Entropy (8bit):6.281513023953211
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:THIWI0hyh/2vKsPMP0VIQUuGOPpBM9Yc81vzNmF:T5Qh/Yq9joBMGz1pmF
                                                                                                                                                                                                                                      MD5:6B2425BB011F5C4ABE0B78EE7B7D1D58
                                                                                                                                                                                                                                      SHA1:29F00FAECB2CA9F0EC9C2F12CC971DE82007F18C
                                                                                                                                                                                                                                      SHA-256:B12580098DD8CBB3AE971A3A48CD9CD770360BA4B40B16C5C2065B825A8F1CCF
                                                                                                                                                                                                                                      SHA-512:01207BBEE1FBCD4CB8C8A27033066C4D6BC7C3A90ABDD189D7BEA8F419ED3E4E030AADEE51E0AEA8379360CB3ACF63A036D6A44B0D4B2EEEB83CC7F666AA84B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: ".......",.. DL_SCANNING_MESSAGE: "..................",.. DL_BLOCKED: "......",.. DL_SCANED: "......",.. SS_ON_STATE: "....",.. SS_FIX_MESSAGE: "...! ....................",.. SS_OFF_STATE: "....!",.. SS_OFF_MESSAGE: "...1/10 ............",.. SS_OFF_DIALOG_HEADER: "...........",.. SS_OFF_DIALOG_CONTENT: "...................",.. SS_SEARCH_OPTION: ".............",.. THREAT_OFF_STATE: ".....",.. THREAT_OFF_MESSAGE: "...................",.. AVFW_DIALOG_HEADER: "............",.. AVFW_DIALOG_CONTENT: ". 2005 ....... 8.64 ..................<br/

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4704
                                                                                                                                                                                                                                      Entropy (8bit):6.283653389261111
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:+54tUIE58+sUHLz4111bAmwqkFvHOVJXBxC7RP9LX9Qom/6tU:+utkVAdAm8uf0X6/StU
                                                                                                                                                                                                                                      MD5:0274EBB7C26A68301BAC8C80691E1D85
                                                                                                                                                                                                                                      SHA1:8A831A27E09F425129C2254C23736783200F0093
                                                                                                                                                                                                                                      SHA-256:EE5EB3545ED65C0D3C7B869F21580418A4F66DD891C288395D9A6867384A8A44
                                                                                                                                                                                                                                      SHA-512:3E51E072D483B165E391307F7B72CCE02ABBAE02CF9893D95F88DE5C777656FFA625E1710BEE356A1DCBDB7FB7EF0FB8C207EB63BEE850D540D17C3F340BE016
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrCheckList_ = {.. DL_SCANNING_STATE: ".......",.. DL_SCANNING_MESSAGE: "..............",.. DL_BLOCKED: ".....",.. DL_SCANED: ".....",.. SS_ON_STATE: "....",.. SS_FIX_MESSAGE: ".......................",.. SS_OFF_STATE: ".....",.. SS_OFF_MESSAGE: "...10 ..... 1 ........",.. SS_OFF_DIALOG_HEADER: ".............",.. SS_OFF_DIALOG_CONTENT: "..................",.. SS_SEARCH_OPTION: "...............",.. THREAT_OFF_STATE: "......",.. THREAT_OFF_MESSAGE: "...................",.. AVFW_DIALOG_HEADER: "...........",.. AVFW_DIALOG_CONTENT: ". 2005 ...... 8 . 6 . 4 ...................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1510
                                                                                                                                                                                                                                      Entropy (8bit):5.727503544022839
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTt2GGq0IQDhhlGGqg4o1GGGqUdVkrN0/Fq9eA0dmUcHs:w3q0Fhl3qg71G3qUvkrNeq9f0dmZs
                                                                                                                                                                                                                                      MD5:820381438823E7F130304A08DA23053E
                                                                                                                                                                                                                                      SHA1:A3B557A86F052B5A2A762EC095591E2342532146
                                                                                                                                                                                                                                      SHA-256:80B89EFF878B643D6628870DA6633FBB4F093D81759572A094C88D84E5FCA334
                                                                                                                                                                                                                                      SHA-512:24C70F2F157E6770311F66B18B9A6D770D0BB7CD8DE3E9E7D874E9FD3C55C27877B47515CF0F61A9506783EF4E01D97BD09964CA409B15CB64C766A43ECC6198
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Z.skejte bezplatnou ochranu p.i proch.zen. internetu od spole.nosti McAfee kliknut.m na mo.nost {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Povolit roz...en.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "Pomoc. mo.nosti {0} zapnete tyto funkce vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Povolit roz...en.",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Pomoc. mo.nosti {0} budete d.le chr.n.ni online d.ky t.mto funkc.m vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Ponechat zm.ny",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "Pomoc. mo.nosti {0} programu McAfee. WebAdvisor zapnete tyto funkce vy... ochrany: Bezpe.n. hled.n. McAfee., Blokov.n. reklam a Blokov.n. sledov.n..",.. ADBLOCK_PERMISSION_ADDED_CONT

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1414
                                                                                                                                                                                                                                      Entropy (8bit):5.53551596267688
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTEz6tBWYCISc5ciWzCISNOFBWYCISrrVpz92w56WYaFtsmA/4:U4nCISc5cvCISNOFnCISrxRmWnFGD4
                                                                                                                                                                                                                                      MD5:E266E312F457050AD50B357C64FC855D
                                                                                                                                                                                                                                      SHA1:73A6065F24B7F3BA9A77602899ADD2DA0CAFF02E
                                                                                                                                                                                                                                      SHA-256:464218BDC5A85B0A064F3122A2DCF0114DD4C6A2ABDEF8B57B4F061F3A96E8AA
                                                                                                                                                                                                                                      SHA-512:6CDC976D032B4174CEA16F32A92920FA2E5061BE0624959F627AE604E6CC390D4C9F2372B86549ABD56EC8B3103AA8717FAB1152561296FBA46FB6D1EA02999F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Hent den gratis webbeskyttelse fra McAfee ved at klikke p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiv.r udvidelse",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} for at sl. disse ekstra sikkerhedsfunktioner fra McAfee. til: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiv.r udvidelse",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} for fortsat at v.re beskyttet online med disse ekstra sikkerhedsfunktioner fra McAfee.: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Behold .ndringer",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor for at sl. disse ekstra sikkerhedsfunktioner fra McAfee. til: sikker s.gning, blokering af reklamer og blokering af sporingsfiler.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Tillad",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ak

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1494
                                                                                                                                                                                                                                      Entropy (8bit):5.5135210722869585
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTjZ+CqIYh/aCCqIYVdQvTMzTIAc7HQmKnCqIY4DMEIWljVWbbBNX:zZ+lxVlxVebMzTEQmKnlx4DO+JmBB
                                                                                                                                                                                                                                      MD5:4F8A856DE9F0FEBAE8341B3421639063
                                                                                                                                                                                                                                      SHA1:2FABF74C55CBAED8AD51E60544BDF68A4C97CB8E
                                                                                                                                                                                                                                      SHA-256:F4C29A1A9DF6F963AB2A9D6B8D29CF698A1F4FCC509442E6D2FB83957484C784
                                                                                                                                                                                                                                      SHA-512:2E7CAD5891CE0171F8454842F7D420D7CE212C43AF43A3705E79834E21D1246ED31D7FC7B0067F3853BDBA094BA8C14B0AE14553AB05232B31B3A593144022FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Nutzen Sie den kostenlosen Web-Schutz von McAfee, indem Sie auf "{0}" klicken.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Erweiterung aktivieren",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "Klicken Sie auf "{0}", um die folgenden Funktionen des zus.tzlichen Schutzes zu nutzen: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Erweiterung aktivieren",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Klicken Sie auf "{0}", um weiterhin mit den folgenden Funktionen des zus.tzlichen Schutzes online gesch.tzt zu bleiben: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".nderungen beibehalten",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "Klicken Sie f.r McAfee. WebAdvisor auf "{0}", um die folgenden Funktionen des zus.tzlichen Schutzes zu aktivieren: McAfee. Sichere Suche, Ad-Blockierung und Tracker-Blockierung.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2138
                                                                                                                                                                                                                                      Entropy (8bit):5.212127477861214
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTYCoYrWTMeJ3P/oYeITMeJ3Pq2dnzgWTMeJ3P+PPvKoYC0EDdX0y2wyiFWvzl:TWRpEIRpq2dzgWRp+Pt0EDdZMl
                                                                                                                                                                                                                                      MD5:BE4EAC268C3206E033F41415087DF951
                                                                                                                                                                                                                                      SHA1:16BB0B6022ED0C229F54B04FFFA5B72F5D695834
                                                                                                                                                                                                                                      SHA-256:58EB619E2E6F5B5A28E4E6BF3D8FD490CB1F893A353E75C2528DB4894CDD61AD
                                                                                                                                                                                                                                      SHA-512:69D010FBC467101CAEF34B57B031A119FC4940051812A7920E052DCB38C37A01BA6AE5E425FA41279305DA4CE8D61C32E8F28DA818CB9A2C040FF88FAE62CBE3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "......... ...... ......... ... .. McAfee ........ .... ... {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............ .........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} ... .. .............. ..... ... ........... ......... ..........: ....... ........., ........... ........... ... ........... .......... ... McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............ .........",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} ... .. ........... ........ online .. ..... ... ........... ......... ..........: ....... ........., ........... ........... ... ........... .......... ...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1249
                                                                                                                                                                                                                                      Entropy (8bit):5.502519115171498
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HTnv5z5vJC7voO2yDTvq7vJC0rr+2yDTvq0rEAPrhG3XO2yDTvqG38OPOyYhbzN:7HTBv4lHkVKlHNEAkulHrRH/T5fLPeNl
                                                                                                                                                                                                                                      MD5:95E35B2CFD7BE1678BAF7DFD1F4BEB24
                                                                                                                                                                                                                                      SHA1:BDEACC53E480FBCBC3E4FDCA44CAF10C115DB8DA
                                                                                                                                                                                                                                      SHA-256:B1387FC641165772F7BC8BE570D715ACA4600BA2E6EE1E077C429FFF0A2141A4
                                                                                                                                                                                                                                      SHA-512:5851D83C8BC3A45FB2CD5BFF39D9F7D0249A8B24CD76F68D684E2EA7AB7BCAA59F25C616B19848848F57BD0D22A98ABA4D6ABCF09ED995504D2F77A7C918C4B0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Get your free web protection from McAfee by clicking {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enable extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} to turn on these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enable extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} to continue staying safe online with these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Keep changes",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor to turn on these Added Protection features: McAfee. Secure Search, Ad Blocker and Tracker Blocker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Allow",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Enable extension",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "to finish setting up WebAdvisor.",.. CHROME_ENABLEMENT_GUIDE_C

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1447
                                                                                                                                                                                                                                      Entropy (8bit):5.4796973972364285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT81my6MaXBldRzVenBldR+MQOAz/HQ2BldRiud91QHIc0x81mHWsLqZ:M1m/MaRlXVeBlKMQOAz/HZleudEr0O1F
                                                                                                                                                                                                                                      MD5:B06E874B75DB06AF31E27A6777125A9A
                                                                                                                                                                                                                                      SHA1:9FC503A284699005EDAED5298EADA9570C2AC809
                                                                                                                                                                                                                                      SHA-256:FD442877FCD4B5675BC89560AF9AA0D8F65D0B210E475948DEC7B3C8F73C6690
                                                                                                                                                                                                                                      SHA-512:B63C7F427BDADCE2AA87F471E622D1B8DEFBE3A4CDA3B8B90131BDC50483216E2B599D3A6E1DB6CC080D3913E7B07B751CA3E8B5404E1C65D8DB997CD457764E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Disfrute de la protecci.n web gratuita de McAfee haciendo clic en {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Habilitar extensi.n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para activar estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Habilitar extensi.n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para seguir estando protegido en Internet con estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conservar cambios",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} WebAdvisor de McAfee. para activar estas funciones de Protecci.n a.adida: B.squeda segura, Bloqueador de anuncios y Bloqueador de rastreadores de McAfee..",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHR

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1434
                                                                                                                                                                                                                                      Entropy (8bit):5.490245911694074
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTBWmy6caQmDdJVe9mDdsMQOAzdmDdQ0a0yLh1mHQOHaD6bcyf:Em/caQs/Ve9s6MQOAzdsuPRLh1mHQOHJ
                                                                                                                                                                                                                                      MD5:7934A991E83E591012BBCB36B32FE17C
                                                                                                                                                                                                                                      SHA1:856EFEB616C1CB681CB7DDB7EE00F7A574BCCA53
                                                                                                                                                                                                                                      SHA-256:13478DBD467AB0487C1E5E6981FF9FE002950D140958B1C10D69BEFB91AFC07C
                                                                                                                                                                                                                                      SHA-512:C2E6957F9698D09D8CAE34C3E29D4C45772D8E0F96E39B2C6BEA23A604A898915993BAC60C8F4823EA39F70E70E92CC28774E63BA502D6F8EB2EBFABA742E710
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenga su protecci.n web gratuita de McAfee haciendo clic en {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activar extensi.n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para habilitar estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activar extensi.n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para continuar seguro en l.nea con estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conservar cambios",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor para habilitar estas funciones de Protecci.n Adicional: B.squeda segura de McAfee., Bloqueador de anuncios y Bloqueador de rastreadores.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHROME_ENABLEMENT

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1371
                                                                                                                                                                                                                                      Entropy (8bit):5.514062388372
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTigoQ6AHPXTSgVCPP3TOcJ9PgTKTSzogH07RQuzSZCsQJwziNzji50:PZtXbVQ3qcJt3+zVUVXXN2mNzb
                                                                                                                                                                                                                                      MD5:C11C2E114B2A6F237B261EC19B8BEC29
                                                                                                                                                                                                                                      SHA1:C73EAA2B9007C99C29B916F320D698814767E176
                                                                                                                                                                                                                                      SHA-256:BA07EF798138D122D9B26E25B4BDEFBD71FCD2EF95FFBE970B04E2B7F01B638C
                                                                                                                                                                                                                                      SHA-512:4692508899A33C48F0D81C37F8D60A3EA6C242F73520030A9F8111BA1D178C8F928377DC3303C4B06E00B10F0F12385A91C8C32655D4A4DF08EE095F1C05A97C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Hanki McAfeen verkkosuojaus maksutta napsauttamalla {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ota laajennus k.ytt..n",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, jotta voit k.ytt.. n.it. lis.suojausominaisuuksia: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ota laajennus k.ytt..n",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, jotta pysyt jatkossakin turvassa verkossa n.ill. lis.suojausominaisuuksilla: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "S.ilyt. muutokset",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0}, ett. McAfee. WebAdvisor ottaa n.m. lis.suojausominaisuudet k.ytt..n: McAfeen. suojattu haku, mainosten esto ja seurannan esto.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Salli",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ota laajennus k.ytt..n",.. CHROME_ENABLEMENT_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1453
                                                                                                                                                                                                                                      Entropy (8bit):5.477282790404569
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTBU39MC7soZ8JyVt0oZ8JVuh6oZ8JTm6Tb41mgENWKY:S7BasV3aT6HahmKU18Wf
                                                                                                                                                                                                                                      MD5:7ACE0A130BA84C20BC753560A39FC3AC
                                                                                                                                                                                                                                      SHA1:3129A62EA602421FA9C9A50FB994E309F55E6C9E
                                                                                                                                                                                                                                      SHA-256:92A1DC3042262895BD1D603EE56A39CA4EBEFD6B2CB2D07DD77C2A8935A177F7
                                                                                                                                                                                                                                      SHA-512:4CBE637A0C03F3432798885B7F74DB1B27066B946946A21DFB9D38B6383F40C780B0ED463BCC67EA7AF292BD71673B161C4AA176CA15573A1C024B87E524A493
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenez votre protection Web gratuite de McAfee en cliquant sur {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} pour activer ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} pour continuer . .voluer en ligne en toute s.curit. gr.ce . ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Maintenir les changements",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor pour activer ces fonctions de protection accrue: recherche s.curis.e McAfee., Bloqueur de publicit. et Bloqueur de localisateur.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Autoriser

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1510
                                                                                                                                                                                                                                      Entropy (8bit):5.511138243337798
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTCKMC7mZ8yHVt2ZGNZ8ysMQu0Z8yQjSFbV+bzFtWr4W3Yk4:yq7ma0VwSa7MQu0apeFMpm4If4
                                                                                                                                                                                                                                      MD5:C0D83F2606D3911533B465FC0609A990
                                                                                                                                                                                                                                      SHA1:AE0BC3DECF5FE89377AA3E54AF828C9A2CE7AE83
                                                                                                                                                                                                                                      SHA-256:1E46602375593F2A1A3F9C617FE1F5708E3C5B89005E374BC5955F3107AC0EB6
                                                                                                                                                                                                                                      SHA-512:42421231CB492391F56F56B050350CAAF447C14405210DB65117E0BA37E5CEC93F377713C7221FEF1C733FED506FD3576AA73134C4AF519F8ACB84406247798C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "B.n.ficiez de la protection web gratuite de McAfee en cliquant sur {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} pour activer ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Activer l'extension",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} pour continuer . .tre prot.g. en ligne avec ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Conserver les modifications",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor pour activer ces fonctionnalit.s de Protection renforc.e.: Recherche s.curis.e McAfee., Bloqueur de publicit.s et Bloqueur de trackers.",.. ADBLOCK_PERMISSION_ADDED_CONTENT

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1402
                                                                                                                                                                                                                                      Entropy (8bit):5.605945453831213
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HThh5mCPPDSIuREwP3ycRCCPPDmetuqELFbiFpVtgDSQe:Rh5mCPPDSI6xP3ycRCCPPDm6pELFOFpd
                                                                                                                                                                                                                                      MD5:B48A573CBD12E2316B85A204D4FBDAD2
                                                                                                                                                                                                                                      SHA1:9CC89D5A27C0324293CD9F4B46DC472FFC413F07
                                                                                                                                                                                                                                      SHA-256:078D1E600833DB2CF2CD790969E7AED023D624D07FBF37C312E2F9C2F1FD696C
                                                                                                                                                                                                                                      SHA-512:B7204DFE8C7522050F4D9BFBDE57D7C93ED10BF308C7CF501D990F07934AEA67B5F7168C6ABFCFD573E5B484EA6120BD1D6A567639C9CF8F1050B031BBE10934
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Dobijte svoju besplatnu web za.titu od McAfee-a klikom na {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.i pro.irenje",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} da biste uklju.ili ove funkcije za dodatnu za.titu: McAfee. Sigurna pretraga, Blokada oglasa i blokada alata za pra.enje.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.i pro.irenje",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} kako biste nastavili biti sigurni na mre.i s ovim dodatnim zna.ajkama za.tite: McAfee. Sigurna pretraga, Blokada oglasa i blokadu alata za pra.enje.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Spremi promjene",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. da biste uklju.ili ove funkcije za dodatnu za.titu: McAfee. Sigurna pretraga, Blokada oglasa i blokada alata za pra.enje.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Odobri",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Omogu.i pro.irenje",.. CHROME_E

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1518
                                                                                                                                                                                                                                      Entropy (8bit):5.684072809816461
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTt3WD/Pwd03L7mtPsJePwd0kYGc8hQwde/WCpeT4zAsjWGTiuySP:5EP20bStUwP20kYGcIQ2e/JYeAsyPva
                                                                                                                                                                                                                                      MD5:08F22E6CD990F85E90DD1BBBF644E760
                                                                                                                                                                                                                                      SHA1:4AD9DAF31E3B8EF591B6DFCB1D4056AE498E5372
                                                                                                                                                                                                                                      SHA-256:2BCA96E400BA0ECB110319BDEB778A7007C4BB86824E9B333A4A02D6091F4DAF
                                                                                                                                                                                                                                      SHA-512:43114E2906BB0F2E91346B44267B958FC6F44CA1B9B22020297F60D3CEB8A6B1A77AE755937EC2B1DD28888F5A01C861DAC613726F58FFB21BDDA0C0322FB4C3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "A McAfee ingyenes webes v.delm.nek ig.nybe v.tel.hez kattintson a(z) {0} elemre.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "B.v.tm.ny enged.lyez.se",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} a tov.bbi v.delmi funkci.k, a McAfee. biztons.gos keres.s, a hirdet.sblokkol.s .s a k.vet.blokkol.s bekapcsol.s.hoz.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Enged.lyezze a b.v.tm.nyt",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, hogy tov.bbra is biztons.gban legyen online a tov.bbi v.delmi funkci.k, a McAfee. biztons.gos keres.s, a hirdet.sblokkol.s .s a k.vet.blokkol.s r.v.n.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".rizze meg a m.dos.t.sokat",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0}, hogy a McAfee. WebAdvisor bekapcsolja a hozz.adott v.delmi funkci.kat a McAfee. biztons.gos keres.st, a hirdet.sblokkol.st .s a k.vet.blokkol.st.",.. ADBLOCK_PERMISSION_ADDE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1405
                                                                                                                                                                                                                                      Entropy (8bit):5.470628074845407
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT1z0nFTVKnrpGpcJVKnrpGNG7FTVKnrpGrjQDej2lDuzg4nG/EI:Fz0FTYrpGpcJYrpGNGBTYrpGrjQCj2lP
                                                                                                                                                                                                                                      MD5:D187101AB2A09E69D3D9474B183D2AB6
                                                                                                                                                                                                                                      SHA1:8BC05D19076F379C5CFA7014C930053760BA1B89
                                                                                                                                                                                                                                      SHA-256:C8664C436AFF1C74C102163C1FED6D7B0DB833F526C8B570FCD786F48F2E999D
                                                                                                                                                                                                                                      SHA-512:B2DE7601881219BB8842723DE8B90297507D80AFD4F4EEA473332C835DE0CD080D395DE583E94A6F7435C914B78390B3D2223783DE48A4D123EE74D6B84A5557
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Ottieni la protezione Web gratuita McAfee facendo clic su {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Attiva l'estensione",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} per attivare queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Attiva l'estensione",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} per restare protetto online con queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Mantieni i cambiamenti",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} a McAfee. WebAdvisor di attivare queste funzionalit. di protezione aggiuntiva: Ricerca sicura McAfee., Blocco della pubblicit. e Blocco dei tracker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Consenti",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Attiva

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1682
                                                                                                                                                                                                                                      Entropy (8bit):5.753080129074989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:x8H0vGRwMvNaRw8CvrbQRwA8vxvovyZWBMJg:a2UwuewDrWwA+pyqW/
                                                                                                                                                                                                                                      MD5:CFA55C1C9412CEC2CAAFAE5984CAA8A1
                                                                                                                                                                                                                                      SHA1:C4EA1EEB4608F9C7207D42856EA625A9CC24D27D
                                                                                                                                                                                                                                      SHA-256:40F54EFB2D93BBA2E2B54BEEA45FE0E03E4B6A67E582174B5D40AD9EAE02BD9F
                                                                                                                                                                                                                                      SHA-512:7FF993FE2B032A1C46D4758AA1B3B7B90CA73F642F9A2CCF79CB916F810E0176794D99D0A850152BB374D1CD41F4AAFB79C0DBA63A6D72EA1439C7BBE566FF18
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0}................. Web ............",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}.......... .... ..........................................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "............",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}.......... .... ..........................................................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".......",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "...... ..........{0}.......... ...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1350
                                                                                                                                                                                                                                      Entropy (8bit):5.993932181742526
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT5dVhbu+vNh0/p7OvmksBv01I+vqNhGjB+Xx2BARLr:pXvkJOvmdBvAvq5B2kP
                                                                                                                                                                                                                                      MD5:229D8B8895150E8E89DFE570519D8494
                                                                                                                                                                                                                                      SHA1:15D137A9BB8700EC4A2D8882B7BB9CD1CC8AF6A9
                                                                                                                                                                                                                                      SHA-256:6E31ED28D9717DA17BFA53DF73BD100B239C8667E455C99DEEB2663AD0A8F755
                                                                                                                                                                                                                                      SHA-512:4386E7A890359FF41AA6C45418BE802CB499186B070B1E16F5DA418C41CE80F36DB0698448D2C82A7C902D2B54BC08E51CE073A0FA4BA0D25497698FBEBD96E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0}. .... McAfee. .. . ... .....",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: ".. ..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}. .. .. .. .. ... .... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: ".. ..",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}. .. .. .. .. .... ... ... ... ..... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: ".. .. ..",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "McAfee. ....... {0}.. .. .. .. ... .... McAfee. .. .., .. ..., .. ...",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: ".. ..",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1389
                                                                                                                                                                                                                                      Entropy (8bit):5.552383373710434
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT7bqCaYyGIG3aYEgdXCCaYIRSPuA9/3QFNC+Ammy:rWCaPQ3a3gdXCCa1oPuAN3K8+p
                                                                                                                                                                                                                                      MD5:7ABDE3BAD088675E38F12CA8CC858760
                                                                                                                                                                                                                                      SHA1:678E1767D1C64CBCFD728945EC78964FAD7018E8
                                                                                                                                                                                                                                      SHA-256:6E7A3D8E17712BAB8DD1BA0DDFF613ECFE56209D721822FBF2DB306910B3854A
                                                                                                                                                                                                                                      SHA-512:8579512CC4D8D010DAA05A2DE1AAAA885330B3B53A249FF26931918EE583023F88365CE396C2E2B8DD0744CCA331E47D6AA7C87C58A185093A9F4A1857423685
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "F. kostnadsfri webbeskyttelse fra McAfee ved . klikke p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiver utvidelse",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} for . sl. p. disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktiver utvidelse",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} for . f. uavbrutt nettsikkerhet med disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Behold endringer",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor for . sl. p. disse funksjonene i Ekstra beskyttelse: McAfee. Sikkert s.k, Annonseblokkering og Annonsesporingsblokkering.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Tillat",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Aktiver utvidelse",.. CHROME_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1362
                                                                                                                                                                                                                                      Entropy (8bit):5.493661481803267
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT+2CwmVpm7KECQc6WpV6LqKECh6zhpTnKECZ6BMcpS3KfwDwzxFz6jcju:ulHXQc6CVsph6znTCZ6BMIS3KQAxFKl
                                                                                                                                                                                                                                      MD5:6068CF22C755EBD19E7C7AC4566068B1
                                                                                                                                                                                                                                      SHA1:3E5A4E7831EC3A5E656B8B618D02335A8CC0F13A
                                                                                                                                                                                                                                      SHA-256:0BB60CCC68E2D3C6A508CE25B51D81D2F19B1AD85178524EA599DF928EF9501D
                                                                                                                                                                                                                                      SHA-512:BF88D280591BEF0126F382FD0ACB3FC6ABAAABC020EDB107D309F2DF4A93E7BAB7692B62E15ABADA7C52D6C685AD980FCA29775BB4540870D7F77CC7D245208F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Activeer uw webbescherming van McAfee door op {0} te klikken.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Extensie inschakelen",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} om deze functies voor Extra bescherming te activeren: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Extensie inschakelen",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} om online veiligheid te handhaven met deze functies voor Extra bescherming: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Wijzigingen behouden",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} dat McAfee. WebAdvisor deze functies voor Extra bescherming inschakelt: McAfee. Secure Search, Advertentieblokkering en Trackerblokkering.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Toestaan",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Extensie inschakelen",.. CHROME_ENAB

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1445
                                                                                                                                                                                                                                      Entropy (8bit):5.687452069807768
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HThG9K7qoBXUUyTNHyAoBXs0W17ZGoBXQLVTEaWjNwc4ucB2GA7USu:xG99IXnkHyAIXs0W17ZGIXQLVoaKNwc4
                                                                                                                                                                                                                                      MD5:BBC7FD8415E6E3B7706934888FB2EAA3
                                                                                                                                                                                                                                      SHA1:F84C8276B214ED75B5631B3A83A05EF091BDBAE7
                                                                                                                                                                                                                                      SHA-256:87FEA2D66CCA7C64DC3CDD3FF5494B209C3712557F4B5B7E9F80D18746BF0257
                                                                                                                                                                                                                                      SHA-512:64553D121FCBD8E267C205F2E47877E38FB4E4516AE2E98A6FA9926669DC23CA064D537415C4AC2F522855262AF9DE617D33952A688CF217D3696B47856713D5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Otrzymaj bezp.atn. ochron. w sieci Web od firmy McAfee, klikaj.c {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "W..cz rozszerzenie",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, aby w..czy. funkcje Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "W..cz rozszerzenie",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, aby zachowa. bezpiecze.stwo w Internecie dzi.ki tym funkcjom Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Zachowaj zmiany",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} programowi McAfee. WebAdvisor na w..czenie funkcji Dodatkowej ochrony: Bezpieczne wyszukiwanie McAfee., Blokowanie reklam i Blokowanie .ledzenia reklam.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Zezw.l",.. CHROME_ENABLEMEN

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1387
                                                                                                                                                                                                                                      Entropy (8bit):5.505792858974644
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTBsKJqk3NnebNgHbrxkHjFRt7Siu4nUiIZl:yaqk3NnebNg7rxCFq4nYD
                                                                                                                                                                                                                                      MD5:93ACE843B100C1DAA1FE32EFE375E770
                                                                                                                                                                                                                                      SHA1:0DC3DCBB0355DFD3D79C745C80F18A729AFD9E6B
                                                                                                                                                                                                                                      SHA-256:1B0A54F2A0FDC04C15F6CA1AC348C8B58248D25D47E52BCFBF31C77DAAAABC55
                                                                                                                                                                                                                                      SHA-512:3E56C4423C8C8947C84B4CAEB04E6D58EBC11609066A9F862E62DD645A89AD545D85D545FE6923A5BCBEFD47298A714DC68673D9834D06DDE1E061D0D5C3CFC4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenha sua prote..o gratuita na Web da McAfee clicando em {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para ativar estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para se manter seguro com estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Manter altera..es",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} o McAfee. WebAdvisor para ativar estes recursos de Prote..o adicional: Pesquisa Segura, Bloqueador de an.ncio e Bloqueador de rastreador da McAfee..",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Ativar extens.o"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                                                                      Entropy (8bit):5.509730809793475
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTBV0k3gQWF3+be0GQWF3+hgoQQWF3+vxkHjJYPJWg0:D0k3gQWObe0GQWOhgvQWOvxCJuWg0
                                                                                                                                                                                                                                      MD5:CD67AD3CBCF5ABBA02EC8A74C9682AAA
                                                                                                                                                                                                                                      SHA1:15EBA7F343B5B8017BF3E458508CBD751F5EDFB1
                                                                                                                                                                                                                                      SHA-256:2A18DDD7F37E8175A91595CB1DF0FAF4FC33136B7C3E94F04266A0B5DDC0D40A
                                                                                                                                                                                                                                      SHA-512:6FC1A7AAD317F21CA38A6FF566BB8B27B5A9F8851CD92A2CFFE3167441A68F21C56353A5F8459B9193D51BF1FBC9CCFF71A7DFCB05220A03F7D4FA6139DF2885
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Obtenha a sua prote..o Web gratuita da McAfee clicando em {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} para ativar estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Ativar extens.o",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} para se manter protegido online com estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Manter altera..es",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} que o McAfee. WebAdvisor ative estas funcionalidades de prote..o adicionais: Pesquisa segura da McAfee., bloqueador de an.ncios e bloqueador de monitorizadores.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Permitir",.. C

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2030
                                                                                                                                                                                                                                      Entropy (8bit):5.2389156698598605
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cjVIb3DoC64sVmb3D1tazjVIb3DzImiLvyxvMoi:QVi3Z2VM3enVi3v2vyg
                                                                                                                                                                                                                                      MD5:C3A987B9AD24315E7713E2CBDA867000
                                                                                                                                                                                                                                      SHA1:2E1777A1B306D35D1A29486AC09F2D31D7F6AE57
                                                                                                                                                                                                                                      SHA-256:A13F9A8BFC7487B906E485277E05FC0CDD898ACB447890B55D95EAB4B9EFDA3B
                                                                                                                                                                                                                                      SHA-512:AE92FACCE527CDEBBBB56AE7376A17277555732B2D444EACB44DC782FF857DDD2549F453C9FDE232D75BF76CE1E7F83D99CEB85A7C395E1E5377E68197B2F026
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "........ .......... ...-...... .. McAfee, ..... {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "........ ..........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}, ..... ............ ......... ....... .............. ......: .......... ..... McAfee., ........... ....... . ........... .........",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "........ ..........",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}, ..... .......... . ............ . ......... ......... ............. ......... .............. ....... ......: .......... ..... McAfee., ........... ....... . ........... .........",.. ADBLOCK_SEARCH_W

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1420
                                                                                                                                                                                                                                      Entropy (8bit):5.806357329480763
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT/iSRyjWeDvEPpRK2NF1I5DyjePD+hCf3c4kcrBlWF8x:P3YSeYpccF1Ic6Chm3jtAmx
                                                                                                                                                                                                                                      MD5:25F7E80CBBF78362DD46936F1293CCFE
                                                                                                                                                                                                                                      SHA1:85D30C6410BEA4A4361C08222A0698D1C33ADB7F
                                                                                                                                                                                                                                      SHA-256:F3BD98BBB824883DAA209924E9676259C014ED39BB7AEA717EBCA1846D08E2B9
                                                                                                                                                                                                                                      SHA-512:A91AFE73BFF7CBD96BAC0B846249D619AF226A4101A6CB1EFD432519C80EF9F41F8B1ECB1D7C4C4BA752F3408101F6357F478E2D21B13B7706A2DB91F00F5BE0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Z.skajte bezplatn. webov. ochranu od McAfee a.kliknite na mo.nos. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Zapn.. roz..renie",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} a.aktivujte funkcie zv..enej ochrany: zabezpe.en. vyh.ad.vanie McAfee., blokovanie rekl.m a.blokovanie sledova.ov.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Zapnite roz..renie",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} a.nestra.te ochranu online v.aka funkci.m zv..enej ochrany: zabezpe.en.mu vyh.ad.vaniu McAfee., blokovaniu rekl.m a.blokovaniu sledova.ov.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Ponechajte zmeny",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor a.zapnite funkcie zv..enej ochrany: zabezpe.en. vyh.ad.vanie McAfee., blokovanie rekl.m a.blokovanie sledova.ov.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Povo.te",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Zapnite r

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1338
                                                                                                                                                                                                                                      Entropy (8bit):5.635744905742948
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT4eGvvtCawa+dCIHrFwa+Npp1mCawa+rUoDOGnDk/flbhlZRmn:IeCvtCawa+dCIBwa+NVmCawa+rUoDOGV
                                                                                                                                                                                                                                      MD5:16BC3BCF0766E9D1BE6C6E9E69EB48E5
                                                                                                                                                                                                                                      SHA1:06EFDB3C104FC91B9AF1B15D2E9A6A9CCF848532
                                                                                                                                                                                                                                      SHA-256:E8D2504729C03361D7D7E52C1991C008468D94BDA31346121EF7E6C25873A62A
                                                                                                                                                                                                                                      SHA-512:DB617851863B3F4B4348D5FF15B51225C94A197C69577A9F14AB53524C233881DD58D3A0E9081D5794BA4158CA8583F6A15697E590644EEFDD5D5BA1189296AB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "Ostvarite besplatnu veb za.titu kompanije McAfee klikom na {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.ite ekstenziju",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} da biste uklju.ili ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Omogu.ite ekstenziju",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} kako biste ostali sigurni na mre.i uz ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Zadr.ite promene na",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor da biste uklju.ili ove funkcije Dodatne za.tite: McAfee. Bezbedna pretraga, Ad Blocker i Tracker Blocker.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Dozvoli",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Omogu.ite ekstenziju",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "da zavr.it

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1361
                                                                                                                                                                                                                                      Entropy (8bit):5.647077111768158
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT7ecjfypbD4qpbD02gVpbDYX/P33zMc2N9jkHu:rDOpbD4qpbD0JVpbDYX/P33zd2N6O
                                                                                                                                                                                                                                      MD5:6E9C0635BB2057998EEA910AA6853EBB
                                                                                                                                                                                                                                      SHA1:8E10D4738E4520E9E7FC6EBD912ADD75E915024E
                                                                                                                                                                                                                                      SHA-256:7FF985F4B97BE26E7281A7D755C2FD2757627F01AFB8B670DBE067063BE8EE8A
                                                                                                                                                                                                                                      SHA-512:0DC3576DED02972B1A4BCEE27F17D4253BB921C7A985CDA2D8DA79D7086C139BD8413DB6F6FC861684506AB90F502581732679E183EC6B39E813D5867C3DBB2D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "F. kostnadsfritt webbskydd fr.n McAfee genom att klicka p. {0}.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktivera till.gg",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} f.r att aktivera Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Aktivera till.gg",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} f.r att forts.tta h.lla dig s.ker online med Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "Beh.ll .ndringar",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor f.r att aktivera Ut.kat skydd-funktionerna: McAfee. S.ker s.kning, Annonsblockering och Blockering av sp.rare.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "Till.t",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "Aktivera till.gg",.. CHROME_ENABLEMENT_GUIDE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1404
                                                                                                                                                                                                                                      Entropy (8bit):5.681986531007875
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HT3Nd7QUN3Z/UVXMJgYZ/v94oIuZ/Nc7I4dBng5cFPkliIKCql:tBQUNGVcDxBc7HTFMliI2l
                                                                                                                                                                                                                                      MD5:28F20893B2A4ED4675765FD8C0095900
                                                                                                                                                                                                                                      SHA1:25BD043C0A790C0810034A609E720599A2282E95
                                                                                                                                                                                                                                      SHA-256:97FAADF7C2412B155881520048D92B79276AC8B6778827FF99392515A56F2493
                                                                                                                                                                                                                                      SHA-512:99DEEEEB38C1AF38DD28C61EACA778AE916438A5FA050FD89FE742DC3ECBF40F9248B6C079EE8655CF4CE01267AF2AB11094B234A7834D0B8EE7DDFE3A2D1920
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: "{0} .zerine t.klayarak McAfee'den .cretsiz web korumas. edinebilirsiniz.",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Uzant.y. etkinle.tir",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "A.a..daki Ek Koruma .zelliklerini a.mak i.in {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "Uzant.y. etkinle.tir",.. ADBLOCK_SEARCH_WARNING_CONTENT: "Bu Ek Koruma .zellikleri ile .evrimi.i g.vende kalmak i.in {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "De.i.iklikleri kaydet",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "A.a..daki Ek Koruma .zelliklerini a.mak i.in McAfee. WebAdvisor'. {0}: McAfee. Secure Search, Reklam Engelleyici ve .zleyici Engelleyici.",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: ".zin Ver",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "WebAdvisor kurulumun

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1303
                                                                                                                                                                                                                                      Entropy (8bit):6.291583352165866
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTjjZ8CKz+1CaxNs/CthZvG7qXdNqZBS:pQzaxmahZv9eZBS
                                                                                                                                                                                                                                      MD5:6256306678C77FDEDA3B693EE8FD127C
                                                                                                                                                                                                                                      SHA1:5F121EBA669DAF34206ED6BD6CF52F65ECE81311
                                                                                                                                                                                                                                      SHA-256:FE5D54A3CEB50B68F8478255401812F1728DAD218AA682B26BCC02A84060A039
                                                                                                                                                                                                                                      SHA-512:92763EBC5894EF75749668B5FBD57F5649BFB2BD04D90746C6360CDD38B9CC77146DF92F45974C81F70312E31859DCF1AD7239BF8DB6F4CA7F03E67677DDAC40
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: ".. {0} .............",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "....",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0} .................. .....................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "....",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0} .................. ..............................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "....",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} .... ...................... .....................",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "......",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1249
                                                                                                                                                                                                                                      Entropy (8bit):6.276892426445918
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HTAOzmcPZeSlGkyTDnZZeSlGCGtDcPZeSlGW17/10lQZ04QJ:dzmkCkyTDn/CCGtDkCW1LQJ
                                                                                                                                                                                                                                      MD5:61644577A965E278A69D0FB294252E08
                                                                                                                                                                                                                                      SHA1:FE30E80D6EDF71AC83491334C5C1433D67B2DD19
                                                                                                                                                                                                                                      SHA-256:FF2769B8B4D9B72F20A5DD2CD7478745A215BCED22BEB03099AF0EEC1A2783B0
                                                                                                                                                                                                                                      SHA-512:FB7A796B107133E9BD59830A9E9EE68A11A2BFD1411DA2EB7585B9D7B4046E527CF3B99B56088C5F20ABB28642A367FC942F199A3E2446D20A74A319026F9926
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. ACCEPTANCE_EXTENSION_CONTENT: ".. {0} ..... McAfee Web ...",.. ACCEPTANCE_EXTENSION_CONTENT_STRONG: "......",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT: "{0}............McAfee. ....................",.. ADBLOCK_ACCEPTANCE_EXTENSION_CONTENT_STRONG: "......",.. ADBLOCK_SEARCH_WARNING_CONTENT: "{0}....................McAfee. ....................",.. ADBLOCK_SEARCH_WARNING_CONTENT_STRONG: "....",.. ADBLOCK_PERMISSION_ADDED_CONTENT: "{0} McAfee. WebAdvisor ...........McAfee. ....................",.. ADBLOCK_PERMISSION_ADDED_CONTENT_STRONG: "..",.. CHROME_ENABLEMENT_GUIDE_BUTTON: "......",.. CHROME_ENABLEMENT_GUIDE_CONTENT_1: "... WebAdvisor ...",.. CHROME_ENABLEMENT_G

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1048
                                                                                                                                                                                                                                      Entropy (8bit):5.7432415026721815
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGY406vV41eK+59CpMSqKBgvtdUeniGdZIV7mTTOkB:24e+59YMdZZZnOkB
                                                                                                                                                                                                                                      MD5:0B456AD915226748362599A2DBD5D9A9
                                                                                                                                                                                                                                      SHA1:27D61AF7830565A60C7A1318B1096E7154834549
                                                                                                                                                                                                                                      SHA-256:AB752F1BAC0BBF18F3D34BC01AC2682F81810439C34256B37D2A1BE6377FF8D5
                                                                                                                                                                                                                                      SHA-512:166F7D1D2AC050F87C511AB7DD118E111B752E4585808F901B386CC391B050CD79871795BD270EC82B19976B0194CD294EED4C000D0DC82309E8BCE844D65E69
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Zajist.te si ochranu v digit.ln.m prost.ed.",.. WAIFF_TOAST_DESC_1_COHORT_1: ".kolem n.stroje McAfee. WebAdvisor je chr.nit va.e osobn. .daje, aby se nedostaly do nespr.vn.ch rukou.",.. WAIFF_TOAST_DESC_2_COHORT_1: "A. ji. nakupujete, vyu..v.te bankovn. slu.by nebo proch.z.te web, na.e bezplatn. n.stroje v.s pom.haj. chr.nit . a kyberzlo.inci nebudou m.t .anci.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je bezplatn. n.stroj, kter. chr.n. va.e osobn. .daje, aby se nedostaly do nespr.vn.ch rukou.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Povolte n.stroj WebAdvisor a zajist.te si ochranu p.ed viry, malwarem a dal..mi hrozbami pro va.e online zabezpe.en..",.. WAIFF_BUTTON_ACCEPT: "Zajistit ochranu",.. WAIFF_BUTTON_REMIND_LATER: "P.ipomenout pozd.ji",.. WAIFF_BUTTON_DECLINE: "Ne, d.kuji"..}..//5281157FA202A3ACB6985DF6A37DBC2C92FC64C84A911E2263AC4E7FD7626F4509D52721CAE91AEB52

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):986
                                                                                                                                                                                                                                      Entropy (8bit):5.468750891107369
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG92vXRwV/YIehPFXc9vLfcRwV/YIeSP/GIi7dZMVIQ8g0SUZ/:nVYC9rVYttZg0SUZ/
                                                                                                                                                                                                                                      MD5:77FAFE7BBFF990E28B4E6CAA20FF6612
                                                                                                                                                                                                                                      SHA1:1BB3197CB4A7EF18D4F39CA528DBC61BA8520E07
                                                                                                                                                                                                                                      SHA-256:8D706BF7ADFC4E4664FD5923A4EB8CBF96680090D826CB90EC55AD1C3E970292
                                                                                                                                                                                                                                      SHA-512:F5BF80577CE396A3E125E2494FB904B31DC8FBC02E507B2049D677185957AD303A3339164F425D36581F682EDB5B54D26A5F3191890D12306E659206316F8CF7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Beskyt dit digitale liv",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor beskytter dine personlige oplysninger og forhindrer, at de falder i de forkerte h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Uanset om du bruger internettet til at shoppe, g. i banken eller bare surfe, holder vores gratis v.rkt.jer dig i sikkerhed og beskytter dig mod cyberkriminelle.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor er et gratis v.rkt.j, der beskytter dine personlige oplysninger og forhindrer, at de falder i de forkerte h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktiv.r WebAdvisor for at beskytte dig selv mod virus, malware og andre onlinetrusler.",.. WAIFF_BUTTON_ACCEPT: "F. beskyttelse",.. WAIFF_BUTTON_REMIND_LATER: "Sp.rg mig igen senere",.. WAIFF_BUTTON_DECLINE: "Nej tak"..}..//7B3F9909029C3471478A8B02DAB7CAFD947DED99B103970A120E544EF09BA6E985D3683EFF2C6E89258831B931C765333C6E9C94F898D76626482305AFB8C30B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1026
                                                                                                                                                                                                                                      Entropy (8bit):5.448818060596771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG+QvxOeGg/OA9kNlv1VOe3F0Sui7xQd/y/QVZrX:QWX9GftF0SJxMa/urX
                                                                                                                                                                                                                                      MD5:945A1356867E3FE35711AAC588C792B9
                                                                                                                                                                                                                                      SHA1:29FD3FA6A3555A2DCE33259D2C362831714610AC
                                                                                                                                                                                                                                      SHA-256:797D02E9F63C56BB45017FC7E3BB9F79D85069667466289BA59B62C9D7F85EFB
                                                                                                                                                                                                                                      SHA-512:DEFD3DE75ED23BCD88C723289E6600BC61E617F386325167C30B2485700B8AF9F0B23CDB33DEC437473D1B3C4BE42B99B692191003D73FE8037734212E867186
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Sch.tzen Sie Ihr digitales Leben",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor hilft Ihnen, zu verhindern, dass Ihre pers.nlichen Daten in die falschen H.nde gelangen.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Ob Sie nun im Internet einkaufen, Bankgesch.fte t.tigen oder surfen: Unsere kostenlosen Tools helfen Ihnen, sicher zu bleiben, damit Cyberkriminelle keine Chance haben.",.. WAIFF_TOAST_DESC_1_COHORT_2: "Das kostenlose Tool McAfee. WebAdvisor hilft Ihnen, zu verhindern, dass Ihre pers.nlichen Daten in die falschen H.nde gelangen.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktivieren Sie WebAdvisor, um sich vor Viren, Malware und anderen Bedrohungen Ihrer Online-Sicherheit zu sch.tzen.",.. WAIFF_BUTTON_ACCEPT: "Schutz einrichten",.. WAIFF_BUTTON_REMIND_LATER: "Sp.ter erinnern",.. WAIFF_BUTTON_DECLINE: "Nein danke"..}..//705C455284B398DB85CC2B60531E9BF2B91F7B11BCE6B051B019960772D83D4C9EDC5D334210DD00D5842D329F139BE678EED973

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1606
                                                                                                                                                                                                                                      Entropy (8bit):5.11484032317632
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGwvlT6DePnEHleEnM+na8cEseDrXHrRvu1QGRXePoEHlesD3ir3rwqDijGduak:4HEHXnjKEXDrXrgKeEHXbirDduDiu
                                                                                                                                                                                                                                      MD5:8D3DD6637EEC2C51EFE99C3F74466D4B
                                                                                                                                                                                                                                      SHA1:325BEA07ECAE89F01BDE24007FFA4CE429F41940
                                                                                                                                                                                                                                      SHA-256:5ACCD5F69B676A4B58D33D548F9569EB65CF398FFE9B68388AA1BFA5191C3025
                                                                                                                                                                                                                                      SHA-512:48F14AB09333D4C2BCEE7F3EEF54EA884CD0E868B921979904450166CDF66F8A35FC9B21CDEC75B5B769C4C2B04E73BFE846AA8AC1B8EA41ECD259CAF2B995F9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "......... ... ........ .... ...",.. WAIFF_TOAST_DESC_1_COHORT_1: ".. McAfee. WebAdvisor .... ..... .. ... ......... .... .......... ........... ... .. ...... .. ..... ......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".... ............... ......, .......... .......... . ........... ... web, .. ...... ........ ... ....... .. ... ......... .. ........... ........ ... .. .......-........... ... .. ..... ..... ........ .. ... ...........",.. WAIFF_TOAST_DESC_1_COHORT_2: ".. McAfee. WebAdvisor ..... ... ...... ........ ... ........... ... .......... ........... ... ... .. .. ...... .. ..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):915
                                                                                                                                                                                                                                      Entropy (8bit):5.485289593543227
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG/4Iv74Ge+uVfWMhCHJHvU0hGecZrD5i9dwdS/ViwvV:l4guUMgHJM06ZSdsSdV
                                                                                                                                                                                                                                      MD5:F92D779EAAAE55A31BCAF3E345B6EA9E
                                                                                                                                                                                                                                      SHA1:F3AD7E0FA59DAB9B1A1B95F464C3EFA4469B5923
                                                                                                                                                                                                                                      SHA-256:512F56FCDD9FA3412729625935347B10E5A75C966F77704117D2BB8E2E69943D
                                                                                                                                                                                                                                      SHA-512:AB3CB1425051788C0D6ED8B82ED1EF697C0A9EDFA58C03CB3AE8FB32289A437BD034F027575E3672438BEC73C48D577AA8DCEE9682BA27A7372C03BBB893E0A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Protect your digital life",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor works to safeguard your personal info from falling into the wrong hands.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Whether you shop, bank, or browse the web, our free tools can help keep you safe -- and cyber criminals won't stand a chance.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor is a free tool that safeguards your personal info from falling into the wrong hands.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Enable WebAdvisor to protect yourself against viruses, malware, and other threats to your online security.",.. WAIFF_BUTTON_ACCEPT: "Get protected",.. WAIFF_BUTTON_REMIND_LATER: "Remind me later",.. WAIFF_BUTTON_DECLINE: "No, thanks"..}..//F13762CCD6FC20E1B52C858144967E692EB22C7D5B04964FF197DDBE74B35756F2636FB3AFE8FB5A0608A39AB12E2B0D9426EB4623665CD3FE877855C3969CF7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):965
                                                                                                                                                                                                                                      Entropy (8bit):5.436239874948396
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGKvMwKimzpe4sTtkAFvZxR/mzpeWLdvRYjiOdSXkHVySdEhe:V/RcKkxspJYbSXkQ+V
                                                                                                                                                                                                                                      MD5:6CCC38A61AEF9934A5B1815901A5E110
                                                                                                                                                                                                                                      SHA1:CEAAECFFA977D59EE52D0EA74B5988464C73B2E4
                                                                                                                                                                                                                                      SHA-256:AB64003948AE90664F4AE574854BF6FEAF4AD33FA9C5F7C60AD28C5272BACDC3
                                                                                                                                                                                                                                      SHA-512:8D2CB2F699E92A3ED0B85A56D009609DB41DB7080C40F7D9D1303C3E1D3C88E584D05BF38CE211C41CD696EBF1D8DC2681E8C04133A827330D70EA539ECB2015
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja su vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor est. pensado para evitar que su informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Nuestras herramientas gratuitas pueden protegerle al navegar, realizar compras y gestiones bancarias. Los ciberdelincuentes dejar.n de ser un peligro.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor es una herramienta gratuita pensada para evitar que su informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Active WebAdvisor para mantenerse a salvo de virus, malware y otras amenazas para su seguridad en Internet.",.. WAIFF_BUTTON_ACCEPT: "Protegerme",.. WAIFF_BUTTON_REMIND_LATER: "Record.rmelo m.s tarde",.. WAIFF_BUTTON_DECLINE: "No, gracias"..}..//E430E0443B01D62E8F18D991ED2A0A0BB09FFB8E3DAFB82B9AEFEDB8C25C719E825F15DC42CA9B9267185DC6A83B1057BB634439363A58527D7C0E5C4066E4A1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):938
                                                                                                                                                                                                                                      Entropy (8bit):5.457166962637053
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGSvyUpep4n0OlvZxxzpeWLZV2iadSXkHVHQzEI:R4nHxP9KSXkl4
                                                                                                                                                                                                                                      MD5:05B756F8022568981FF15FA9B43FACC3
                                                                                                                                                                                                                                      SHA1:E467120C7E6DA2868A8493B11EF9A46F80039230
                                                                                                                                                                                                                                      SHA-256:C78EAF8B5D7F5056487B03886D23646D2786324C56345D835B8BB292052778FA
                                                                                                                                                                                                                                      SHA-512:25ABB3D8F1B52E8012FC09FB312C87D5E85B73512B6D056FFD976C811ACEFFAA234824C6BFF48135C15274566B35B852040B7B3CEBE55FCC20B2D98DED5275A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Protege tu vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor trabaja para evitar que su informaci.n caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Sea que compre, haga operaciones bancarias o explore la web, nuestras herramientas gratuitas ayudan a mantenerlo seguro, y a derrotar a los cibercriminales.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor es una herramienta gratuita para evitar que tu informaci.n personal caiga en malas manos.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Active WebAdvisor para protegerse contra virus, malware y otras amenazas a su seguridad en l.nea.",.. WAIFF_BUTTON_ACCEPT: "Prot.jase",.. WAIFF_BUTTON_REMIND_LATER: "Record.rmelo m.s tarde",.. WAIFF_BUTTON_DECLINE: "No, gracias"..}..//EDEC7644536F08210664C6DA1D3296E17AD581EA4406EBF731267112F9F05298D4C58AE72E4A8A7994BD222E60BE0DD8D3D4C4B7CF900EE46D8414E7FBE82144++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):992
                                                                                                                                                                                                                                      Entropy (8bit):5.522067171971699
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGrvpj8feM9FkTJ/XvQEbJjZjeX3EliRDd8tmQV95Qc:3qF4Z59lQEmdo
                                                                                                                                                                                                                                      MD5:256AD474E95AC8C8196FAF5FC5E7E67F
                                                                                                                                                                                                                                      SHA1:70E4367931271E8ED13B49B0419C3131B8BA2AE3
                                                                                                                                                                                                                                      SHA-256:6D61F861C9D6D589E7F9503C7FB9F56B652845749991EB048C7CB57703F83266
                                                                                                                                                                                                                                      SHA-512:9BB640555A4235DDAC03877CA937FBEB41A94145257116A4E07BA89163FE64A6C2FBF09FF8B36002CF6E729EDC704973C65F4D8850C65F13CF6609A30E769052
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Suojaa digitaalinen el.m.si",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor pyrkii est.m..n henkil.kohtaisten tietojesi joutumisen v..riin k.siin.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Miten tahansa viet.tkin aikaa verkossa . ostoksia tehden, pankkiasioita hoitaen tai sivustoja selaillen . pysyt turvassa maksuttomien ty.kalujemme avulla. Kyberrikollisilla ei ole mit..n saumaa.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor -ilmaisty.kalu est.. henkil.kohtaisia tietojasi joutumasta v..riin k.siin.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ota WebAdvisor k.ytt..n suojautuaksesi viruksilta, haittaohjelmilta ja muila tietoturvauhilta.",.. WAIFF_BUTTON_ACCEPT: "Hanki suojaus",.. WAIFF_BUTTON_REMIND_LATER: "Muistuta my.hemmin",.. WAIFF_BUTTON_DECLINE: "Ei kiitos"..}..//D04F820D2B0455D8E9DBB1BA08EC3707CCC31AA1ED8945E2AFEF8ACDF28C76497D85D8841A0E353886BED4DA2F0C749BDADB1698CEA985B269B974F19EA2B297++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1082
                                                                                                                                                                                                                                      Entropy (8bit):5.430324895927245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGNwvlMmlPcePzFzW0AvZrONq2lPce+XRKjwihGyAdCVqzAQuccMI:SMmlxpq0YrR2lkRKRUU9B
                                                                                                                                                                                                                                      MD5:FAE2BF0652C3A09B72D3FBB6302F9AA7
                                                                                                                                                                                                                                      SHA1:D70A18039BF3FB030AAD2D10A549D5ACFDEE9A4D
                                                                                                                                                                                                                                      SHA-256:B49A16ED8218207D54EF934325172743528800A77CBD5F770409E5F90EFA33E2
                                                                                                                                                                                                                                      SHA-512:2DD69F12EE0755ED08BEB24388F8D8334A98A9DC0880F0699B2DEDFAB6D43546E42C1A4B1CAD8942656AD531016A384C69EF020D2E97EAEC9EAE3EADA04CA541
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Prot.gez votre univers num.rique",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor oeuvre . s.curiser vos donn.es personnelles et les emp.cher de tomber entre mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Quand vous magasinez, effectuez des op.rations bancaires ou parcourez le web, nos outils gratuits contribuent . votre s.curit. -- et les cybercriminels n'ont aucune chance contre vous.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor est un outil gratuit qui s.curise vos donn.es personnelles et les emp.che de tomber entre mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Activez WebAdvisor pour vous prot.ger contre les virus, les logiciels malveillants et d'autres menaces pesant sur votre s.curit. en ligne.",.. WAIFF_BUTTON_ACCEPT: ".tre prot.g.",.. WAIFF_BUTTON_REMIND_LATER: "Me le rappeler plus tard",.. WAIFF_BUTTON_DECLINE: "Non, merci"..}..//6ECAFF7EBDA9AD6618FFC47FA41B054F05A030888F0D2AB1

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1128
                                                                                                                                                                                                                                      Entropy (8bit):5.402508955862292
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGmowvBtNhlFsceiA/6FVFzupllnF4vZrJ5NhlFsce+XvJ+wiZQdqVqDD9:eNhllA/6FVFOlOrJ5NhlNUMH
                                                                                                                                                                                                                                      MD5:2E2E06A01F4766C8DDD3B6F5D0F6B752
                                                                                                                                                                                                                                      SHA1:1402F5B07CE59959386EAF576EB4E3309CC8EA11
                                                                                                                                                                                                                                      SHA-256:EF2DF4CFB5B5A8C2F62454B8CB1AE9ED9D8109F0714DA86AF3377B4F0E830326
                                                                                                                                                                                                                                      SHA-512:E62F90D43240D01C0E9D2E59EAB8991B0D61079F41D5128877303D0752E5BDE36DFC771EF03371C38F5EAEB6C144D3999105CF1D1C36ECC09AD3DE732BB73729
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Prot.gez votre vie num.rique",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor s'efforce de prot.ger vos donn.es personnelles pour les emp.cher de tomber entre de mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Que vous fassiez des achats en ligne, effectuiez des op.rations bancaires ou naviguiez sur le Web, nos outils gratuits vous aident . rester en s.curit..: les cybercriminels n'auront aucune chance d'arriver . leurs fins.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor est un outil gratuit qui prot.ge vos donn.es personnelles pour les emp.cher de tomber entre de mauvaises mains.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Activez WebAdvisor pour vous prot.ger contre les virus, logiciels malveillants et autres menaces pour votre s.curit. en ligne.",.. WAIFF_BUTTON_ACCEPT: "Obtenir une protection",.. WAIFF_BUTTON_REMIND_LATER: "Me le rappeler ult.rieurement",.. WAIFF_BUTTON_DECLINE: "Non, merci"..}..//EA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):970
                                                                                                                                                                                                                                      Entropy (8bit):5.53684099046014
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGjvA5v/6FewAv/dHvav/6Fe0QhJ4Mmi6dwVu863JVQjSXh:S5vyAvlSvSG2M0H1My
                                                                                                                                                                                                                                      MD5:2C2EF6419A4146CEBF9490BB41E213FC
                                                                                                                                                                                                                                      SHA1:D67637CCD33A2E2C959DC530715A77647A4A43B5
                                                                                                                                                                                                                                      SHA-256:A9531C569889C5C7E65866EA7431533987FBFA16C0D80046D4073B5D0D4365B1
                                                                                                                                                                                                                                      SHA-512:5D9B15F5DCE61E69AA2760A27CF41EC71DCDACD11F605787ACE2D6071C81088DA02A43CADFD9349850AC49C53ED98D3ACFBB65B2763601028813D8661691A8B7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Za.titite svoj digitalni .ivot",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor djeluje kako bi za.titio va.e osobne podatke od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Bez obzira da li kupujete, bankarite ili pregledavate web, na.i besplatni alati mogu vam osigurati sigurnost - a cyber kriminalci ne.e imate .ansu.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je besplatni online alat koji .titi va.e osobne podatke od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Omogu.ite WebAdvisor kako bi se za.titili od virusa, zlonamjernog softvera i drugih prijetnji va.oj internetskoj sigurnosti.",.. WAIFF_BUTTON_ACCEPT: "Za.titite se",.. WAIFF_BUTTON_REMIND_LATER: "Podsjeti me kasnije",.. WAIFF_BUTTON_DECLINE: "Ne, hvala"..}..//C2004829C342DD4C714297110BC9ADA2F6D4CC8EB3605A79E5290A775BA0ED702C46625E8AF1FC06FE2366551B2E742EBB09A6DF86CF5A1FDF247D8897318A7E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1111
                                                                                                                                                                                                                                      Entropy (8bit):5.602686551909707
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG7bmvSr5Mycde/FsuaVvQG2Qe5MycdefYasTyrikPId7r6QVbTzV/K3nDJJ/:RTUju5UJ3TyVE7NzU3ndJ/
                                                                                                                                                                                                                                      MD5:215936230336E79835B741392148AE73
                                                                                                                                                                                                                                      SHA1:F444714F470318205D0506E8BCC864DA8B93256F
                                                                                                                                                                                                                                      SHA-256:2C395124CB19D2BBF519EB911AD53BF51D7562C82FF7209A5555AE658E0A6BA9
                                                                                                                                                                                                                                      SHA-512:1355AB668092A14A877A189F4B78B839AF3DC37B7CB2863396684FC064977C5B02056F8205B4DAA55BCF39B7FA8294841FCA8446D1FD2FD1515A8EBD556A15E9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Gondoskodjon digit.lis .let.nek v.delm.r.l",.. WAIFF_TOAST_DESC_1_COHORT_1: "A McAfee. WebAdvisor megakad.lyozza, hogy szem.lyes adatai illet.ktelenek kez.be ker.ljenek.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Ak.r v.s.rol, banki .gyeit int.zi vagy b.ng.szik online, ingyenes eszk.zeink gondoskodnak v.delm.r.l, hogy az internetes b.n.z.knek es.ly.k sem legyen.",.. WAIFF_TOAST_DESC_1_COHORT_2: "A McAfee. WebAdvisor egy ingyenes eszk.z, amely megakad.lyozza, hogy szem.lyes adatai illet.ktelenek kez.be ker.ljenek.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Enged.lyezze a WebAdvisor funkci.t, hogy biztons.gban legyen a v.rusokkal, a k.rtev. programokkal .s az egy.b vesz.lyforr.sokkal szemben, amelyek online leselkednek .nre.",.. WAIFF_BUTTON_ACCEPT: "Gondoskodjon a v.delemr.l",.. WAIFF_BUTTON_REMIND_LATER: "Eml.keztessen k.s.bb",.. WAIFF_BUTTON_DECLINE: "K.sz.n.m, nem"..}..//65DF69CC7B4DFA70F0D

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):978
                                                                                                                                                                                                                                      Entropy (8bit):5.363993895689114
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGKk2vkvtdeLny8MK9GEreLYvl6lvtdeVHD/ikdCeitVo0MJ:tBQxMK7eLjYCeN0O
                                                                                                                                                                                                                                      MD5:E30C0F9EA1225C5FD8B0AE7F9F9D6299
                                                                                                                                                                                                                                      SHA1:90894D52636109F18A019EA6CD740048C8E18BD9
                                                                                                                                                                                                                                      SHA-256:404B4F86C70726C074B59948DB3BFEE9EC22A276C61D1B73577A8D039DF1786D
                                                                                                                                                                                                                                      SHA-512:E67649001162F6619762736570DA1EF984686D517B5433EC5552BB6C3DCD1B59AB873B9A661CBD552DD859479FE137F749821A46FBF0C82859E56B00C6EE2379
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteggi la tua vita digitale",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor impedisce alle tue informazioni personali di finire nelle mani sbagliate.",.. WAIFF_TOAST_DESC_2_COHORT_1: "I nostri strumenti gratuiti ti aiutano a restare protetto e tenere alla larga i criminali informatici quando fai acquisti, esegui transazioni bancarie e navighi in Internet.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . uno strumento gratuito che impedisce alle tue informazioni personali di finire nelle mani sbagliate.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Attiva WebAdvisor per proteggerti da virus, malware e altre minacce alla tua sicurezza online.",.. WAIFF_BUTTON_ACCEPT: "Proteggiti",.. WAIFF_BUTTON_REMIND_LATER: "Visualizza in seguito",.. WAIFF_BUTTON_DECLINE: "No, grazie"..}..//ED0BC458F485C244D37F2D439A10D49130004DB7AE94C8153D2AD2F1EA18323EA3D27CD1C4191997F71E2D60C1AE7C4C56BF560C4B40405F00473211DF797DE5++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1220
                                                                                                                                                                                                                                      Entropy (8bit):5.720561231216306
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG7QvTYRFqOqeEnckuxTvlRFqOlesuhxkOQihdPvIVbfTxVWiK:ZQYRFqkZrRFqcuzBvPv0TTWiK
                                                                                                                                                                                                                                      MD5:0E7C5CB269541284E952B41AADFD3F06
                                                                                                                                                                                                                                      SHA1:A39A02E759C2EF95ABD26AAE4CBE5E99E7600112
                                                                                                                                                                                                                                      SHA-256:866EFDCA5DBEF77B63A5E30844242EB831B633DAE6AA47D096D0E8D8C2E34485
                                                                                                                                                                                                                                      SHA-512:286709D251AD6775EA6986A55D9D453BF14B38F9BC72540F3EBF0453BA38DD2C33A7652FC97103F11CFE6EC2292B0A981F39BF1C8AC63853323386CF6DA8A149
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: ".... ...........",.. WAIFF_TOAST_DESC_1_COHORT_1: "...... ......................................",.. WAIFF_TOAST_DESC_2_COHORT_1: "..... ............ ................................................................",.. WAIFF_TOAST_DESC_1_COHORT_2: "...... ............................................",.. WAIFF_TOAST_DESC_2_COHORT_2: "..........................................................",.. WAIFF_BUTTON_ACCEPT: ".....",.. WAIFF_BU

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):986
                                                                                                                                                                                                                                      Entropy (8bit):5.998055861973347
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGqSv513heSk6BcSVpFrhjvG13DaJe/MhCowW/irdijVAJv59PehLqQ:0cdFvrhqD0QRPii590qQ
                                                                                                                                                                                                                                      MD5:571DBB13922DDDE8E2ED3C79A672AA46
                                                                                                                                                                                                                                      SHA1:3B981620CA381C58783AF247BE77C865D4B58AFA
                                                                                                                                                                                                                                      SHA-256:55B10A54F36AAC21512D3994A543A37083B610D15598457F9EBBBA261F0A5F14
                                                                                                                                                                                                                                      SHA-512:CE9A7B91DC0F58E91F6DD10857255229E7349767BB5FB7E8030E0417E1F440079DA7CB339EE43BF5D16103E99EEAF2854199FF31201161CFC4CAB97F7454F3BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "... ... ..",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. ....... .. ... .... ... ......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".., .. .. . .. . .. ..... McAfee .. ... ... ... .... ... .... ... ... . .....",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. ....... .. ... .... ... .... .. ......",.. WAIFF_TOAST_DESC_2_COHORT_2: "....... .... ...., ... . .. ... .. ...... ......",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: "... ..",.. WAIFF_BUTTON_DECLINE: ".. . ."..}..//222D8263193BC4AEB75631BA71E12257A78A197F4F707886DADFD14C12C1F265E506B9750FA5E612B5CB0C073C5258F0310AD2ECD61E14E13064B30555E80D16++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):962
                                                                                                                                                                                                                                      Entropy (8bit):5.486271804331691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uG9IvAh1IerDGuH9tvIzzh1IeLkGAlIi7dkVpFlXic:fLd+LtkHtSDic
                                                                                                                                                                                                                                      MD5:C13070E5BDF6B5B1AAAF9F72B2BF5668
                                                                                                                                                                                                                                      SHA1:F1D20DB4E08403A434402774A9BA3B47486AD6E0
                                                                                                                                                                                                                                      SHA-256:8CF583206062D1FC176835506362045DFE259033DDFC2CAD41DC660CE9A7D46D
                                                                                                                                                                                                                                      SHA-512:764B1A9BB3BDC66E1C6C2F24C25885AD43F8913FC8B110719D82BA7DC309C30327C35310EED269E2F93EEBD9B23E48E3DC303818999A9318D63EA89DBD00A970
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Beskytt det digitale livet ditt",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor bidrar til . forhindre at personopplysningene dine havner i gale hender.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Enten du handler, bruker nettbank eller surfer p. nettet, kan de kostnadsfrie verkt.yene v.re holde deg trygg . og nettkriminelle har ingen sjanse.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor er et kostnadsfritt verkt.y som bidrar til . forhindre at personopplysningene dine havner i gale hender.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktiver WebAdvisor for . f. beskyttelse mot virus, skadelig programvare og andre nettrusler.",.. WAIFF_BUTTON_ACCEPT: "F. beskyttelse",.. WAIFF_BUTTON_REMIND_LATER: "P.minn meg senere",.. WAIFF_BUTTON_DECLINE: "Nei takk"..}..//5C3D661F48995F966A70D69180093AF77593D6984D7E3E1B7CB92A522988BA35B4DD093C990693523A8D42488660EAD0D427DDBED16D587258218B5552232686++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1008
                                                                                                                                                                                                                                      Entropy (8bit):5.379834205254167
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGCbQvNQ/JHeGLwpBgvNTHUQ/JHeHgjQui8QydMiQVFxZ0jWZH:wbE+JjwpMU+JeaQuHxs0K
                                                                                                                                                                                                                                      MD5:1FAF74B1D3C6CB333558917CE2366938
                                                                                                                                                                                                                                      SHA1:D5436164B931F2E3F9F0D859150148F5A80C60D2
                                                                                                                                                                                                                                      SHA-256:EACEF0D43993776299429F90F4DD764E5FEB3B1ED978FFE7EDE0F279845DB0C8
                                                                                                                                                                                                                                      SHA-512:A6B683D751DD9CFB6E9D1C741DAE35D327B9C06511CCAFF8DB48B25BA3D783D7D1E4658AEF6E9B17DFCD23A1F95CC431D760DA8142B2D798C166C6780861982D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Bescherm uw digitale leven",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor beschermt u door te voorkomen dat uw persoonlijke gegevens in de verkeerde handen vallen.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Of u nu online winkelt, bankiert of surft, onze gratis tools kunnen u helpen om uw veiligheid te handhaven. Cyberciminelen maken geen schijn van kans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor is een gratis tool waarmee u kunt voorkomen dat uw persoonlijke gegevens in de verkeerde handen vallen.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Schakel WebAdvisor in om uzelf tegen virussen, malware en andere bedreigingen van uw online beveiliging te beschermen.",.. WAIFF_BUTTON_ACCEPT: "Zorg dat u beveiligd bent",.. WAIFF_BUTTON_REMIND_LATER: "Help mij herinneren",.. WAIFF_BUTTON_DECLINE: "Nee, bedankt"..}..//8362F99913AAD084BDB46AB898ABB1B71CCBBE63CA4FE3454EAF281967E3EEEC7CAFC88FB801881146DA0BEE784D01C6C37E41C5ACB0219E5C7420D7B6

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1093
                                                                                                                                                                                                                                      Entropy (8bit):5.661563477710932
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGVNFvLnLYFCeTKTv0vmNGHKZYFCeoVmPbYCjisi2d8VVNNy33hOZ:PnLaKTvdckXVmPbvUO8Dy3ROZ
                                                                                                                                                                                                                                      MD5:3525DDB2F30F7565DDB6ED18BCCC04D8
                                                                                                                                                                                                                                      SHA1:B0532E3E00BDDD5A087AD613F029D9C52DA6CB8F
                                                                                                                                                                                                                                      SHA-256:F237B09229DBB9C7AA0F35240E32A31001A5BCBD9A3C7E7D15D12284E8503A87
                                                                                                                                                                                                                                      SHA-512:EE28A057BC388BD3EDA7CFFB7FB0F3BC113DE8F5E8D0C3E04B8C3EF123390D8C48C4EB4DA42DF4153820A76B8F899DA2E7EA58E906AAA005C7B4BD4A463F710A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Bezpiecze.stwo w cyfrowym .wiecie",.. WAIFF_TOAST_DESC_1_COHORT_1: "Rozszerzenie McAfee. WebAdvisor dzia.a w celu zabezpieczenia Twoich danych osobowych przed wpadni.ciem w niepowo.ane r.ce.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Nasze bezp.atne narz.dzia pomog. Ci. zabezpieczy. przy zakupach, korzystaniu z bankowo.ci lub podczas przegl.dania Internetu . cyberprzest.pcy nie maj. szans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "Rozszerzenie McAfee. WebAdvisor to bezp.atne narz.dzie chroni.ce Twoje dane osobowe przed wpadni.ciem w niepowo.ane r.ce.",.. WAIFF_TOAST_DESC_2_COHORT_2: "W..cz rozszerzenie WebAdvisor, aby chroni. si. przed wirusami, z.o.liwym oprogramowaniem i innymi zagro.eniami dla bezpiecze.stwa w Internecie.",.. WAIFF_BUTTON_ACCEPT: "Skorzystaj z ochrony",.. WAIFF_BUTTON_REMIND_LATER: "Przypomnij mi p..niej",.. WAIFF_BUTTON_DECLINE: "Nie, dzi.kuj."..}..//F3E38B302B10D1809203477C6527315E0B003

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1007
                                                                                                                                                                                                                                      Entropy (8bit):5.496378454894593
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGWvGqe4TqfWHvxYLqeo3L9iGdtHVzWgtX20:JsTmLA3LNtx20
                                                                                                                                                                                                                                      MD5:8899A12D177374A1E773048D3CF9BCB4
                                                                                                                                                                                                                                      SHA1:DAE5F43D4F2BF92A0B52E96B4A38C39D81175632
                                                                                                                                                                                                                                      SHA-256:8675BCC36472BA7C972E8FD8D1AB534759012B861E6832558E33FB078C62D6D9
                                                                                                                                                                                                                                      SHA-512:9ADBB4BA346FCCD2E55B86ED787DACF758EC864EB016CFB471894A5D1CCD5F937AEFB9991AD6197A7224E1104DA42656F9B942265987E8B1FC60DD7FBDD618D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja a sua vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor trabalha para impedir que suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Seja para comprar, fazer transa..es banc.rias ou navegar a Web, nossas ferramentas gratuitas podem ajud.-lo a manter-se e seguran.a -- e os criminosos cibern.ticos n.o ter.o a menor chance.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . uma ferramenta gratuita que impede que suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ative o WebAdvisor para proteg.-lo contra v.rus, malware e outras amea.as . sua seguran.a online.",.. WAIFF_BUTTON_ACCEPT: "Proteja-se",.. WAIFF_BUTTON_REMIND_LATER: "Lembrar-me mais tarde",.. WAIFF_BUTTON_DECLINE: "N.o, obrigado"..}..//B4C8C55D0A9539728374305BCD57564250DFE050C1D5B937463EE1107E10765048755FC4FCC83C8A4D3BD82246DF57DC7ED4B9CDFFC8D4095D3FC686F7C

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1038
                                                                                                                                                                                                                                      Entropy (8bit):5.460077956162041
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGWvXqemtvxo8lo8Fv0YYqeorp9i7d0HVCjRkz:munlVYArpm0ojCz
                                                                                                                                                                                                                                      MD5:BD668E8B6F75150D66047408468BACC6
                                                                                                                                                                                                                                      SHA1:95FBE849771C0A6A448381618FCC53C2D9B6886F
                                                                                                                                                                                                                                      SHA-256:103D4067070A4E77C137D708DD74826A17DA20F4E79FE8F06AEBDC2B0AB9F49C
                                                                                                                                                                                                                                      SHA-512:F795402684B32C7ADAC4AFCEB4CF244396F8232895C3BADD213521F20937BD055CCFE08F5A00A38CC1A31FFE2378ADAA17C2B8CE70508BE8B4047FCBD54ADB2A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Proteja a sua vida digital",.. WAIFF_TOAST_DESC_1_COHORT_1: "O McAfee. WebAdvisor trabalha para impedir que as suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Caso fa.a compras, realize opera..es banc.rias ou navegue na Web, as nossas ferramentas gratuitas podem ajud.-lo a manter-se em seguran.a, e os cibercriminosos n.o v.o ter qualquer hip.tese.",.. WAIFF_TOAST_DESC_1_COHORT_2: "O McAfee. WebAdvisor . uma ferramenta gratuita que trabalha para impedir que as suas informa..es pessoais caiam nas m.os erradas.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Ative o WebAdvisor para se proteger contra v.rus, malware, e outras amea.as . sua seguran.a online.",.. WAIFF_BUTTON_ACCEPT: "Obter prote..o",.. WAIFF_BUTTON_REMIND_LATER: "Lembrar mais tarde",.. WAIFF_BUTTON_DECLINE: "N.o, obrigado"..}..//87F2E6FC174E1AFAEBD92BBD958E990F3143F5AC780C18B8E4780B71B0871BA4590E7316B59458017C37EB813DDE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1396
                                                                                                                                                                                                                                      Entropy (8bit):5.223729678928805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGgmLHv4r6HeS0WPHH7XQfOc5TwvFovr6HeyHiM7avIixQd3ImlVXxrUV+THv:amMm7Uh2zaq46y+7
                                                                                                                                                                                                                                      MD5:3820BB070D453754C89877D64E66D0B7
                                                                                                                                                                                                                                      SHA1:74747863FD2E68BAE4C4A4EBAAA0EC3E2201DE9A
                                                                                                                                                                                                                                      SHA-256:8620FB0C1C61B902F06C2905C07E756C7C227C8AE0CC3C546DAC520E462FB727
                                                                                                                                                                                                                                      SHA-512:497F221C2FF74897322A24CF6471E96E8AB555A021F2CB70E777824F64B9BC2325D44C15266083DFBE2FEBD521C83C1AB1AF0FC922525644CF0335C55BCB74AA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........ .... ........ ...",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor ............ .................. ..... ...... .......",.. WAIFF_TOAST_DESC_2_COHORT_1: ".......... .. ...., .......... .. .. ......., .......... ........ ... .............. ...-........, .... .......... ........... ....... .......... .... ...... .. ..... . ..................",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor . .......... .........., .............. .................. ..... ...... .......",.. WAIFF_TOAST_DESC_2_COHORT_2: "........ WebAdvisor, ..... ........ .... .. ......., ........... .....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):954
                                                                                                                                                                                                                                      Entropy (8bit):5.785420919757499
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGqvUTke2+u4Z2M2vtd2keuEAvECuiFdCVt9kHn:s2Ovphn
                                                                                                                                                                                                                                      MD5:BEC1657844380EC152D41F26DB72F2AF
                                                                                                                                                                                                                                      SHA1:4CE896C7DE3BF1CD4A730C10B1E6E283F378CB05
                                                                                                                                                                                                                                      SHA-256:66F51D95DD48CF20C5B2877C611254A971789A6DC1FF178585242364D683668F
                                                                                                                                                                                                                                      SHA-512:B2420F1E5C049D7822E47EFD70FA535CD0BB07274B506AA54C2F50E8E519F74AD89B33044496111BC56CE07B1D363EF7464A86B01EFF582BDBAAEE95F87BB6D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Chr..te svoj digit.lny svet",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor v.m pom..e ochr.ni. osobn. .daje pred ne.iaducimi osobami.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Na.e bezplatn. funkcie v.s ochr.nia pri nakupovan. online, elektronickom bankovn.ctve alebo prehliadan. webu a.nedaj. .ancu kyberzlo.incom.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je bezplatn. n.stroj, ktor. ochr.ni osobn. .daje pred ne.iaducimi osobami.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Zapnite WebAdvisor a.ochr..te sa pred v.rusmi, malv.rom a.in.mi hrozbami, ktor. na v.s ..haj. online.",.. WAIFF_BUTTON_ACCEPT: "Z.ska. ochranu",.. WAIFF_BUTTON_REMIND_LATER: "Pripomen.. nesk.r",.. WAIFF_BUTTON_DECLINE: "Nie, .akujem"..}..//45D6D7954CEFC05DC754717DDDA93C26C85735147608EDC37BCCA3BF92981532CD0DBBBE7FB9B0BCC90593A5942D92AAA2792BF8437A71606F52FD73B9B27F81++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):962
                                                                                                                                                                                                                                      Entropy (8bit):5.563925494198125
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGjvY4FembeVgtvKSFe0WLmLTlwFi1dAVrSDhzW:mlQJnlH2SNW
                                                                                                                                                                                                                                      MD5:704420A9E993429FB96DEBC48984A686
                                                                                                                                                                                                                                      SHA1:D371618971305C0DAEF262752F424B47348415C2
                                                                                                                                                                                                                                      SHA-256:A7C9BEFC06A8B3707DAED444A6203D65E5B95BF25A4333D536E1436BF0738B8F
                                                                                                                                                                                                                                      SHA-512:0A5393A9C55BFA78192A341AB0E32B6BA158ED0A8867C55A0F817B9C1F95BE7689A1B27490BBABD8ECC5BF5970367479A63A7871B9094C8E850B8AA56A6AE5B4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Za.titite svoj digitalni .ivot",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor radi na .uvanju va.ih li.nih informacija od padanja u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Bez obzira da li kupujete, koristite bankarske usluge ili pretra.ujete veb, na.i besplatni alati mogu sa.uvati va.u bezbednost-- a sajber kriminalci ne.e imati .anse.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor je besplatan alat koji .uva va.e li.ne informacije od pada u pogre.ne ruke.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Omogu.ite da vas WebAdvisor za.titi od virusa, malvera i drugih pretnji po va.u bezbednost na mre.i.",.. WAIFF_BUTTON_ACCEPT: "Za.titi me",.. WAIFF_BUTTON_REMIND_LATER: "Podseti me kasnije",.. WAIFF_BUTTON_DECLINE: "Ne, hvala"..}..//8A7A7BBFCEF77E27295AACBFEB5CEBBEBFA26AD5C32C16902DB2E046A8CF6B63ABE6BFA03A189B662D7EB6897C0761E75AA09CCDB385FBE833B4917657B4C5EE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1002
                                                                                                                                                                                                                                      Entropy (8bit):5.500667627680436
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGKlvc49IeIuZR6/Otvo6WT8E9IehgNMxi72dUVIX/jCRtJP:Y9au+2M8E9nqMSOPjGJP
                                                                                                                                                                                                                                      MD5:129F0DAB4D2D66B187CC855602D4C926
                                                                                                                                                                                                                                      SHA1:5351212D61AC1A3D73DCA135BC0013E5723F2FAB
                                                                                                                                                                                                                                      SHA-256:1875E44310F4D4A44EF35173459058CFD6665E8038AEFB324F0E6ACAB58082B4
                                                                                                                                                                                                                                      SHA-512:4F5D59BA0D6F0AF39A6D640EBE71692514EAC5B70B44735AE5BA3FF0777AEEE372A6AD145D96E3FF35DA0F43B5B6191B0D58E9643401902CB425D2EE282994DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Skydda ditt digitala liv",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor jobbar f.r att f.rhindra att din personliga information hamnar i fel h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_1: "Oavsett om du shoppar, utr.ttar bank.renden eller surfar p. internet kan v.ra kostnadsfria verktyg hj.lpa till att h.lla dig s.ker -- och n.tbrottslingarna kommer inte ha en chans.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor .r ett kostnadsfritt verktyg som hindrar att din personliga information hamnar i fel h.nder.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Aktivera WebAdvisor f.r att skydda dig mot virus, skadlig programvara och andra hot mot din s.kerhet p. internet.",.. WAIFF_BUTTON_ACCEPT: "Skydda dig",.. WAIFF_BUTTON_REMIND_LATER: "P.minn mig senare",.. WAIFF_BUTTON_DECLINE: "Nej tack"..}..//6A7B87963BAD2A034B7A9B0F706F606BEB8B063A849E7F99C8F54871957BEA7DDAF93BBEBDE58A6A3250F3AAF93F0B00D27AE0DEFFEC4525B048D11DCCDAF8E4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1061
                                                                                                                                                                                                                                      Entropy (8bit):5.631054618724672
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGS2QvNaIeIse0jz0CtBsvzCOvje4DFkNHiNQd1NHVbaOQ2k:PaahjzHtWbnZMHxk
                                                                                                                                                                                                                                      MD5:9E474EFCA83308514B37F9592AFD7D44
                                                                                                                                                                                                                                      SHA1:228F1579B706CCE1B9350EC44076071A69D44A7C
                                                                                                                                                                                                                                      SHA-256:A5245FB0B6C4D54D4180024574D44AAB17A86A15C54A13EF54219771276989E4
                                                                                                                                                                                                                                      SHA-512:5EA893F077B72AD9B253B674B019153305F4E406C56AC82A30B53628BB50CA59C99FB42D2A486B5A0F2892699036D89CDE3668A1C6AAD7E077902093C5B036FC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "Dijital ya.am.n.z. koruyun",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor ki.isel bilgilerinizin yanl.. ki.ilerin eline d..mesini engeller.",.. WAIFF_TOAST_DESC_2_COHORT_1: ".ster al..veri. yap.n, ister banka i.lemi ger.ekle.tirin, ister web'de gezinin, .cretsiz ara.lar.m.z g.vende olman.za yard.mc. olur; siber su.lular.n hi.bir .ans. kalmaz.",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor, ki.isel bilgilerinizin yanl.. ellere ge.mesini .nleyen .cretsiz bir ara.t.r.",.. WAIFF_TOAST_DESC_2_COHORT_2: "Kendinizi vir.slere, k.t. ama.l. yaz.l.mlara ve .evrimi.i g.venli.inize y.nelik di.er tehditlere kar.. korumak i.in WebAdvisor'. etkinle.tirin.",.. WAIFF_BUTTON_ACCEPT: "Kendinizi koruyun",.. WAIFF_BUTTON_REMIND_LATER: "Daha sonra hat.rlat",.. WAIFF_BUTTON_DECLINE: "Hay.r, te.ekk.rler"..}..//D2F6708E64E1593BD7A3A0C02E12F4833D18B66AFDFFDAE77CD4646C057234045E3D4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):917
                                                                                                                                                                                                                                      Entropy (8bit):6.332666918466607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGFvQsaInleBd82wvxsnInlehoyliIodS8VqiBnBh4qhjz:RaI4i2ZnI9Dyq1z
                                                                                                                                                                                                                                      MD5:E2F297335C6C421C7C079F32EF9EC703
                                                                                                                                                                                                                                      SHA1:CBCFBAC1B668F45AC4094B4959438DB3EF9D97FA
                                                                                                                                                                                                                                      SHA-256:D2706B69BDD37D6D8D119EC88B4C9B2A72E0F9A8F07698A71456FA25DDD77650
                                                                                                                                                                                                                                      SHA-512:2A5DD2E4BF46EECD46411532BB49648DFDB029D892C2555D744E356D3CC69DCA172E73E4B998367D18E489AC887B44D8E93A8A8F7105C7C9E18D015D43D4BA7D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........",.. WAIFF_TOAST_DESC_1_COHORT_1: ".... ...................",.. WAIFF_TOAST_DESC_2_COHORT_1: "........................................................",.. WAIFF_TOAST_DESC_1_COHORT_2: ".... ............................",.. WAIFF_TOAST_DESC_2_COHORT_2: "................................",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: ".....",.. WAIFF_BUTTON_DECLINE: "...."..}..//7E1B9A1E5C32E1A98E2A32470E34762F4E7FEBE769F99D4D6EA46B84B77EF25025C8BB26D42881AF2EE05CCA6FBE17CF899696A428738DD53132B2AF9456466E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):915
                                                                                                                                                                                                                                      Entropy (8bit):6.36668015504765
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7uGYvJeiCCpqKvZeedNsyinkdSgVq47TW30wmRE5:GJRNxtT65
                                                                                                                                                                                                                                      MD5:A27D77F1987B5D1E2150FBB12A40E90B
                                                                                                                                                                                                                                      SHA1:F2FCDD08BC5A006254DA7493A9A568ED505D3582
                                                                                                                                                                                                                                      SHA-256:F9D8C507B59139F173A856B2125C9E1130388496658115D8DB74A27CBD189B2A
                                                                                                                                                                                                                                      SHA-512:F34DB70870587F20DCE66E37EFDA7E40C32EFC2977C47B52D18595B1C561BB9D4E559D460DEC333C335A51FECFEB4D7ACF723BDC00FDA4B9E2EDC3D4CE867C83
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrExtensionInstall_ = {.. WAIFF_TOAST_TITLE: "........",.. WAIFF_TOAST_DESC_1_COHORT_1: "McAfee. WebAdvisor .....................",.. WAIFF_TOAST_DESC_2_COHORT_1: "...............................................",.. WAIFF_TOAST_DESC_1_COHORT_2: "McAfee. WebAdvisor ..........................",.. WAIFF_TOAST_DESC_2_COHORT_2: ".. WebAdvisor ...........................",.. WAIFF_BUTTON_ACCEPT: "....",.. WAIFF_BUTTON_REMIND_LATER: ".....",.. WAIFF_BUTTON_DECLINE: "......"..}..//6E84C1AAA5CBEBB5A5CBDE3AFF2DBB91AFB6895037E42A195A6084896E0F0EBE5B4B9223264CD844AC1878AE6E52454069EF8276156FD9E8F26226507BAD33B0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4962
                                                                                                                                                                                                                                      Entropy (8bit):5.645182296543807
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Ht5PSpPUGEAopoM4odOR9EPH1h1bTzUXToCnqIK92n4laxOQDgf:rqpcGEAQ54ROdhlTCTXqIKM4lansf
                                                                                                                                                                                                                                      MD5:D80A0D574B332C670D1CBE0BFA95D8DD
                                                                                                                                                                                                                                      SHA1:2EAB02F241B941F0553F32BD1C8FA6644CC52007
                                                                                                                                                                                                                                      SHA-256:440028E29265E732D3007F1FEE8D5E67CC3AD893147DF12177F90C31B6FC3B68
                                                                                                                                                                                                                                      SHA-512:7EB1A36F9663934F3E4B95F1DF07285CEFDDA14044655A7CCF021955ADC322A44A24A822D003B1C613A96E7A9CB30B1F07657FB152E4CB40185FFF1C82F51836
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dokon.ete svoji ochranu na internetu . ZDARMA!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Jen tak d.l!",.. OEM_TOAST_VARIANT_INFO: "M..ete se na internetu c.tit mnohem bezpe.n.ji. P.idejte zabezpe.en. vyhled.v.n., abyste dokon.ili ochranu p.i proch.zen. internetu McAfee a zv..ili sv. bezpe.. na internetu.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Aktivov.n.m zabezpe.en. vyhled.v.n. jste dokon.ili nastaven. ochrany p.i proch.zen. internetu McAfee.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Zku.ebn. verze antivirov. ochrany McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrana internetov.ho prohl..e.e",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrana prohl..e.e je va.e linie obrany proti nebezpe.n.m webov.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4454
                                                                                                                                                                                                                                      Entropy (8bit):5.395923614178725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Hud7h5xpL1yuPQacJspPbkwriNTSwcvEFyFQFgrXirAw:M7hTpByuodJspPbrriNmwcvkZFgrSAw
                                                                                                                                                                                                                                      MD5:6EDE9954CC5AC0624CF9623B2DC8C6D7
                                                                                                                                                                                                                                      SHA1:097BBD50D8D4ACA1F17DC55F1DE87E5786105E18
                                                                                                                                                                                                                                      SHA-256:1A12A5D3AA55C8254AAFFE588E37C1A1F42FAF5BE896340D0F9CF386B748C3F5
                                                                                                                                                                                                                                      SHA-512:AB4A3CD3CACF1CB83B04C1325B7ABD40FE9282CD7475EFB1DD52684299A8B394388B04C1DBCB88DFFB9DACD21348C3105A347EEF47F0C8CBA915A604DF9215DC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "G.r konfigurationen af din onlinebeskyttelse f.rdig . GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "S.dan!",.. OEM_TOAST_VARIANT_INFO: "Du kan have en endnu bedre beskyttelse online. Tilf.j s.gebeskyttelse for at g.re konfigurationen af McAfee Web Protection f.rdig og forbedre din sikkerhed online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du har afsluttet oprettelsen af din McAfee Web Protection ved at aktivere s.gebeskyttelse.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Pr.veversion af McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online browserbeskyttelse",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Browserbeskyttelse er din f.rste forsvarslinje mod usikre websteder, links, downloads, malware og meget mere.",.. OEM_TOAST_VARIA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4525
                                                                                                                                                                                                                                      Entropy (8bit):5.3542257187142255
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Hu7HbtZh8r8XUawmvah/R70a0+PNIk02+qjdLcSpQkwqJ7:yHbF8rbme/RRpOk02+QtcSukwW7
                                                                                                                                                                                                                                      MD5:4D8E78CDF5B01FF205264861F935F25A
                                                                                                                                                                                                                                      SHA1:BB21E73EB3CA74F4B65053C65FF89C709F1C087E
                                                                                                                                                                                                                                      SHA-256:C44D8BD83D8095A2790DF4B985A38AD4E8F45C9E6372C493DB45E8AD2DB68F73
                                                                                                                                                                                                                                      SHA-512:82D3BB4C9B451656C6B7F27D0B39C45F9091A4C495C12D769A4AE7EB9AA38D2FE03B9E4D4BDC16681EFA00537164B51DB22A3EE10A7DBEBD4EA4230792C2CEAC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Komplettieren Sie Ihren Online-Schutz . KOSTENLOS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Sie nutzen nicht alle Funktionen!",.. OEM_TOAST_VARIANT_INFO: "Ihr Online-Leben k.nnte noch viel sicherer sein. F.gen Sie Online-Suchschutz hinzu, um den McAfee-Webschutz zu vervollst.ndigen und Ihre Sicherheit im Internet zu erh.hen.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Sie haben den Suchschutz aktiviert . der McAfee-Webschutz ist jetzt vollst.ndig eingerichtet.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee-Testversion",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Browserschutz",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Der Browserschutz ist Ihre erste Abwehrreihe gegen unsichere Websites, Links, Downloads, Malware und mehr.",.. OEM_TOAST_VARIANT_F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6944
                                                                                                                                                                                                                                      Entropy (8bit):5.100360169240959
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HwrU5F9ob1w9r4vQZEiH/MkCyf9Wxi8+cw2tV9fnozQRfQ7oRZ1:QrU5FixMrp/MksxbhtV91I7oRb
                                                                                                                                                                                                                                      MD5:366BE26D1DABCF44941F7E8758593762
                                                                                                                                                                                                                                      SHA1:E4B5D7A1094D7EBF2CB68B3E2585DFC837A82B6F
                                                                                                                                                                                                                                      SHA-256:C487BD06C96A74F4422CC3A605606CD67A94A01D468CCF58AB25EE5B1E1B13FA
                                                                                                                                                                                                                                      SHA-512:88D086AB955970A36EF96D46D502ADADAFE8EA9128AAD36E02053A97F7E33748E4E56735CB3708C34836029F741652A429A9DE37AA7A1CADF41053D3985CDDC9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "........... ... ........... ... ......... . ......!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......!",.. OEM_TOAST_VARIANT_INFO: ".... ........ .. ..... ... ........ ... .......... ......... ... ......... .......... ... .. ............ .. ........... ... ......... McAfee ... .. .......... .. ........... ... .........",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "............ .. ....... ... ............ ... .......... McAfee .............. ... ......... ...........",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "...... McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABL

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4727
                                                                                                                                                                                                                                      Entropy (8bit):5.36058489621146
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HVm7IJTUE/c0dnhD6HaTKz+cfItWHMtDJHRLWyk7mEQheMrm:IYUcno6mpbONH5Wt7mPheMrm
                                                                                                                                                                                                                                      MD5:E0D1193B0CC7EF51835BE39F21D30ED6
                                                                                                                                                                                                                                      SHA1:0392666A0BCB0BA990BCDFE3C7FF4F3BE9B91476
                                                                                                                                                                                                                                      SHA-256:0AF79C4732DA48724BCF47105D3CCDF92DF695D8C2B03EA50B6387BA1B7AC91F
                                                                                                                                                                                                                                      SHA-512:C570448E90A342BF2FF2CA9F87EA4A938816888AFA0709B8A8E6AB8ABD42C6B964FB0F384F62487ADD1AE0449829053EDD5549FF3378063A30B30D4736AFBAA2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Refuerce su protecci.n online GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".Muy bien!",.. OEM_TOAST_VARIANT_INFO: "Puede navegar con mucha m.s seguridad. A.ada una capa de protecci.n a sus b.squedas en Internet con McAfee Web Protection.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Ha terminado de configurar McAfee Web Protection con la protecci.n para las b.squedas.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Versi.n de prueba del antivirus de McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protecci.n para navegar por Internet",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protecci.n del navegador es su primera l.nea de defensa frente a sitios web, v.nculos y archivos de descarga poco seguros, adem.s del malware y otras amenazas.",.. OEM_T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4645
                                                                                                                                                                                                                                      Entropy (8bit):5.367337782235457
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H+uLpSRLUr0y8YDhD5MkLb6kyoRV41uRyrF4QVT2:euLiQgu4kLbLyqMuRAFjVy
                                                                                                                                                                                                                                      MD5:96936BE4F463AA7A97CCDCC6D7E38FDA
                                                                                                                                                                                                                                      SHA1:011B0F6B7A7B3826F42B8A4A8BB75A23C66413AA
                                                                                                                                                                                                                                      SHA-256:226F1709B477ED59E059D846CBBD0740CD3CBA52B8A5FC3D385653BBF8120E23
                                                                                                                                                                                                                                      SHA-512:6004A728BD3641189E00233FBBFAFE9C230BA056D2D82022677A4F01094339DEEB9F250AA4EA83356CDA7EF4776544555015B58A33F988147DBB55089A82787B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Completa tu protecci.n en l.nea. .GRATIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".Fant.stico!",.. OEM_TOAST_VARIANT_INFO: "Puedes estar mucho m.s seguro en l.nea. Agrega la protecci.n de b.squedas para completar McAfee Web Protection y mejorar tu seguridad en l.nea.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Has completado la configuraci.n de tu McAfee Web Protection activando la protecci.n de b.squedas.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Prueba de McAfee AntiVirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protecci.n del navegador en l.nea",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protecci.n del navegador es tu primera l.nea de defensa contra el malware, los sitios web, las descargas y los v.nculos inseguros, y mucho m.s

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4369
                                                                                                                                                                                                                                      Entropy (8bit):5.381721523071525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HCY1buqqISrqXmaENWWAyROr+DTVgjifdQhmX:i2bURGOAlyROrWgjCChmX
                                                                                                                                                                                                                                      MD5:DDBD8D7DF71429833887385483B3A5C1
                                                                                                                                                                                                                                      SHA1:B9F565FB8C1DD39A8F1D8A9ABB55497F36AB5B55
                                                                                                                                                                                                                                      SHA-256:0E4B946A8DAC2E39CCD305FA8E77BCF047FA2D8121D5768C38FC14E01A3465BE
                                                                                                                                                                                                                                      SHA-512:DE34EF6290B94E1562D67957B6AB900CDE691529498E67313A87D3090B6A37149578FC5D514E54196D83D771C3C351E5D52D3277FEF6E23E930D7EA2FD5438DA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "T.ydenn. verkkosuojauksesi . MAKSUTTA!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Hienoa!",.. OEM_TOAST_VARIANT_INFO: "El.m. verkossa voi olla turvallisempaa. T.ydenn. McAfeen verkkosuojaus hakujen suojauksella ja paranna turvallisuuttasi verkossa.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Viimeistelit McAfeen verkkosuojauksen ottamalla hakujen suojauksen k.ytt..n.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus -kokeiluversio",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Selaimen suojaus verkossa",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Selaimen suojaus on ensimm.inen puolustuslinjasi muun muassa vaarallisia verkkosivustoja, linkkej., latauksia ja haittaohjelmia vastaan.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "Hakujen suojau

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5002
                                                                                                                                                                                                                                      Entropy (8bit):5.357219757014203
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HZzGKZjPEluOR2wzvjc8/MWaAE+XZKn3mTvARBdphbmbQQQJA3jqtQjQ7cHSg:lVEzx/Zk3uvAdfdJo1jzj
                                                                                                                                                                                                                                      MD5:155C5AB5ACCA7FCAD52B027038664601
                                                                                                                                                                                                                                      SHA1:2C84796616DBBF81DA3E5BC1AE1788C1F1D5C4B7
                                                                                                                                                                                                                                      SHA-256:E7E37A4223C5574C5B79FC4F323EFA27AA7122797FDC22F24273518A0285B936
                                                                                                                                                                                                                                      SHA-512:AD8FE82F1B4C53E3854284A6FC1E3C1D33DD1EBA01D52F33D32B3416D8D0FC4FE83025A888505D99C1C235AF823FF66E85FC1939A087A290D32A75CF7E34755E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Compl.tez votre protection en ligne - GRATUIT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Quelle bonne d.cision!",.. OEM_TOAST_VARIANT_INFO: "Vous pourriez .tre beaucoup mieux s.curis. en ligne. Ajoutez la recherche s.curis.e pour compl.ter la protection Web McAfee et pour renforcer votre s.curit. en ligne.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Vous avez compl.t. la configuration de votre protection Web McAfee en activant la recherche s.curis.e.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: ".valuation gratuite de l.antivirus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protection du navigateur en ligne",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protection du navigateur est votre premi.re ligne de d.fense contre les sites Web, lie

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4951
                                                                                                                                                                                                                                      Entropy (8bit):5.3675775101006735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H1dQtHATWE0/hUcGNyFmjjc8md8QPSsnRxKGF7juyNmYSff9j5rQgTX:VKtrE0pIUL6sR727FBygTX
                                                                                                                                                                                                                                      MD5:B214EDD31788DEF196D4BDA2A185DD1E
                                                                                                                                                                                                                                      SHA1:76F1DB2A00C17FB55177CA032766A02704C1CBE9
                                                                                                                                                                                                                                      SHA-256:2E2182FE39CB31234CD5821A98828FFC7F05C5FBD0694EEABD430FA6DED5C003
                                                                                                                                                                                                                                      SHA-512:9C0435F4F1651F675220D1E4B8428BD17B64E788EDD21AE608B67E6FEB3AF75FD8806AE3AEC3525AFC2D1482DE767397F00ED75FF26BB593D3B92D6B5ED63B59
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Terminez la configuration de votre protection en ligne . GRATUITEMENT.!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Bravo.!",.. OEM_TOAST_VARIANT_INFO: "Vous pouvez .tre beaucoup mieux prot.g. en ligne. Ajoutez la protection des recherches pour compl.ter votre protection web McAfee et renforcer votre s.curit. en ligne.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Vous avez termin. la configuration de votre protection web McAfee en activant la protection des recherches.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: ".valuation de l'antivirus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protection du navigateur en ligne",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protection du navigateur constitue votre premi.re ligne de d.fense contre les sites

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4651
                                                                                                                                                                                                                                      Entropy (8bit):5.463795354688797
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HCsNsKVqer5TZNOZG9OBhwMsvA0+Ovho6rQYBI9:zNsiqsZ4cM6A0+Ove60YW
                                                                                                                                                                                                                                      MD5:501D00D2EBC4945959F2D6DB1A14EEFB
                                                                                                                                                                                                                                      SHA1:69EEC6B51EA50AE6E8E9F30C0B0A23EA5367647E
                                                                                                                                                                                                                                      SHA-256:0E234C8B89D046404045E2A712C6838C899235A2A41BEB267941E0DB5107824A
                                                                                                                                                                                                                                      SHA-512:AAD39758A81C5CE662DFD0BB3FBB053DB32A4093CA3B533B801F882A620DD55A74C9ECA770C634C5F654B494101B3CCA17C7DE4C4BF89A612F87D4E1C1C2AB01
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dovr.ite svoju online za.titu . BESPLATNO!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Tako treba!",.. OEM_TOAST_VARIANT_INFO: "Na mre.i mo.ete biti puno sigurniji. Dodajte za.titu pri pretra.ivanju kako biste dovr.ili McAfee Web Protection i pobolj.ali svoju sigurnost na mre.i.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Dovr.ili ste postavljanje svoje McAfee Web Protection omogu.avanjem za.tite pri pretra.ivanju.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Probna verzija McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Za.tita preglednika na mre.i",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Za.tita preglednika va.a je prva linija obrane od nesigurnih web-mjesta, poveznica, preuzimanja, zlonamjernog softvera i jo. mnogo toga.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4620
                                                                                                                                                                                                                                      Entropy (8bit):5.539111754845767
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HfqjRDpi/v3XWyYNDX5XcmPcnrW2S6CatskM0QlHCp:/q7gGFDX5dorWKskCFCp
                                                                                                                                                                                                                                      MD5:8F3FD935C0BB5FFD63E021122CCF9D76
                                                                                                                                                                                                                                      SHA1:CC25856FC3E5B571845A153E2647008E9D6BEE6D
                                                                                                                                                                                                                                      SHA-256:6ADD6F420B6EA9E1DB45C79809F848276C3B3A0B988EC6EEC6135999962F2C69
                                                                                                                                                                                                                                      SHA-512:D328C62E1D52A52C9A8402FA7EC4F3194FAEEC4E8ECC92C6B653D8E2CA3A4F75F32ECAB3AAFBF54010CD8E47D99D3EFB7CD88EB57DE0F1BF8F6E4328815C3DF3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Eg.sz.tse ki online v.delm.t . INGYEN!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Nagyszer.!",.. OEM_TOAST_VARIANT_INFO: "M.g nagyobb biztons.gban lehet online. Enged.lyezze a v.dett keres.st, hogy teljess. tegye a McAfee webes v.delmet, .s n.velje online biztons.g.t.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "A v.dett keres.s bekapcsol.s.val befejezte a McAfee webes v.delm.nek be.ll.t.s.t.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee v.rusirt. pr.baverzi.ja",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online b.ng.sz.v.delem",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "B.ng.sz.je v.delme a frontvonal a nem biztons.gos weboldalak, hivatkoz.sok, let.lt.sek, k.rt.kony programok stb. elleni biztons.g ter.n.",.. O

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4608
                                                                                                                                                                                                                                      Entropy (8bit):5.237023474585658
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HQj/oecik1Rs8CwrTww7Jr6QdIBOG1XY4RO2YC+qQAjMVL:4/obl1VnUw7Jr6QdIh1XY4RO2YC+pCMp
                                                                                                                                                                                                                                      MD5:AC66BA2ED12DD9C411DA7807CA3AB822
                                                                                                                                                                                                                                      SHA1:49704A3709617571B3190BE203DF4DD908CB5FBB
                                                                                                                                                                                                                                      SHA-256:507391D53118C7223677B6E3B8A5B306E8CF8B804AB8312123446D85DA5A3098
                                                                                                                                                                                                                                      SHA-512:B9ECF6BCFE4588074820EB6E4D1FA9ED8652EE3ADF5C3CAD95ECEB63031BC970784E7B31D200EE9E729FB993B24EDB151BB9098AB654A9E390181E5D01D0B844
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Completa la tua protezione online - GRATIS",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Ottimo!",.. OEM_TOAST_VARIANT_INFO: "Puoi migliorare notevolmente la protezione online. Aggiungi la protezione delle ricerche per integrare McAfee Web Protection e migliorare la tua sicurezza online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Hai completato la configurazione di McAfee Web Protection attivando la protezione delle ricerche.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Prova di McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Protezione online del browser",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "La protezione del browser . la prima linea di difesa da siti Web, collegamenti e download non protetti e dal malware.",.. OEM_TOAST_VARIANT_FEATURES_DISAB

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5215
                                                                                                                                                                                                                                      Entropy (8bit):5.864645907791899
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HaYG+SPT4mep9K9B95H1bccLyf/9f71bYwNKiVEVH9skXbrbQCQ6L2nKQKUG12K:q+SPT4mnh5d/KVYwNZiZ9RrOJ6gK
                                                                                                                                                                                                                                      MD5:48F97C116108EE647F8CB084ACA1061D
                                                                                                                                                                                                                                      SHA1:7B477A4BB92AC699CB0DB14DB15DAAF3462A795E
                                                                                                                                                                                                                                      SHA-256:609237AD93361B1970E0B716F98B96E22573097D80135506BA09ABDA32E144E0
                                                                                                                                                                                                                                      SHA-512:F58F8BCA36CE4409DE3893E3D133627C58BDA4C6F48762B3C2DB5EAEA12C625DA40E59728F147D474960FB2144C2912C6344606C5E5CCC6A2EDC7863787E2C29
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "................. - .....",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".......",.. OEM_TOAST_VARIANT_INFO: "............................... McAfee Web Protection ..........................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".............McAfee Web Protection ...............",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "..... .............",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".........",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4770
                                                                                                                                                                                                                                      Entropy (8bit):5.834199135632937
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HNby+JvldshnPhOVGUZoI+0MYAT2T1eHEzdaVQkwpSMHdr:tGk3sNhxHI+0cUKu06kTM9r
                                                                                                                                                                                                                                      MD5:D229C7C4C1F0DD17D1EA378D1B064118
                                                                                                                                                                                                                                      SHA1:42A0C0010C9DD6FD3FB32D4C2BE4B4253D08740B
                                                                                                                                                                                                                                      SHA-256:52E62EAED42CBB578CC70999DF709B52B649D5675E3F431C7B59C5D81B7370BC
                                                                                                                                                                                                                                      SHA-512:4E40BF22333561DAC150A54ABE283309EB1B89FF9758E9E6442A6519D6DE917521B4359A27A8C0C7A0713CCDEF89A25AD68F4159C038F351F52B6C9A0F71C41E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "... ... ... ... ......",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......!",.. OEM_TOAST_VARIANT_INFO: "... ... ... . ..... .. ... .... ... McAfee . ... ... ... ... ......",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".. ... ..... McAfee . .. ... .......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee ...... ...",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "... .... ..",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".... ... .... .. . ..., .., ...., ... .. .. ... ... ......",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4467
                                                                                                                                                                                                                                      Entropy (8bit):5.379517540748781
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HqSH3f2pqCBDGeE36ZmcQf5xPCN1LeCYrWbVhYqeQGE/MSE:KmW4eClJ/PCN1LXYr2LYqdGE/xE
                                                                                                                                                                                                                                      MD5:D18D3F399728DD12F88889400B4FA691
                                                                                                                                                                                                                                      SHA1:E7D80F94E03D8A0CB2CDB029AA722A5BAB46410F
                                                                                                                                                                                                                                      SHA-256:68D78BC683FF59575467FA9F39E2FE864FDC4280C8677C441044710632DB9B91
                                                                                                                                                                                                                                      SHA-512:C5C77DEC2D57A4A3CF3377F6281174C530E341F51ADE09C19EA337F9A6C8C2A7B57B96349B30F65844B8AF82936329B5D391F2FE78B7626B6096A70C740D092F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Gj.r nettbeskyttelsen din komplett . KOSTNADSFRITT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Ikke verst!",.. OEM_TOAST_VARIANT_INFO: "Du kan bli mye tryggere p. nettet. Legg til s.kebeskyttelse for . gj.re McAfee nettbeskyttelse komplett og forbedre nettsikkerheten din.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du fullf.rte konfigureringen av McAfee nettbeskyttelse ved . aktivere s.kebeskyttelse.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Pr.veversjon av McAfee antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Nettleserbeskyttelse",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Nettleserbeskyttelse er ditt fremste forsvar mot usikre webomr.der, koblinger, nedlastinger, skadelig programvare med mer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4299
                                                                                                                                                                                                                                      Entropy (8bit):5.37954739360316
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H2AwS9S9NzRHuSpGikmkH4XRgPKvpR1E1B2azPDcF2g+FeksVMkgR1pfQ5hr:WAweeN9hGikmkHDKpRS1EaTDw2g+FfsV
                                                                                                                                                                                                                                      MD5:272A2E091BEB2272D7321ABE108D31E8
                                                                                                                                                                                                                                      SHA1:2711C644960BB9C964619F3F26A3D1DFEAF90746
                                                                                                                                                                                                                                      SHA-256:627DAB36506F5874F959651AA936099BF31507D4CAAF79E96365433D64322901
                                                                                                                                                                                                                                      SHA-512:0EC512CBFC0BE4ADC8970B374BA3EDF78B018BCE68A46B55A4FF96DC3393DB1B41E8715FBB81E595615AD97599C3ED586687BA5CE43E11AAC221312A14F5A303
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Voltooi uw online bescherming . GRATIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Goed gedaan!",.. OEM_TOAST_VARIANT_INFO: "U kunt online veel veiliger zijn. Voeg zoekbescherming aan uw McAfee-webbescherming toe en verbeter uw online veiligheid.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "U hebt het instellen van uw McAfee-webbescherming voltooid door zoekbescherming in te schakelen.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Proefversie van McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Online browserbeveiliging",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Browserbeveiliging is uw eerste verdedigingslinie tegen onveilige websites, koppelingen, downloads, malware en meer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "Zoekbescherming",.. OEM_T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4749
                                                                                                                                                                                                                                      Entropy (8bit):5.581947984855599
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HeH6Ry8L5clQB1MuoIbuNO8Q2STtWQLpXsJi6jiTZ/80zthQX2wgcl:+Ht8tclQB1AnO8Q2STtWQLpXsJrEZ/8N
                                                                                                                                                                                                                                      MD5:97AABFAC4BC891F2C35F09D5DEAACFB6
                                                                                                                                                                                                                                      SHA1:8DBE7AEF374BBE8C4D29E67755AB3AA42A8A6B36
                                                                                                                                                                                                                                      SHA-256:921F9588367507FFB2E155F37E4011400C5C997E343B085861F7ACB117B319FB
                                                                                                                                                                                                                                      SHA-512:259D3DA3CC9666C0A5A06CD5C32750A02C75D19A06D3C07ED7CAEE73473366A883E02651608E4D3464D4FFFFCC4852452CD4EA4DAFA47107DABD03293D7BDB3E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Wzmocnij swoj. ochron. w Internecie . BEZP.ATNIE!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Dobra robota!",.. OEM_TOAST_VARIANT_INFO: "Mo.esz mie. znacznie wi.ksz. ochron. w Internecie. Dodaj ochron. wyszukiwania, aby wzmocni. ochron. funkcji McAfee Web Protection i zwi.kszy. swoje bezpiecze.stwo w Internecie.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Uko.czono konfiguracj. funkcji McAfee Web Protection poprzez w..czenie ochrony wyszukiwania.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Wersja pr.bna programu McAfee Antivirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrona przegl.darki w Internecie",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrona przegl.darki to pierwsza linia obrony przed niebezpiecznymi witrynami, ..czami, pob

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4556
                                                                                                                                                                                                                                      Entropy (8bit):5.389950553479833
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Hlahgzv62PaQaLuR89CrPnzGS77lq+XQsBC:FaqvFL7R89MPnzGS77U+AsBC
                                                                                                                                                                                                                                      MD5:627D62246EA849E3823CB44DA1D8DFC5
                                                                                                                                                                                                                                      SHA1:421FC163038B611F6B29C5306331E0725871CA1F
                                                                                                                                                                                                                                      SHA-256:5145465559F0C5F67D3AD7B07170ABCDDA2D3639DC51A9F18C5B93BEFAB1C6C4
                                                                                                                                                                                                                                      SHA-512:076E6717C87073C4559C66320853361ED6C05E2E96BD4C66B6C25687DEDD068F787C288F02BF8D0FA2BE8AD97C6F9DA1F59BC49ABA2F3C32B4C7104273145FC1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Conclua a sua prote..o on-line GRATUITAMENTE!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ". isso a.!",.. OEM_TOAST_VARIANT_INFO: "Voc. pode ter muito mais seguran.a on-line. Adicione prote..o de pesquisa para completar o McAfee Web Protection e aumentar sua seguran.a on-line.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Voc. concluiu a configura..o do McAfee Web Protection ativando a prote..o de pesquisa.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Avalia..o gr.tis do antiv.rus da McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Prote..o do navegador on-line",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "A prote..o do navegador . sua primeira linha de defesa contra sites, links e downloads inseguros, malware e muito mais.",.. OEM_TOAST_VARIA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4478
                                                                                                                                                                                                                                      Entropy (8bit):5.370623994510734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HI2q8anq+9cCh9FcTVvtObxsp0R1vsfYRq+XQwCc:o38eq7CTWRvtO6pe1vsfYg+AwCc
                                                                                                                                                                                                                                      MD5:2A76152D14793AFD1ADD1B5EB30A5015
                                                                                                                                                                                                                                      SHA1:CB351E46E20EE5E37E8C12C38966FF939929EC0C
                                                                                                                                                                                                                                      SHA-256:C691ADB641E71F8FC9F9A144C357BDF1F0BB7CD8BC21C234E40E3442B3520DF4
                                                                                                                                                                                                                                      SHA-512:311293E9F37A0AB09DA78F99BE0C6E6D8D30CF360F8CA7273792FDC8EF503CC1423B247E2BB709EBC77B4E46FD91AF28253FCE01A8EF283F3EB425AB5C7F809B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Complete a sua prote..o online . GR.TIS!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Boa!",.. OEM_TOAST_VARIANT_INFO: "Pode estar muito mais seguro online. Adicione a prote..o de pesquisa para completar o seu McAfee Web Protection e aumentar a sua seguran.a online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Terminou de configurar o seu McAfee Web Protection ao ativar a prote..o de pesquisa.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Avalia..o do antiv.rus McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Prote..o de browser online",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "A prote..o de browser . a sua primeira linha de defesa contra Web sites inseguros, transfer.ncias, malware e muito mais.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "P

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6441
                                                                                                                                                                                                                                      Entropy (8bit):5.190585989195741
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H3P3dV2BQF3iK4ttHiUWB3E4L2bLrrDSiaA1oSUd0BSO+Vft1ZQpmvfR6/:v/2Bo3L4iPdMPnSvA1UQbGf6pMfR6/
                                                                                                                                                                                                                                      MD5:B598CC6240BDC7756AE9BE89334A1BD0
                                                                                                                                                                                                                                      SHA1:152CB1B0CFEFE33D041E1B0EF8D71B505E31897D
                                                                                                                                                                                                                                      SHA-256:61D74121D469B56F7823E83C669267EE923FE0A66A72F2B2FD4954C8AB70CEDB
                                                                                                                                                                                                                                      SHA-512:59375E86447199DC4649FACEC4552A92D132C67425FDA39F2DF6D9986B8176CE99D6D67E80AD224BA23269D658965B432B759C9803872EB3F07BC8EF59ABE21B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "......... .... ...... . ......... . .........!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "... .......!",.. OEM_TOAST_VARIANT_INFO: ".. ...... ........ .... ............ . .......... ........ ...... ......, ..... ......... McAfee Web Protection . ........ .... ............ . ..........",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".. ......... ......... McAfee Web Protection, ....... ...... .......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "....... ...... McAfee AntiVirus",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "...... ........ . .........",.. OEM_TOAST_VARIANT_FREE_LABE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4713
                                                                                                                                                                                                                                      Entropy (8bit):5.638720688354164
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Hu/cMHiS0zIB64Vb8JmdTv6zInPVO+mMQ9bf:2c+iE64xTdTvPVng9bf
                                                                                                                                                                                                                                      MD5:98C22BBD3E4136933A5F0EB6707AA884
                                                                                                                                                                                                                                      SHA1:AABB26A2BA9EF05C609D01948011319AF7D286D2
                                                                                                                                                                                                                                      SHA-256:398C43FF634071AD03814BD05A8374373C55EA7B7D4FE747AC42E6AB7F2B0109
                                                                                                                                                                                                                                      SHA-512:FECDB71569C419261B9E6290F918FF2702ABAF92CC2E21C4EF0BE52E2DC6426B6E572C74BD73FA7EDD74FCD719B5AB7D3E6881CE46E754F325523CD70810645F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Dokon.ite nastavenie online ochrany ZADARMO.",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Chr..te sa.",.. OEM_TOAST_VARIANT_INFO: "Aj online m..ete by. v.bezpe... Pridajte ochranu vyh.ad.vania do produktu McAfee Web Protection a.zv..te svoju bezpe.nos. online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Zapnut.m ochrany vyh.ad.vania ste dokon.ili nastavenie McAfee Web Protection.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Sk..obn. verzia antiv.rusu od McAfee",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Ochrana online prehliada.a",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Ochrana prehliada.a tvor. prv. .rove. ochrany pred nebezpe.n.mi webov.mi lokalitami, odkazmi, stiahnut.mi s.bormi, malv.rom a .al..mi hrozbami.",.. OEM_TOA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4628
                                                                                                                                                                                                                                      Entropy (8bit):5.428196140824858
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H7718TA7STZFOZGOA9wSdASMoNNPDgYK0hQOLYBB8:b7glDu8ASMAtjK0mOEBS
                                                                                                                                                                                                                                      MD5:C3D070FCFB31E3CEBE62044DE51CCECE
                                                                                                                                                                                                                                      SHA1:C771BCB9E8B93B0E2CE2115D6AC18AF7E4A0E571
                                                                                                                                                                                                                                      SHA-256:FF97B78D705C00E778EF02F4E39544383BD2EB80CFA77F0862B64D101DC93923
                                                                                                                                                                                                                                      SHA-512:2540494AF41DEC6B839EA1DB15405D6BF310611CBDA3F8E1C36CDE3BB3B2BDC61A6EFF0A8E03F47A21ABE5BD61A118BEE279699505AB9038010D75D09C7140A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Upotpunite za.titu na internetu . BESPLATNO!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Prava stvar!",.. OEM_TOAST_VARIANT_INFO: "Mo.ete biti mnogo bezbedniji na internetu. Dodajte za.titu pregledanja kako biste upotpunili McAfee Web Protection i pobolj.ali bezbednost na internetu.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Upotpunili ste postavku McAfee Web Protection omogu.uju.i za.titu pregledanja.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Probna verzija McAfee antivirusnog programa",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Za.tita pregleda.a na internetu",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Za.tita pregleda.a je va.a prva linija odbrane od nebezbednih veb lokacija, veza, preuzimanja, malvera i jo. toga.",.. OEM_TOAST_VARIANT_FEATU

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4220
                                                                                                                                                                                                                                      Entropy (8bit):5.441230452443078
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HkTQd3F1N1KuBfzHv7afFmZMfSseE08bwzGt9S0NpQIrCF+AQmGIXe:KWVBbz5vsec0zK9p1LL/IXe
                                                                                                                                                                                                                                      MD5:CE23978A62AFD467DDBD64F786E74750
                                                                                                                                                                                                                                      SHA1:7089283981168AB8808979A599E353D81151C1EA
                                                                                                                                                                                                                                      SHA-256:2FFCA48116362E5B65F6526568EFBFAB54678B685A67C9772E64E359DAB5FBFC
                                                                                                                                                                                                                                      SHA-512:19BA48D404A3251345E8E0095165C966F138E16C576B84DF6B4BED9EC8D7EBB0F445B88D4F7ACDF5FFC47C192BE073DBDB533183AC662CCA4F54A57B7FBE0511
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "Fullborda ditt skydd online - KOSTNADSFRITT!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "S.d.r ja!",.. OEM_TOAST_VARIANT_INFO: "Du kan surfa mycket s.krare. L.gg till s.kskydd f.r att komplettera McAfee Web Protection och f.rb.ttra din s.kerhet online.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Du har fullbordat inst.llningen av McAfee Web Protection genom att aktivera s.kskydd.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "Provversion av McAfees virusskydd",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: "Webbl.sarskydd online",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Webbl.sarskyddet .r ditt f.rsta f.rsvar mot os.kra webbsidor, l.nkar, h.mtningar, malware och mer.",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "S.kskydd",.. OEM_TOAST_VARIANT_FEA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4525
                                                                                                                                                                                                                                      Entropy (8bit):5.522367101435932
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HsafCWrSckFzm3EzHFSCvXV4lsQtFT7rk:MaKWrSzm3EzHFSCP43Pvk
                                                                                                                                                                                                                                      MD5:83B37F5846940C7D0EA2E0CCC9730D42
                                                                                                                                                                                                                                      SHA1:F969AFAB823DA412A382D590490C96F9643ED6C5
                                                                                                                                                                                                                                      SHA-256:27D79933371575B66BE1D5D1AB23983C2EBF5CCB7657E293645AB54C1AC682C4
                                                                                                                                                                                                                                      SHA-512:4C6870BBECDF899595101E3ED38C75F686DD741E83D6FDCBB313146C3E918A63831BD4F5CD1856904EE89D86C88B5C1A8ADDB23D037F988DA33811D95A14340D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: ".evrimi.i koruman.z. tamamlay.n - .CRETS.Z!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "Tebrikler!",.. OEM_TOAST_VARIANT_INFO: ".evrim i.i .ok daha g.vende olabilirsiniz. McAfee Web Protection'. tamamlamak ve .evrim i.i g.venli.inizi art.rmak i.in arama korumas.n. ekleyin.",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "Arama korumas.n. etkinle.tirerek McAfee Web Protection'. .evrim i.i kurmay. tamamlad.n.z.",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus Denemesi",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".evrim i.i taray.c. korumas.",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: "Taray.c. korumas.; g.venli olmayan web siteleri, ba.lant.lar, indirmeler, zararl. yaz.l.m vb.'ine kar.. ilk savunma hatt.n.zd.r.",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4033
                                                                                                                                                                                                                                      Entropy (8bit):6.105667869437987
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H69N08pRNQ/OJJNZsjB90G3Qm/aCQVH/s:a9+qN7JJ7mBKUQCaBN/s
                                                                                                                                                                                                                                      MD5:E2A29E09F6DACDC784DDB305145981EB
                                                                                                                                                                                                                                      SHA1:90CE562A9CA481445DEFA4051AA29197D615CFB3
                                                                                                                                                                                                                                      SHA-256:BE94B132161BA6BE1C36C0AC54E4C85B9C0A983856C2BA58972733013A18368B
                                                                                                                                                                                                                                      SHA-512:634E868A5F22EE4D485E762FD3AE4AC550F56EAF8D7BF8CEA92C73248344DC2B38CD7D3FFD03D8BA021EAC82C8309B0685CFEB45CD3DD03B2BA9122F8CC545B1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: "........ . ..!",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: ".....!",.. OEM_TOAST_VARIANT_INFO: ".......................................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: ".......................",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "...........",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".......",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".................................",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "....",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_DESC: "......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4288
                                                                                                                                                                                                                                      Entropy (8bit):6.170207978583642
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:HummxlGEjsinJjE8X7IujB0LbIF5fFrQTyKhw:OmmOvkEU7IuN0+5fF0vhw
                                                                                                                                                                                                                                      MD5:C59D8300FCE50936AD4AAF33E704BE1E
                                                                                                                                                                                                                                      SHA1:16AA3BBB5F5A1CFC47B0C218DB3CE2676C7031AB
                                                                                                                                                                                                                                      SHA-256:7EDF77479CFEEFC6CF3645E1C1746DFA64896387149FE386276DFFEE6414FEC7
                                                                                                                                                                                                                                      SHA-512:556E11F63BDA6B2636C33DD2FED75ED770F390A3D3753F6B3EC3F8FCA1DBDC446CAB14EEC82D408917F138527B70E62339B32DA24D211CE64B74D62927A3418B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. // Specific for Cohort 1, 2.. OEM_TOAST_VARIANT_TITLE: ".......... . .....",.. OEM_TOAST_VARIANT_TITLE_SS_PROTECTED: "......",.. OEM_TOAST_VARIANT_INFO: "................ McAfee Web ...................",.. OEM_TOAST_VARIANT_INFO_SS_PROTECTED: "............. McAfee Web ......",.. OEM_TOAST_VARIANT_EXPIRED_LABEL: "EXPIRED",.. OEM_TOAST_VARIANT_EXPIRED_NAME: "McAfee Antivirus ..",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_LABEL: "ON",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_NAME: ".......",.. OEM_TOAST_VARIANT_FREE_LABEL: "FREE",.. OEM_TOAST_VARIANT_FEATURES_ENABLED_DESC: ".....................................",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_NAME: "....",.. OEM_TOAST_VARIANT_FEATURES_DISABLED_DESC:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3415
                                                                                                                                                                                                                                      Entropy (8bit):5.663699321642511
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:calbcPcTkV6hxvM/L4PgzN/6hxO232sN4agGuI:GUwdkec2sN4agGuI
                                                                                                                                                                                                                                      MD5:F871A43BEBA4D0A0E63B9F8413FC1556
                                                                                                                                                                                                                                      SHA1:E0572DE3E310E9DB3AAF334476DBA3F9A2242FE0
                                                                                                                                                                                                                                      SHA-256:0EB7329CF81505809CDDD246F514C48447EF06DCA11F04FDFF77C0D3E4C0EDF8
                                                                                                                                                                                                                                      SHA-512:09959B7178B93541D2484E60B39124F84062E856EB8A9A43815A6B59D589C2F431BBAFF612D80FCC5193EB6E48141E886A696FA34A1AAC23D16CC5114392F730
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "N.pov.da",.. HELP_FAQ_TITLE: "Nej.ast.j.. dotazy",.. HELP_SUPPORT_TITLE: "Podpora",.. HELP_EMAIL_US: "Za.lete n.m e-mail na adresu",.. ABOUT: "O aplikaci",.. ABOUT_DESCRIPTION: "D.ky aplikaci {0} se m..ete na internetu l.pe rozhodovat.",.. CREATE_SAFER_PASSWORDS: "Vytv..en. bezpe.n.j..ch hesel",.. DOWNLOAD_CONFIDENTLY: "Stahov.n. bez obav",.. SETTINGS_SS_OPTION_ALL: "Informovat o bezpe.nosti v.sledk. hled.n. ve v.ech vyhled.va..ch",.. SETTINGS_SS_OPTION_NONE: "Neinformovat o v.sledc.ch hled.n.",.. SETTINGS_SS_OPTION_SS: "Informovat o bezpe.nosti v.sledk. hled.n. pouze ve slu.b. Bezpe.n. hled.n.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Vlo.te nebo zadejte adresu URL.",.. TRUST_SITE: "D.v..ovat str.nce",.. DONT_TRUST: "Ned.v..ovat",.. HELP_FAQ_SECTION_ONE_HEADER: "K .emu slou.. aplikace {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "D.ky aplikaci {0} se m..ete na in

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3222
                                                                                                                                                                                                                                      Entropy (8bit):5.389308428477568
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cIWPf2VFTTGDGMZO4WVFwT/s9vyNnma/DvOvEiFk83qS8sDQTjmHBgp5M9i:9FMZAOgFiizJMjmWp
                                                                                                                                                                                                                                      MD5:05F93BEE6174DEC723063D1FABB017FB
                                                                                                                                                                                                                                      SHA1:39FFF628464B472569FC7B718CDE87C561A6E923
                                                                                                                                                                                                                                      SHA-256:0190AE9C1E2DB7367CF7457A2D6B44DA7728016FA1E165C305C9163363CD144A
                                                                                                                                                                                                                                      SHA-512:0F4504701EBA305B041A478D58FBA00472319CC8ABFF567C10D4C415A6CAD82788CEDF17B55B2DE44270AB057348122E99AF00E986C371720A5DD4F8DD0A522C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Hj.lp",.. HELP_FAQ_TITLE: "Ofte stillede sp.rgsm.l",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Send en mail til os p.",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} hj.lper dig med at tr.ffe de rigtige beslutninger, n.r du er p. nettet.",.. CREATE_SAFER_PASSWORDS: "Opret sikrere adgangskoder",.. DOWNLOAD_CONFIDENTLY: "Sikre overf.rsler",.. SETTINGS_SS_OPTION_ALL: "Fort.l mig, om et s.geresultat er sikkert i alle s.gemaskiner",.. SETTINGS_SS_OPTION_NONE: "Fort.l mig ikke om s.geresultater",.. SETTINGS_SS_OPTION_SS: "Fort.l mig, om et s.geresultat kun er sikkert i Sikker s.gning",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Inds.t eller skriv URL-adressen",.. TRUST_SITE: "Har tillid til websted",.. DONT_TRUST: "Har ikke tillid",.. HELP_FAQ_SECTION_ONE_HEADER: "Hvad er {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} hj.lper dig med at tr.ffe de rigtige beslutninger, n.r du er p. nettet.",.. HELP_F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3302
                                                                                                                                                                                                                                      Entropy (8bit):5.379842622310449
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:c5vPqTKqMocuMD9nd/9j25ktHec9VYwpu4sD2oitofo:BNMVLac+uYwp9sD2pt2o
                                                                                                                                                                                                                                      MD5:CB4C262098602CC60EEF4532583A7545
                                                                                                                                                                                                                                      SHA1:8E9204F995238A74BB55EA8E93C09B6AC800F73E
                                                                                                                                                                                                                                      SHA-256:B372D32C799A248F585654AFACDA7800EE196EF2F70C4028BCF225B85330760B
                                                                                                                                                                                                                                      SHA-512:C55121C8A351F5329C56B1ABE7D7D5B3425BE78F4891BB789E33D21EE24BB2309684FED1C01BDCD46884CACB3E34131B66FB23A1DF6C043BEDC1582D725857A9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Hilfe",.. HELP_FAQ_TITLE: "H.ufig gestellte Fragen (FAQs)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Senden Sie uns eine E-Mail:",.. ABOUT: "Info",.. ABOUT_DESCRIPTION: "Dank {0} k.nnen Sie besser entscheiden, welche Websites Sie unbesorgt besuchen k.nnen.",.. CREATE_SAFER_PASSWORDS: "Sicherere Kennw.rter erstellen",.. DOWNLOAD_CONFIDENTLY: "Sichere Dateien herunterladen",.. SETTINGS_SS_OPTION_ALL: "In jeder Suchmaschine Bewertung von Suchergebnissen anzeigen",.. SETTINGS_SS_OPTION_NONE: "Keine Bewertung von Suchergebnissen anzeigen",.. SETTINGS_SS_OPTION_SS: "Nur bei der sicheren Suche Bewertung von Suchergebnissen anzeigen",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL einf.gen oder eingeben",.. TRUST_SITE: "Site als vertrauensw.rdig einstufen",.. DONT_TRUST: "Nicht als vertrauensw.rdig einstufen",.. HELP_FAQ_SECTION_ONE_HEADER: "Was ist {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Dank {0} k.nnen Sie

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5323
                                                                                                                                                                                                                                      Entropy (8bit):5.035439820478563
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:czSqYMiAFSTIbO48c2aO490VuVMGzqRcAF+gx/ijYz2HC8Tt7iVJnIjz1NCPcWFs:DMO8w3BVGt22jz1QPltZIHt1v
                                                                                                                                                                                                                                      MD5:543396848C547A85C940508FDDBCACF2
                                                                                                                                                                                                                                      SHA1:7F735CBCD5A0E1A2F263DECE666F33E4CF033475
                                                                                                                                                                                                                                      SHA-256:E2BEED1B0D6CFC53B4C82650E622BBE97B6692832208DF64A164EABD25560F86
                                                                                                                                                                                                                                      SHA-512:249C363EF57B0F15EB92E88C22D9B122FC12C7B2F6E6BEC71CC07D7B771D80155F25ACE84C9F66E34A08EDA9515D231205C4232428BD6DFCA18FECCAA0F5867B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: ".......",.. HELP_FAQ_TITLE: "...... .........",.. HELP_SUPPORT_TITLE: "..........",.. HELP_EMAIL_US: "....... ... ...... ............ ............ ... .........",.. ABOUT: "...........",.. ABOUT_DESCRIPTION: ".. {0} ... ..... .. ......... .......... ......... ....... .. ... ......... ... ... Internet.",.. CREATE_SAFER_PASSWORDS: "............ ............. ........ .........",.. DOWNLOAD_CONFIDENTLY: "......... ...... .. ........",.. SETTINGS_SS_OPTION_ALL: ".. ............ .. ... .......... .......... ..... ....... .. ........... ......... ..........",.. SETTINGS_SS_OPTION_NONE: ".. ... ............ ..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2970
                                                                                                                                                                                                                                      Entropy (8bit):5.359520151385515
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cwr9pTTyT7Few0MxjU99E/E0v7StLuJHTuiGextXq/JXTGpUx86NQ4QeQr4+8Lke:cwr9pPyTEMxI99E/fTStLOz7xtulGOxh
                                                                                                                                                                                                                                      MD5:48CB347553678CDD242A99A86CA779F4
                                                                                                                                                                                                                                      SHA1:4808DA1C10503C75787100D1C55ABE725ABADD16
                                                                                                                                                                                                                                      SHA-256:00E932898E972214C2218FFAB0C957A37B4317C1DAAD07C09040DCB2F470ADC3
                                                                                                                                                                                                                                      SHA-512:6A96500AC41139CD89DA2D93E91DAC5A6F4EE9577B316952A4D7855B6D82CDB86A97A3F1696B771BA7F8242F09F69F761F8274198A89B557CAA60279EFC75FDC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Help",.. HELP_FAQ_TITLE: "Frequently Asked Questions (FAQs)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Email us at",.. ABOUT: "About",.. ABOUT_DESCRIPTION: "{0} helps you make better decisions about what you do online.",.. CREATE_SAFER_PASSWORDS: "Create safer passwords",.. DOWNLOAD_CONFIDENTLY: "Download confidently",.. SETTINGS_SS_OPTION_ALL: "Tell me if a search result is safe in any search user",.. SETTINGS_SS_OPTION_NONE: "Don't tell me about search results",.. SETTINGS_SS_OPTION_SS: "Tell me if a search result is safe only in Secure Search",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Paste or type your URL",.. TRUST_SITE: "Trust site",.. DONT_TRUST: "Don't trust",.. HELP_FAQ_SECTION_ONE_HEADER: "What is {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} helps you make better decisions about what you do online.",.. HELP_FAQ_SECTION_TWO_HEADER: "How do I share {0} with others?",.. HELP_FAQ_SECTION_TWO_CO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3318
                                                                                                                                                                                                                                      Entropy (8bit):5.3850350116755745
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cDEMyiTKKM+hOeBgn/qfBJq3/GQjD7mQujWoIcsW:vieH+g1D7mfIcsW
                                                                                                                                                                                                                                      MD5:1ABB132302373913E044F5156D9CC718
                                                                                                                                                                                                                                      SHA1:20B85AA4B6306CCB0BB125E5E49E5E073B763991
                                                                                                                                                                                                                                      SHA-256:0349E70A1860DC9771D2EAD686D0210CB0F1782320AC9B04DB71D2E5E69210FA
                                                                                                                                                                                                                                      SHA-512:B8B1EC3B6ABD0F1182D7918E0C16C471B02C4BE1B4E82E99A2A8EDFF2789DEA36D625CA43256861AA30C87834135730D39A7E928EA789CD074AFC0D79D87AA1C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Ayuda",.. HELP_FAQ_TITLE: "Preguntas frecuentes",.. HELP_SUPPORT_TITLE: "Soporte",.. HELP_EMAIL_US: "Env.enos un correo electr.nico a",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "{0} le ayuda a tomar decisiones m.s fundamentadas acerca del uso que hace de Internet.",.. CREATE_SAFER_PASSWORDS: "Cree contrase.as m.s seguras",.. DOWNLOAD_CONFIDENTLY: "Descargue con seguridad",.. SETTINGS_SS_OPTION_ALL: "Informarme si un resultado de b.squeda es seguro en otro motor de b.squeda",.. SETTINGS_SS_OPTION_NONE: "No informarme de resultados de b.squeda",.. SETTINGS_SS_OPTION_SS: "Informarme si un resultado de b.squeda es seguro solo en B.squeda segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Pegue o escriba la direcci.n URL",.. TRUST_SITE: "Confiar en el sitio web",.. DONT_TRUST: "No confiar",.. HELP_FAQ_SECTION_ONE_HEADER: ".Qu. es {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} le ayuda a tomar decisiones m.s fu

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3269
                                                                                                                                                                                                                                      Entropy (8bit):5.397713898219972
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cDEMRrT9tM+hOeBJDfE/ZABFWeLT91e5kkmpouToIc2eoxkPnsP:SRO+gEDUkkmAIc6yW
                                                                                                                                                                                                                                      MD5:97E9F25CBE09014C9906AFD501BEAFA0
                                                                                                                                                                                                                                      SHA1:BE2AF679DD853D45B9DD60358414545A82B90EB1
                                                                                                                                                                                                                                      SHA-256:17C0012EA577B98F47FFAE2429659F4FBE58F0224D3FBE598EFF4EB54B151226
                                                                                                                                                                                                                                      SHA-512:EF677C7E908147AE73DC4052A428E3F620B213A2E3E4DD1FB3AEA09E3AC5DADD98BAE6F7181470DBC49AAAF17D32630429395DB9C5F70B61D7CB2918903D1C4D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Ayuda",.. HELP_FAQ_TITLE: "Preguntas frecuentes",.. HELP_SUPPORT_TITLE: "Soporte",.. HELP_EMAIL_US: "Env.enos un correo electr.nico",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "{0} lo ayuda a tomar mejores decisiones acerca de lo que hace en l.nea.",.. CREATE_SAFER_PASSWORDS: "Cree contrase.as m.s seguras",.. DOWNLOAD_CONFIDENTLY: "Descargue con confianza",.. SETTINGS_SS_OPTION_ALL: "Comunicarme si un resultado de b.squeda es seguro en cualquier motor de b.squeda",.. SETTINGS_SS_OPTION_NONE: "No comunicarme sobre los resultados de b.squedas",.. SETTINGS_SS_OPTION_SS: "Comunicarme si un resultado de b.squeda es seguro solo en b.squeda segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Pegue o escriba la direcci.n URL",.. TRUST_SITE: "Sitio de confianza",.. DONT_TRUST: "No confiar",.. HELP_FAQ_SECTION_ONE_HEADER: ".Qu. es {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} lo ayuda a tomar mejores decisiones acerc

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3156
                                                                                                                                                                                                                                      Entropy (8bit):5.33605601525227
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cFjnmzGSTEMQHo+X/lFYpHNVbA5yZq0Ui4M:dzGSxDlNFR8i4M
                                                                                                                                                                                                                                      MD5:D8FF9BDC8147DA96CC69F322C4FA6ACC
                                                                                                                                                                                                                                      SHA1:65960751D1CDB2250BA4D9879D41CF5F599FA704
                                                                                                                                                                                                                                      SHA-256:EFBD90EE29D723EDBA33CEB4B65CA4D8B2C58F6C71B5F9A5F0D1E4C746DE0051
                                                                                                                                                                                                                                      SHA-512:E84907162A1D82A7EEAA1B42B8132FA3722A3835D5552F75DDBAB0E95E674A271307DA77B9A6B5D5C1366E577A43CC0A82B3987810579456279DF9AD5B061B92
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Ohje",.. HELP_FAQ_TITLE: "Usein kysytyt kysymykset (UKK)",.. HELP_SUPPORT_TITLE: "Tuki",.. HELP_EMAIL_US: "L.het. meille s.hk.postia osoitteeseen",.. ABOUT: "Tietoja",.. ABOUT_DESCRIPTION: "{0} auttaa sinua toimimaan verkossa turvallisesti.",.. CREATE_SAFER_PASSWORDS: "Entist. turvallisempien salasanojen luominen",.. DOWNLOAD_CONFIDENTLY: "Luotettava lataaminen",.. SETTINGS_SS_OPTION_ALL: "Ilmoita, onko hakutulos turvallinen, miss. tahansa hakukoneessa",.. SETTINGS_SS_OPTION_NONE: ".l. n.yt. ilmoituksia hakutulosten turvallisuudesta",.. SETTINGS_SS_OPTION_SS: "Ilmoita, onko hakutulos turvallinen, kun k.yt.n Suojattua hakua",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Liit. tai kirjoita URL-osoite",.. TRUST_SITE: "Luota sivustoon",.. DONT_TRUST: ".l. luota",.. HELP_FAQ_SECTION_ONE_HEADER: "Mik. on {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} auttaa sinua toimimaan verkossa turvallisesti.",.. HELP_FAQ_S

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3475
                                                                                                                                                                                                                                      Entropy (8bit):5.380064521367525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cyXk9LMTrBXOkXco29M5t6QUxT//fM5NzyKt6yQjheF:zZR+ksoX4xgbyK1QjheF
                                                                                                                                                                                                                                      MD5:1D1010C1A91C8E03E85C55B9F4A8130C
                                                                                                                                                                                                                                      SHA1:02549B15939F77C47606480F4190F50485F81C27
                                                                                                                                                                                                                                      SHA-256:36424E6C178278FDA2EEEA0ED4F2769E2AE3F8CA97E99B1DC3B430FB20D67EAA
                                                                                                                                                                                                                                      SHA-512:6D5B9227D893145AADC501540A6E2A630536C0C354E83862710023102D3560FC609BD70B7FFE9271F4CC6491A22205901975DE9963F4AB492274A8961E1F32DA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Aide",.. HELP_FAQ_TITLE: "Foire aux questions (FAQ)",.. HELP_SUPPORT_TITLE: "Soutien",.. HELP_EMAIL_US: "Envoyez-nous un courriel au",.. ABOUT: ". propos",.. ABOUT_DESCRIPTION: "{0} vous aide . prendre de meilleures d.cisions sur vos activit.s en ligne.",.. CREATE_SAFER_PASSWORDS: "Cr.er des mots de passe plus s.rs",.. DOWNLOAD_CONFIDENTLY: "T.l.charger de fa.on confidentielle",.. SETTINGS_SS_OPTION_ALL: "Me dire si un r.sultat de recherche est s.r dans tous les moteurs de recherche",.. SETTINGS_SS_OPTION_NONE: "Ne pas me parler des r.sultats de recherche",.. SETTINGS_SS_OPTION_SS: "Me dire si un r.sultat de recherche est s.r seulement dans la recherche s.curis.e",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Coller ou saisir votre URL",.. TRUST_SITE: "Faire confiance au site",.. DONT_TRUST: "Ne pas faire confiance",.. HELP_FAQ_SECTION_ONE_HEADER: "Qu'est-ce que {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3557
                                                                                                                                                                                                                                      Entropy (8bit):5.410531724928662
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cyXkPWgMTpX56126MJk7OQTxN//i46XeNWtd0lDqKStVGC4jRgoO9:zrN1XU1G2xKnINCieoM
                                                                                                                                                                                                                                      MD5:E9A8D60AAE57F78CCEC75BEEE14B6122
                                                                                                                                                                                                                                      SHA1:71652B16C1ACDA2FB300873F1B33A52A398F20F0
                                                                                                                                                                                                                                      SHA-256:C837B7D43825F402B8CFE9C23F788D86CF74BF9AC3CA91CFF19235F6F5BB5AEE
                                                                                                                                                                                                                                      SHA-512:2F3E398B5B5001BD2C242659EBDCCB02BA3CFB059961D4F4BAB6B0C409EEDA012F9949D327DC099E890929B2310692D499E15270D61CB2B8CC41427D4A04E87B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Aide",.. HELP_FAQ_TITLE: "Foire aux questions (FAQ)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Contactez-nous par e-mail . cette adresse",.. ABOUT: "A propos",.. ABOUT_DESCRIPTION: "{0} vous aide . prendre les bonnes d.cisions en ce qui concerne vos activit.s en ligne.",.. CREATE_SAFER_PASSWORDS: "Cr.ez des mots de passe plus fiables",.. DOWNLOAD_CONFIDENTLY: "T.l.chargez en toute confiance",.. SETTINGS_SS_OPTION_ALL: "Me dire si le r.sultat de la recherche est prot.g. dans tous les moteurs de recherche",.. SETTINGS_SS_OPTION_NONE: "Ne rien me dire sur les r.sultats de la recherche",.. SETTINGS_SS_OPTION_SS: "Me dire si le r.sultat de la recherche est prot.g. dans la recherche s.curis.e uniquement",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Collez ou saisissez l'URL",.. TRUST_SITE: "Approuver",.. DONT_TRUST: "Ne pas approuver",.. HELP_FAQ_SECTION_ONE_HEADER: "Qu'est-ce que {0}.?",.. HELP_FAQ

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3286
                                                                                                                                                                                                                                      Entropy (8bit):5.445102457415404
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cv359TfWlMbZ5ur/cOKc+vOOES9Wxt9yzoIEZUDrBdjoe2o:iLW2yYlVES9+96UuDrBdjoHo
                                                                                                                                                                                                                                      MD5:4944158CB57A53158D69C4A1F0974A8D
                                                                                                                                                                                                                                      SHA1:72279B039A08651B100A87921731559AC752D71D
                                                                                                                                                                                                                                      SHA-256:D020049D2A1057C240AE486A431BDEEBCD055F7BF5D5464E1944EEA47817344E
                                                                                                                                                                                                                                      SHA-512:A3F33A763D1305A2D09C63E9F46A275B5955585DF06EE3547716E03FA6A6707C88BC8B3275C3992DB4474AA69B3134E539EFEB82596C514EF8B31D737F751E1F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Pomo.",.. HELP_FAQ_TITLE: ".esto postavljana pitanja (.PP)",.. HELP_SUPPORT_TITLE: "Podr.ka",.. HELP_EMAIL_US: "Obratite nam se na adresi e-po.te",.. ABOUT: "O aplikaciji",.. ABOUT_DESCRIPTION: "{0} poma.e vam u dono.enju boljih odluka o tome .to .inite na mre.i.",.. CREATE_SAFER_PASSWORDS: "Stvorite sigurnije lozinke",.. DOWNLOAD_CONFIDENTLY: "Pouzdano preuzimajte",.. SETTINGS_SS_OPTION_ALL: "Obavijesti me ako je rezultat pretra.ivanja siguran u bilo kojoj tra.ilici",.. SETTINGS_SS_OPTION_NONE: "Nemoj me obavijestiti o rezultatima pretra.ivanja",.. SETTINGS_SS_OPTION_SS: "Obavijesti me ako je rezultat pretra.ivanja siguran samo u Sigurnom pretra.ivanju",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Zalijepite ili unesite svoj URL",.. TRUST_SITE: "Mjesto smatraj pouzdanim",.. DONT_TRUST: "Ne smatraj pouzdanim",.. HELP_FAQ_SECTION_ONE_HEADER: ".to je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} poma.e vam

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3670
                                                                                                                                                                                                                                      Entropy (8bit):5.573215491924637
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:c491zbQ9T9aMhF7fQdq/SvRonzXfFNtvf1B1BER7yU8p:tbQ9hfQfRonzb/3iRGU8p
                                                                                                                                                                                                                                      MD5:E4FD82A296AC2A08459CC0350283A319
                                                                                                                                                                                                                                      SHA1:24C9D4A5144E23C62E02B2EF507DD982B84815BE
                                                                                                                                                                                                                                      SHA-256:8F307EC1E7959E22410B15998004E9D6E1211AAA7FEEA01A1D41431272969A3B
                                                                                                                                                                                                                                      SHA-512:9C31ADA08A11B5CB507671E74A675F9D4F9743DA8A2A31ADE2C2DB2BAC62B89291CE9C42FAEE24EDCC2A8BE1A69883C4A43DBFBA225B6FD455D7700C871731BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "S.g.",.. HELP_FAQ_TITLE: "Gyakran ism.telt k.rd.sek (GYIK)",.. HELP_SUPPORT_TITLE: "T.mogat.s",.. HELP_EMAIL_US: "K.ldj.n nek.nk e-mailt az al.bbi c.mre:",.. ABOUT: "N.vjegy",.. ABOUT_DESCRIPTION: "A(z) {0} seg.ts.get ny.jt ahhoz, hogy jobb d.nt.seket hozhasson az online vil.gban.",.. CREATE_SAFER_PASSWORDS: "Biztons.gosabb jelszavak l.trehoz.sa",.. DOWNLOAD_CONFIDENTLY: "Biztons.gos let.lt.s",.. SETTINGS_SS_OPTION_ALL: "T.j.koztasson a keres.s eredm.ny.nek biztons.goss.g.r.l b.rmely keres.motorra vonatkoz.an",.. SETTINGS_SS_OPTION_NONE: "Ne t.j.koztasson a keres.si eredm.nyekkel kapcsolatban",.. SETTINGS_SS_OPTION_SS: "A keres.s eredm.ny.nek biztons.goss.g.r.l csak a Biztons.gos keres.sben t.j.koztasson",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL beilleszt.se vagy be.r.sa",.. TRUST_SITE: "Megb.zhat. webhely",.. DONT_TRUST: "Nem megb.zhat.",.. HELP_FAQ_SECTIO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3280
                                                                                                                                                                                                                                      Entropy (8bit):5.322858493506595
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cF+xiITUmLgSM+xy07Zg/ikrQs9N46fkjorok0jQxsT0:QIIag/+fENbsErI0xsQ
                                                                                                                                                                                                                                      MD5:8FAF76184E737C9A673519A387EFC9F8
                                                                                                                                                                                                                                      SHA1:8608FF2194C635F1193FBCADDECAB2F768E00DAB
                                                                                                                                                                                                                                      SHA-256:EF0AB3D766B85F225C532B3E83D2291E838F373826A891071BFBE2E589F6D9E3
                                                                                                                                                                                                                                      SHA-512:BACF279DB501BD08FF110FF02FAC569A3D5ECB36DB0A52292721F95DC6C8B9FB77584101A98B37496CBE54B9FBB7C6AE47FE577D44577C03ED1EEA02B5257FB7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Guida",.. HELP_FAQ_TITLE: "Domande frequenti",.. HELP_SUPPORT_TITLE: "Assistenza",.. HELP_EMAIL_US: "Contattaci via email all'indirizzo",.. ABOUT: "Informazioni su",.. ABOUT_DESCRIPTION: "{0} ti aiuta a prendere decisioni pi. consapevoli sulle attivit. online.",.. CREATE_SAFER_PASSWORDS: "Crea password pi. sicure",.. DOWNLOAD_CONFIDENTLY: "Scarica con la massima sicurezza",.. SETTINGS_SS_OPTION_ALL: "Comunicami se un risultato di ricerca . sicuro in un motore di ricerca",.. SETTINGS_SS_OPTION_NONE: "Non comunicare nulla riguardo ai risultati di ricerca",.. SETTINGS_SS_OPTION_SS: "Comunicami se un risultato di ricerca . sicuro solo in ricerca sicura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Incolla o digita l'URL",.. TRUST_SITE: "Considera affidabile il sito",.. DONT_TRUST: "Non considerare affidabile",.. HELP_FAQ_SECTION_ONE_HEADER: "Che cos'. {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ti aiuta a prendere dec

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3760
                                                                                                                                                                                                                                      Entropy (8bit):5.753349775330985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cFuvhOT6tGCuqZu0KMV1V6Gq//0bNbJkKjixAwRm4wegixVU0is:1YGtGCuyu0HfDFBPiKem4/gi/n
                                                                                                                                                                                                                                      MD5:FFA3A4CED29FC57F7FE708B693081466
                                                                                                                                                                                                                                      SHA1:4D3EFACD7EA8D75FD10B0A436068513CA77CC89A
                                                                                                                                                                                                                                      SHA-256:EEFBA8E4306B833BDBB6EF34AC3BA3D1C954884FBAF9BFC9F31DBB7F3E52E263
                                                                                                                                                                                                                                      SHA-512:1DFE28F724D7A3AA98DD3B1C82F4FDADF263EEF79CE162A174FF0C854E352FA11743D916B5D52B9EFEA4A67A5680F00A079C3A1DF1C53CC052C5FDF3562094C1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "...",.. HELP_FAQ_TITLE: "...... (FAQ)",.. HELP_SUPPORT_TITLE: "....",.. HELP_EMAIL_US: "........",.. ABOUT: ".......",.. ABOUT_DESCRIPTION: "{0} ...................",.. CREATE_SAFER_PASSWORDS: "...............",.. DOWNLOAD_CONFIDENTLY: "...........",.. SETTINGS_SS_OPTION_ALL: "..........................",.. SETTINGS_SS_OPTION_NONE: "..............",.. SETTINGS_SS_OPTION_SS: ".... .....................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL ................",.. TRUST_SITE: "........",.. DONT_TRUST: ".....",.. HELP_FAQ_SECTION_ONE_HEADER: "{0} .......",.. HELP_FAQ_SECTI

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3451
                                                                                                                                                                                                                                      Entropy (8bit):5.831296283324677
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:c0hbqh5TgP81LM2z7i6B/+XP6HUdYXx/gAw8otAJ2y8Bwz:JWQ8S76X6Avot3h8
                                                                                                                                                                                                                                      MD5:880B0F87BF8597D04D777EE0A1D0EA7B
                                                                                                                                                                                                                                      SHA1:544F51D79814142A094080CD852568B44DC3D0A7
                                                                                                                                                                                                                                      SHA-256:CF77A7008D152BCEB9EA18C8EDB3847F146499BF5AEDA0B30638902EE6D5E99D
                                                                                                                                                                                                                                      SHA-512:730B5F056480B5EF05C000958152F84A19DA2788BBC355BDB4B8D4FFC987AE3A6AED15B23B4D62E45BBD24DD7750DF7A587D49284FEC3BCC28808087C340C980
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "...",.. HELP_FAQ_TITLE: "... ..(FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: "... ..",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0}. .... ... .. . ... ... .. . ... ......",.. CREATE_SAFER_PASSWORDS: ".. ... .. ...",.. DOWNLOAD_CONFIDENTLY: "... ....",.. SETTINGS_SS_OPTION_ALL: ".. .. .... .. ... .... ..",.. SETTINGS_SS_OPTION_NONE: ".. ... .. ... ..",.. SETTINGS_SS_OPTION_SS: ".. ..... .. ... .... ..",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL. .. ... ......",.. TRUST_SITE: "... ..",.. DONT_TRUST: ".... ..",.. HELP_FAQ_SECTION_ONE_HEADER: "{0}. .....?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}. .... ... .. . ... .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3107
                                                                                                                                                                                                                                      Entropy (8bit):5.354780956543607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cA9ffAT6MuE50WT/CGoDAUtGZpn2g3BBInl:ejVoxtepD3B6nl
                                                                                                                                                                                                                                      MD5:F89A4D759BB256E0AE34D07AA128097F
                                                                                                                                                                                                                                      SHA1:74CA1C9DD2DB91225AF71CF31FEC9B86D3722895
                                                                                                                                                                                                                                      SHA-256:C362F0AA07F0C7279037FFF5249DAE0BF91EDD0EB3C9F24A5C785C86E776AD12
                                                                                                                                                                                                                                      SHA-512:6E81DFAC71F232BEEDA49387B9DC069F649E262670AB0251EFEE1D62C3B859EBFC5C7CBF87317A87D94E7AB27C43AD4296995528B507B38D775A9CAC30136A35
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Hjelp",.. HELP_FAQ_TITLE: "Vanlige sp.rsm.l",.. HELP_SUPPORT_TITLE: "St.tte",.. HELP_EMAIL_US: "Send oss en e-postmelding til",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} gj.r det enklere . ta bedre avgj.relser om hva du gj.r p. Internett.",.. CREATE_SAFER_PASSWORDS: "Opprett sikrere passord",.. DOWNLOAD_CONFIDENTLY: "Last ned uten bekymringer",.. SETTINGS_SS_OPTION_ALL: "Fortell om et s.keresultat er trygt, i enhver s.kemotor",.. SETTINGS_SS_OPTION_NONE: "Ikke fortell meg om s.keresultatene",.. SETTINGS_SS_OPTION_SS: "Fortell om et s.keresultat er sikkert, men bare i Sikkert s.k",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Lim eller skriv inn URL-adressen din",.. TRUST_SITE: "Klarer omr.de",.. DONT_TRUST: "Ikke klarer",.. HELP_FAQ_SECTION_ONE_HEADER: "Hva er {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} gj.r det enklere . ta bedre avgj.relser om hva du gj.r p. Internett.",.. HELP_FAQ_SECTION_TWO_HEAD

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3196
                                                                                                                                                                                                                                      Entropy (8bit):5.325138480606689
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cwMUf5ztTk0aUPDMavouzNv/lzz0TldANPQ3tBvlv4mP:rhtaUQWiMctBvBP
                                                                                                                                                                                                                                      MD5:EBD941D8B6CC18ECC655D9E444EEA044
                                                                                                                                                                                                                                      SHA1:B38030392BB2CC67BDC8A67DB71D9595D72A6DA2
                                                                                                                                                                                                                                      SHA-256:C86C4B612C9C099F20A060AC26534F83E79A8228F7A42BEB0FB956AA5344BB7F
                                                                                                                                                                                                                                      SHA-512:F48A97D9A338B501F6C35DF24FD81FE830E652A8BBFA54399DEE76D9A1E1FDD49D40E2403C60BCDF78BDF08BE8050DAF0AE577ACF2D8F09D7464C057B02CE790
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Help",.. HELP_FAQ_TITLE: "Veelgestelde vragen",.. HELP_SUPPORT_TITLE: "Ondersteuning",.. HELP_EMAIL_US: "E-mail ons op",.. ABOUT: "Info",.. ABOUT_DESCRIPTION: "{0} helpt u betere beslissingen over uw online activiteiten te nemen.",.. CREATE_SAFER_PASSWORDS: "Maak veiligere wachtwoorden",.. DOWNLOAD_CONFIDENTLY: "Download probleemloos",.. SETTINGS_SS_OPTION_ALL: "Laat mij in elke zoekmachine weten of een zoekresultaat veilig is",.. SETTINGS_SS_OPTION_NONE: "Niets zeggen over zoekresultaten",.. SETTINGS_SS_OPTION_SS: "Laat mij alleen in Beveiligd zoeken weten of een zoekresultaat veilig is",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Plak of typ uw URL",.. TRUST_SITE: "Site vertrouwen",.. DONT_TRUST: "Niet vertrouwen",.. HELP_FAQ_SECTION_ONE_HEADER: "Wat is {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} helpt u betere beslissingen over uw online activiteiten te nemen.",.. HELP_FAQ_SECTION_TWO_HEADER: "Hoe kan ik {0} met

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3433
                                                                                                                                                                                                                                      Entropy (8bit):5.622827756522604
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cnWv3LDTIKXe8FDXdIzMn5VRe/8gAR+3jRsFAEEGs6L49l0v2dUPJJS:ZPUKpFDOIiRc7EA+lXUPJJS
                                                                                                                                                                                                                                      MD5:4F4886EE3ED1FC57ECB4DD56D9166101
                                                                                                                                                                                                                                      SHA1:72DBF92E71EB1C9E148553869333DCADDD0A5908
                                                                                                                                                                                                                                      SHA-256:FD7BC0FEF7BE5A6FCBD83DDAB00A0DED02E7551C5D96B0DD1CCEE71168493FAA
                                                                                                                                                                                                                                      SHA-512:C4065D12C00413170B3795298778054B15329FFA99C5CA0DF7C5B10AA6AA58108960817586067CC656494F744D7C2C139DD8D63F758992F779F3CECDC0387983
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Pomoc",.. HELP_FAQ_TITLE: "Cz.sto zadawane pytania",.. HELP_SUPPORT_TITLE: "Pomoc techniczna",.. HELP_EMAIL_US: "Wy.lij wiadomo.. e-mail na adres",.. ABOUT: "Informacje",.. ABOUT_DESCRIPTION: "Program {0} pomaga podejmowa. rozs.dne decyzje podczas przegl.dania Internetu.",.. CREATE_SAFER_PASSWORDS: "Tw.rz silniejsze has.a",.. DOWNLOAD_CONFIDENTLY: "Pobieraj bez obaw",.. SETTINGS_SS_OPTION_ALL: "Pokazuj oceny bezpiecze.stwa wynik.w wyszukiwania w ka.dej wyszukiwarce",.. SETTINGS_SS_OPTION_NONE: "Nie pokazuj ocen wynik.w wyszukiwania",.. SETTINGS_SS_OPTION_SS: "Pokazuj oceny bezpiecze.stwa wynik.w wyszukiwania tylko w wyszukiwarce Bezpieczne wyszukiwanie",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Wklej lub wpisz adres URL",.. TRUST_SITE: "Zaufaj witrynie",.. DONT_TRUST: "Nie ufaj",.. HELP_FAQ_SECTION_ONE_HEADER: "Co to jest {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Program {0} pomaga podejmowa. rozs.dne

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3252
                                                                                                                                                                                                                                      Entropy (8bit):5.398695869071252
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cc0m2Tpgz2z24eMgUWy0/IULhYRukp+ATR8tXVfNTO:wloYdMIuQ8FVfhO
                                                                                                                                                                                                                                      MD5:37A7999929C49F24CDCBF140F3F09862
                                                                                                                                                                                                                                      SHA1:BDAAD3CADD678C2460EE64A1457168B1BC944D33
                                                                                                                                                                                                                                      SHA-256:D424D1177FDD8CB85349090241D844DE1271DE014735B0E72A31719A5A354E74
                                                                                                                                                                                                                                      SHA-512:7D08EDC69FFB9976B12E62EE2ED275313F2305089B070667593434DFA4FB532261EA41C7D032A07D5E8CF34E615A763E0CB6BBB465EE5F41BC9D504B3FF6278B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Ajuda",.. HELP_FAQ_TITLE: "Perguntas frequentes",.. HELP_SUPPORT_TITLE: "Suporte",.. HELP_EMAIL_US: "Envie um e-mail para",.. ABOUT: "Sobre",.. ABOUT_DESCRIPTION: "{0} ajuda voc. a tomar melhores decis.es durante suas atividades online.",.. CREATE_SAFER_PASSWORDS: "Crie senhas mais seguras",.. DOWNLOAD_CONFIDENTLY: "Fa.a downloads com confian.a",.. SETTINGS_SS_OPTION_ALL: "Avise-me quando um resultado de pesquisa for seguro em qualquer mecanismo de pesquisa",.. SETTINGS_SS_OPTION_NONE: "N.o me avise a respeito dos resultados de pesquisa",.. SETTINGS_SS_OPTION_SS: "Avise-me quando um resultado de pesquisa for seguro apenas com a Pesquisa segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Copie ou cole seu URL",.. TRUST_SITE: "Confiar no site",.. DONT_TRUST: "N.o confiar",.. HELP_FAQ_SECTION_ONE_HEADER: "O que . {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ajuda voc. a tomar melhores decis.es durante suas ativid

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3264
                                                                                                                                                                                                                                      Entropy (8bit):5.391466214051842
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ccGmQ7XTlHUszMAqjI/O/rgZaFWCG3Ix5amxnFJ:I7hHUlmwamxnv
                                                                                                                                                                                                                                      MD5:B45D6F2128C5542807A7A5D0B45D14DA
                                                                                                                                                                                                                                      SHA1:7A2A7C67AB9CFF949DE93966534F185E8657FB25
                                                                                                                                                                                                                                      SHA-256:D9EE59321AA24CE0A2405C259B0A8E9353D8CF2210C3F17B14492D44A5FB7937
                                                                                                                                                                                                                                      SHA-512:9011814BBD1919C3126105C5F3FB353E8B76BF124DCF34D5E7FA4E4D3027A3FB1585F0E4E9DCA75D8D26AD10CF068E42CB54DEEDF7C0234F34A0B5CEC7A49802
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Ajuda",.. HELP_FAQ_TITLE: "Perguntas Mais Frequentes (FAQs)",.. HELP_SUPPORT_TITLE: "Suporte",.. HELP_EMAIL_US: "Envie-nos uma mensagem de correio eletr.nico para",.. ABOUT: "Acerca de",.. ABOUT_DESCRIPTION: "O {0} ajuda-o a tomar melhores decis.es acerca das suas atividades online.",.. CREATE_SAFER_PASSWORDS: "Crie palavras-passe mais seguras",.. DOWNLOAD_CONFIDENTLY: "Transfira com confian.a",.. SETTINGS_SS_OPTION_ALL: "Indicar se um resultado de pesquisa . seguro em todos os motores de pesquisa",.. SETTINGS_SS_OPTION_NONE: "N.o me informar sobre os resultados de pesquisa",.. SETTINGS_SS_OPTION_SS: "Indicar se um resultado . seguro apenas na Pesquisa Segura",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Cole ou escreva o URL",.. TRUST_SITE: "Considerar site fidedigno",.. DONT_TRUST: "N.o considerar fidedigno",.. HELP_FAQ_SECTION_ONE_HEADER: "O que . o {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "O {0} ajuda-o a toma

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4697
                                                                                                                                                                                                                                      Entropy (8bit):5.050341236557548
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cgyp6VTFkLeMF+TXVjM/2m9VzTUmw9+WTnoXTAqsvm6:LVRkHARMH4TnoDAqsvX
                                                                                                                                                                                                                                      MD5:F8B9070B9698EFBA530B6064D8928AC7
                                                                                                                                                                                                                                      SHA1:C2E41EAB9AC16D0EAE526FE4FB3957D4B7607F79
                                                                                                                                                                                                                                      SHA-256:7A04B3B43652D44E82D9FD5C7CD546AEC3B41E4085D39610E4694A37E1D9BCD7
                                                                                                                                                                                                                                      SHA-512:9A562DC9BE253FF73FE223690D9B56ED86064538D077F6D791E39246600D171F28C0B24A55BE20B447E4229BD046D56DF1E1469292E968D94FD2C56DF66BE79A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: ".......",.. HELP_FAQ_TITLE: "..... .......... .......",.. HELP_SUPPORT_TITLE: ".........",.. HELP_EMAIL_US: "..... ........... .....:",.. ABOUT: ". .........",.. ABOUT_DESCRIPTION: "{0} . ... .........., ........... ..... ......... ........... . ..........",.. CREATE_SAFER_PASSWORDS: "........ ........ .......",.. DOWNLOAD_CONFIDENTLY: "........ ... ........",.. SETTINGS_SS_OPTION_ALL: "........ . ............ ........... ...... .. .... ......... ........",.. SETTINGS_SS_OPTION_NONE: ".. ........ . ............ ........... ......",.. SETTINGS_SS_OPTION_SS: "........ . ............ ........... ...... ...... . ..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3534
                                                                                                                                                                                                                                      Entropy (8bit):5.657001911592916
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cwP+i9HTsGeKlMMUjY3n8BEM/f0vlJuOquLlXElBfoWagWpWrdimER7r+05+qmY:cwPb9HTcKaMUy8aM/sX0ajnecmSr+WmY
                                                                                                                                                                                                                                      MD5:88840FD2BC5DE71C8E30124FCABF723D
                                                                                                                                                                                                                                      SHA1:71F1D3326FF650FC55414E6B956F66F49B220E1C
                                                                                                                                                                                                                                      SHA-256:A89FA5261EAE41F0C6EB53DAEEDAFC8B5D898EB76E973FE5AEF21D3839BF0902
                                                                                                                                                                                                                                      SHA-512:7C9DDC20B8E6BC7A7D0DCD0950F2BA47050761CEC6A0681515A4B82150945360B414B7AABE72DFDEED58D484472DAFDD67461A380CEF5BB06E11BDE45435EC1A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Pomocn.k",.. HELP_FAQ_TITLE: "Naj.astej.ie ot.zky",.. HELP_SUPPORT_TITLE: "Podpora",.. HELP_EMAIL_US: "Po.lite n.m e-mail na adresu",.. ABOUT: "Inform.cie",.. ABOUT_DESCRIPTION: "Aplik.cia {0} v.m pom..e robi. lep.ie rozhodnutia o va.om .ivote online.",.. CREATE_SAFER_PASSWORDS: "Vytv.rajte bezpe.nej.ie hesl.",.. DOWNLOAD_CONFIDENTLY: "S.ahujte d.veryhodn. s.bory",.. SETTINGS_SS_OPTION_ALL: "Informova. o bezpe.nosti v.sledku vyh.ad.vania v ka.dom vyh.ad.vacom n.stroji",.. SETTINGS_SS_OPTION_NONE: "Neinformova. o v.sledkoch vyh.ad.vania",.. SETTINGS_SS_OPTION_SS: "O.bezpe.nosti v.sledku vyh.ad.vania ma informujte len v.zabezpe.enom vyh.ad.van.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Prilepte alebo zadajte adresu URL",.. TRUST_SITE: "D.verova. lokalite",.. DONT_TRUST: "Ned.verova.",.. HELP_FAQ_SECTION_ONE_HEADER: ".o je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "Aplik.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3203
                                                                                                                                                                                                                                      Entropy (8bit):5.453100214404126
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cvh5lgT19NMMgHg8/9WQqRZt8JZZmVau8KP8jvv/FUD8VSk:BhlmJXPdSD8VSk
                                                                                                                                                                                                                                      MD5:019F2DCD38DE33EB9C39340CE8F782A8
                                                                                                                                                                                                                                      SHA1:5542AA5B078B6B7C03823D2A796D494480032B0A
                                                                                                                                                                                                                                      SHA-256:AAB9EA2AFDCE9A645F331486C9617547A7BE9C1EFA7B8DA09182FBF1A212D45D
                                                                                                                                                                                                                                      SHA-512:FD1969910D898F7CDBDDE969624873DEC4A64AB9F5E4EC82B0E92D2F1BA176088DAAAEED1BD8C4630378F0F37959EBECDFDF87501F75F2EAEB64633B733BBFC9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Pomo.",.. HELP_FAQ_TITLE: "Naj.e..a pitanja",.. HELP_SUPPORT_TITLE: "Podr.ka",.. HELP_EMAIL_US: "Po.aljite nam e-poruku na adresu",.. ABOUT: "Osnovni podaci",.. ABOUT_DESCRIPTION: "{0} vam poma.e da donosite bolje odluke o svojim aktivnostima na mre.i.",.. CREATE_SAFER_PASSWORDS: "Kreirajte bezbednije lozinke",.. DOWNLOAD_CONFIDENTLY: "Preuzimajte bezbri.no",.. SETTINGS_SS_OPTION_ALL: "Obavesti me u svakom pretra.iva.u da li je rezultat pretrage bezbedan",.. SETTINGS_SS_OPTION_NONE: "Ne obave.tavaj me o rezultatima pretrage",.. SETTINGS_SS_OPTION_SS: "Obavesti me samo u bezbednoj pretrazi da li je rezultat pretrage bezbedan",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Nalepite ili unesite URL adresu",.. TRUST_SITE: "Veruj lokaciji",.. DONT_TRUST: "Ne veruj",.. HELP_FAQ_SECTION_ONE_HEADER: ".ta je {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} vam poma.e da donosite bolje odluke o svojim aktivnostima na mre.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3145
                                                                                                                                                                                                                                      Entropy (8bit):5.46340323219285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cayPkTXsNMjOlH/PROv5eFqNzXl9Rjz8BU5w:3Dsu/TNl9Fz3w
                                                                                                                                                                                                                                      MD5:7B25A2C2903107E9A9BAA126A7EC7FD4
                                                                                                                                                                                                                                      SHA1:F76B2BF5FEDEA54286D22524BE68D026FA1E0968
                                                                                                                                                                                                                                      SHA-256:DE34F4B7584B21028415A2BB09C17B6F6618A016F49802BCC9B753C756892E9E
                                                                                                                                                                                                                                      SHA-512:EAA6DE1D0A394E1EAD843D9C189F5BE4FF88512B7062DE44AD3AD9D82AEC62CD095D4AEE67E28CF40D7AF6C44E7520E69C003690A637F3936F6EFC43584F2281
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Hj.lp",.. HELP_FAQ_TITLE: "Vanliga fr.gor (FAQ)",.. HELP_SUPPORT_TITLE: "Support",.. HELP_EMAIL_US: "Kontakta oss via e-post p.",.. ABOUT: "Om",.. ABOUT_DESCRIPTION: "{0} hj.lper dig att ta b.ttre beslut g.llande vad du g.r online.",.. CREATE_SAFER_PASSWORDS: "Skapa s.krare l.senord",.. DOWNLOAD_CONFIDENTLY: "S.kra h.mtningar",.. SETTINGS_SS_OPTION_ALL: "Informera mig om s.kra s.kresultat i samtliga s.kmotorer",.. SETTINGS_SS_OPTION_NONE: "Informera mig inte om s.kresultat",.. SETTINGS_SS_OPTION_SS: "Informera mig om s.kra s.kresultat, men endast vid s.ker s.kning",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "Klistra in eller ange webbadress (URL)",.. TRUST_SITE: "Ange som betrodd webbplats",.. DONT_TRUST: "Ange inte som betrodd webbplats",.. HELP_FAQ_SECTION_ONE_HEADER: "Vad .r {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} hj.lper dig att ta b.ttre beslut g.llande vad du g.r online.",.. HELP_FA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3451
                                                                                                                                                                                                                                      Entropy (8bit):5.523016979092692
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:cUCFiIkATzMz/k1/DJMWeTc3a/B6eCVt/zes6t3K8SLcwl39cNyZw:gngIDKQ/ei/Bik39cNl
                                                                                                                                                                                                                                      MD5:B8F95BBC704669A8172B338F3F27AC00
                                                                                                                                                                                                                                      SHA1:6283755A6AE7FB754290A42F921A60439532B917
                                                                                                                                                                                                                                      SHA-256:D3B92A4226A301168F8D223F493F7DE12E90246B24BA4B99CD99A8EBF0DF4221
                                                                                                                                                                                                                                      SHA-512:4F220234EE93DD38FAD4CA2191962DD6D97D267F1BBB72E78B8A407BF5F85785C3675B6AFEA7187D735BD5837588D9A1B54A9D70125D78251B2FAE5B75B126B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "Yard.m",.. HELP_FAQ_TITLE: "S.k Sorulan Sorular (SSS'ler)",.. HELP_SUPPORT_TITLE: "Destek",.. HELP_EMAIL_US: ".u adresten bize e-posta g.nderin:",.. ABOUT: "Hakk.nda",.. ABOUT_DESCRIPTION: "{0} .evrimi.iyken ne yapaca..n.z konusunda daha iyi kararlar alman.za yard.mc. olur.",.. CREATE_SAFER_PASSWORDS: "Daha g.venli parolalar olu.turun",.. DOWNLOAD_CONFIDENTLY: "G.venle indirin",.. SETTINGS_SS_OPTION_ALL: "Herhangi bir arama motorunda bir arama sonucunun g.venli olup olmad...n. benimle payla.",.. SETTINGS_SS_OPTION_NONE: "Arama sonu.lar.n. benimle payla.ma",.. SETTINGS_SS_OPTION_SS: "Yaln.zca G.venli Arama'da bir arama sonucunun g.venli olup olmad...n. benimle payla.",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "URL'nizi yap..t.r.n veya yaz.n",.. TRUST_SITE: "Bu siteye g.ven",.. DONT_TRUST: "G.venme",.. HELP_FAQ_SECTION_ONE_HEADER: "{0} nedir?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2969
                                                                                                                                                                                                                                      Entropy (8bit):6.156573438528102
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cii4bo8iTBSeLHzMP0jnlOe/50vovlun8uTAlHWx3sMvZpSIOeN5SfKj0gPBFlpg:cii4boXTNHzMP07we/OQvl08GN8oZkIa
                                                                                                                                                                                                                                      MD5:10E36ED7123345F89D67DD3F8FF64772
                                                                                                                                                                                                                                      SHA1:19FDE1FD119959625FB38A7EEF93B566BB771485
                                                                                                                                                                                                                                      SHA-256:74E75A2E66BB9FB60FB61384428E4FE6E9D007166EF00B25DF936CB9B8193F95
                                                                                                                                                                                                                                      SHA-512:6E25231ADD1539EE008973D842A6B3F2A62E6F87BAFDFC2B757F0449CE4F016FE04DF776C7A50605B0556BDC0949DECDAA4511C6E3832B8922FB20B790664D9A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "..",.. HELP_FAQ_TITLE: "...... (FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: ".........",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0}.................",.. CREATE_SAFER_PASSWORDS: "........",.. DOWNLOAD_CONFIDENTLY: "......",.. SETTINGS_SS_OPTION_ALL: ".....................",.. SETTINGS_SS_OPTION_NONE: ".........",.. SETTINGS_SS_OPTION_SS: "...................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "..... URL",.. TRUST_SITE: "....",.. DONT_TRUST: "...",.. HELP_FAQ_SECTION_ONE_HEADER: "... {0}?",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0}.................",.. HELP_FAQ_SECTION_TWO_HEADER: ".......{0}?",.. HELP_FAQ_SECTION_TWO_CONTENT: ".

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-options-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3046
                                                                                                                                                                                                                                      Entropy (8bit):6.153142415513714
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cjEUAb0CTgSztJYMreb0j9ruR/o0v5uJufDeQO1LDohNp+i6Zj5dCQU8+N/SoAu6:cjpAbxT2Mru0p6R/TBmWDVMz7fU/N/Sh
                                                                                                                                                                                                                                      MD5:DB4DB05A90949698175842C391F190CA
                                                                                                                                                                                                                                      SHA1:2911A24FD51496DFCC3CB00C5E381E699B602F05
                                                                                                                                                                                                                                      SHA-256:05A76C0173B32A83A01A64606E51A527E86BCC4EC7F8679A9FB6FDF8FF660890
                                                                                                                                                                                                                                      SHA-512:6D38E9E4A78AEF0FBDB7FC0D0CC957C282732D44CDEF26F71F3294B734930F62497BF17CA891A53860B7512CE79E890195CCEFEC82EB84C2978336D201FB3FA6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOptions_ = {.. HELP: "..",.. HELP_FAQ_TITLE: "..... (FAQ)",.. HELP_SUPPORT_TITLE: "..",.. HELP_EMAIL_US: "...........",.. ABOUT: "..",.. ABOUT_DESCRIPTION: "{0} ..................",.. CREATE_SAFER_PASSWORDS: "........",.. DOWNLOAD_CONFIDENTLY: ".....",.. SETTINGS_SS_OPTION_ALL: "....................",.. SETTINGS_SS_OPTION_NONE: "..............",.. SETTINGS_SS_OPTION_SS: "...................",.. SETTINGS_DEFAULT_TRUSTED_TEXT: "....... URL",.. TRUST_SITE: "....",.. DONT_TRUST: "....",.. HELP_FAQ_SECTION_ONE_HEADER: ".. {0}.",.. HELP_FAQ_SECTION_ONE_CONTENT: "{0} ..................",.. HELP_FAQ_SECTION_TWO_HEADER: "......... {0}.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3708
                                                                                                                                                                                                                                      Entropy (8bit):5.707977313474772
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Kar2MPa6uw0VE2HYP9ouKQaMF2B8KVj5YVj8nn:K8zb0VE24FfKQXF2B8an
                                                                                                                                                                                                                                      MD5:C998D198B25754E1B734C47719058DCA
                                                                                                                                                                                                                                      SHA1:A6D21DB11C10FB07584ADFF4BEC98B2CD586501D
                                                                                                                                                                                                                                      SHA-256:A49C162B23A9864D0CBCAE9583E152BEE08DE319C1F104448B7AD62A6742843B
                                                                                                                                                                                                                                      SHA-512:5A33E7FD555298A6D3296A87FA11FD894010443119CDC2CBDB53CA6B301C061207CB98D093C538E6663F384690B83E43640ECC62C167734ADB8BCDBC30250D3C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknut.m na mo.nost {0} dokon..te nastaven. programu WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Povolit roz...en.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nejste si jisti v..e uvedenou zpr.vou? Bu.te bez obav . va.e soukrom. je v.dy na.. hlavn. prioritou.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Pokra.ujte kliknut.m na mo.nost {0}. U. to skoro je!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Povolit roz...en.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "P.i p...t.m vyhled.v.n. budete po..d.ni o proveden. akce {0}, abyste dokon.ili nastaven. funkce Bezpe.n. hled.n..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Ponechat zm.ny",.... SETTINGS_OVERLAY_CONTENT: "Klikn.te na zpr.vu {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Bylo p.id.no roz...en. McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otev.ete nab.dku prohl..e.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3577
                                                                                                                                                                                                                                      Entropy (8bit):5.443266641472095
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:AqjTIrwTeQCMF0yt0nWmumEbX0B57Oye2wos/ctmwufpsdb4jHpsd9rijT26Hi1:JIsdCMYnWmnEc7FxtmwipsGpn2B
                                                                                                                                                                                                                                      MD5:641FDDA6922D624D3762022A6F436991
                                                                                                                                                                                                                                      SHA1:89034BFF6F8913C66C462F9429DA93529D900B9D
                                                                                                                                                                                                                                      SHA-256:D3B6CC6C238DFEADDDF7A010CE2DA62651E6583F0D8B2907427F686A66329C05
                                                                                                                                                                                                                                      SHA-512:0EB56197C34FA186387A20DA30C15C5A3DCCADD06A9FCDC840CBC81E2A7463BFF72D03FABAE0CC929CB5E6079190162CC024709988632F555768EC74DBB08876
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klik p. {0} for at fuldf.re konfigurationen af WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktiv.r udvidelse",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Er du i tvivl om, hvordan du skal forholde dig til ovenst.ende meddelelse? Bare rolig . dit privatliv er altid vores h.jeste prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klik p. {0} for at forts.tte. Du er n.sten f.rdig.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktiv.r udvidelse",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "N.ste gang du s.ger, bliver du bedt om f.lgende for at fuldf.re konfigurationen af sikker s.gning: {0}",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Behold .ndringer",.... SETTINGS_OVERLAY_CONTENT: "Klik p. meddelelsen {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-udvidelsen er blevet tilf.jet",.... INTRO_OVERLAY_CONTENT_1: ".bn menuen i Edge for at konfigurere Web

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3813
                                                                                                                                                                                                                                      Entropy (8bit):5.419907887207429
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:KClwI7loU8z+JpKGZVp978ACtA6YI2l46D6sITl2klcHU:KUToUfZVp978AmA6Rw46D6sIp2+v
                                                                                                                                                                                                                                      MD5:2D4368B55AEFAA1041255C5DD7C4AD9D
                                                                                                                                                                                                                                      SHA1:71CCD1C7DC2D94BCEE59F94F0E6B9083670F1E6F
                                                                                                                                                                                                                                      SHA-256:27B73E8D9D2D3B7726F6083991BA7E9696C0ECFF68DF81740A471914D2C4D51F
                                                                                                                                                                                                                                      SHA-512:5734C76EA3A58A10C33D9D0A97715DE913A5DA2D8DA4E373AC1F3B4B4588F34AA43D3662FF2F7445F2F657CECE63A20273EF54A2F96FE00F558A82C192A94A34
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klicken Sie auf {0}, um die Einrichtung von WebAdvisor abzuschlie.en.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Erweiterung aktivieren",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Sie sind sich unsicher wegen der oben angezeigten Meldung? Keine Sorge . der Schutz Ihrer Daten hat bei uns h.chste Priorit.t.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klicken Sie auf \"{0}\", um fortzufahren. Fast fertig!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Erweiterung aktivieren",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Bei Ihrer n.chsten Suche werden Sie aufgefordert, auf \"{0}\" zu klicken, um die Einrichtung von \"Sichere Suche\" abzuschlie.en.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".nderungen beibehalten",.... SETTINGS_OVERLAY_CONTENT: "Klicken Sie auf die Meldung \"{0}\".",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-Erweiterung wurde hinzugef.gt",.... INTRO_OVERLAY_CON

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5373
                                                                                                                                                                                                                                      Entropy (8bit):5.0649577064183555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:PKUYel5agUIM392dF9xVV/vT2Kc9xKU0L8:aePhFLCcQ
                                                                                                                                                                                                                                      MD5:F58476DB96526F060D24AF87AA8D13BF
                                                                                                                                                                                                                                      SHA1:B39899610A15788E123547D39A221345A0572C1F
                                                                                                                                                                                                                                      SHA-256:972CC73A0634EB70CDD0FB3995C198795208E455BC6BEE3BB95D0C2A24BA7DA2
                                                                                                                                                                                                                                      SHA-512:DB49DF900472AC57FB497DA08AB492E25E403BDAFC36B7EC744C37FDEE762D43715FA991618F974DE41AAFC37AA2B80C5ECD4E0117B1EE31E370BC932D1548D9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "..... .... ... {0} ... .. ............ .. ....... ... WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "............ .........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "... ..... ........ ... .. ........ ......; ... .......... . .. ........ ... ..... ..... . ...... ... ..............",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "..... .... ... {0} ... .. ........... ...... ..........!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "............ .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "... ....... .... ... .. ...... ........., .. ... ....... .. {0} ... .. ............ .. ....... ... .......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3473
                                                                                                                                                                                                                                      Entropy (8bit):5.4726351551459285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:hX+nTmLZpNvS6qfKmtBBiNgsbjBLNZoIJon512xyQy6ihdt7+JjlSL:FpfqfKwegw7jen2AL
                                                                                                                                                                                                                                      MD5:4FF2797578510E55ADFC08F7D06FF7BE
                                                                                                                                                                                                                                      SHA1:4A4DD7A9D239F0B7BCDA59F85C6554D6FECD2C6D
                                                                                                                                                                                                                                      SHA-256:B2D7C45978D4BD0B992F165460876119FAF769FA63AEA5B16DBCB83C1D1411B3
                                                                                                                                                                                                                                      SHA-512:DF37BC04800BCDD00F5053AFEDC0BA12E771CD3A6321447BF9622BB70E5F99DFD17FC50F0D4530B30D6CCDCE14309FAB5F689792756FFD54CBEE972A1956A140
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Click {0} to finish setting up WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Enable Extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Unsure of the message above? Don't worry &mdash; your privacy is always our top priority.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Click {0} to continue. You're almost done!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Enable Extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "The next time you search, you'll be asked to {0} to finish setting up Secure Search.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Keep changes",.... SETTINGS_OVERLAY_CONTENT: "Click the {0} message.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor extension has been added",.... INTRO_OVERLAY_CONTENT_1: "Open the Edge menu to start setting up the WebAdvisor extension.",.. INTRO_OVERLAY_CONTENT_2: "Avoid risky sites while you browse, shop, and stream with free web

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3561
                                                                                                                                                                                                                                      Entropy (8bit):5.430186150112123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:795vs3WVLAOOxYqGEsU9b5TaBl/t6/Pv5L:7LvKVk3U9tTa/E/PBL
                                                                                                                                                                                                                                      MD5:96BAE9F3B4EE2BC8CBBC849C058F1F14
                                                                                                                                                                                                                                      SHA1:D5A5C2F470C0962501FB1CCFAE259635A0B228A2
                                                                                                                                                                                                                                      SHA-256:9FEB1EEAC7386160E393CF79FE43B8730FE96D83654C2FA2C629B118FD2071E5
                                                                                                                                                                                                                                      SHA-512:12E0F999852B2BA3A71DC24D42A057A044DC449146E4C88521EE3AD4049F4FC9012424355421EAA7AA98F549420992F56C73ED4ACD4315F9F9D024FED17B2C33
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Haz clic en {0} para terminar de configurar WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Habilitar extensi.n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".No est.s seguro del mensaje de arriba? No te preocupes; tu privacidad siempre es nuestra m.xima prioridad.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Haz clic en {0} para continuar. Ya casi has acabado.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Habilitar extensi.n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La pr.xima vez que realices una b.squeda, se te pedir. que {0} para terminar de configurar la b.squeda segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conservar cambios",.... SETTINGS_OVERLAY_CONTENT: "Haz clic en el mensaje {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Se ha a.adido la extensi.n McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Abre el men. de Edge para empezar a configurar la extensi.n WebA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3447
                                                                                                                                                                                                                                      Entropy (8bit):5.4115819628021375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:78BzdBs4G8LY3WBrDACAOuN0/4L9U1m4yxO2loA5nAQ1m4M0j+wbTcO1zPOE+sQE:7qs4c3WBLAOuAd6j9bTNbOEQyNxe6x1r
                                                                                                                                                                                                                                      MD5:7E11BC255CEDBF1C432EB3209F15C29C
                                                                                                                                                                                                                                      SHA1:1071658B65CBEA324F335E43D13555BC4C6D6A2B
                                                                                                                                                                                                                                      SHA-256:F41490105FD1DF9DA3AB997C61D11303A17C3ECE3C82EA58FBDA237AC9475A5E
                                                                                                                                                                                                                                      SHA-512:01A497D4022E354C0C1E354AD1A1D93B44B15D9F124988087435FAF81B9BFBB7DEC64160D324AA66D77000FC8A36BA5DAB7FCEFC8CFAB7ABF7263C710F8559C7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Haz clic en {0} para completar la configuraci.n de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activar extensi.n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".Tienes dudas sobre el mensaje anterior? No te preocupes. Tu privacidad es nuestra prioridad.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Haz clic en {0} para continuar. .Ya casi terminas!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activar extensi.n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La pr.xima vez que realices una b.squeda, se te pedir. que {0} para que termines de configurar la b.squeda segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conservar cambios",.... SETTINGS_OVERLAY_CONTENT: "Haz clic en el mensaje {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Se agreg. la extensi.n de McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Abre el men. de Edge para comenzar a configurar la extensi.n WebAdvisor."

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3511
                                                                                                                                                                                                                                      Entropy (8bit):5.433601626158511
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:PNyeWArmSSL0jMwX/Bz7N208N2Kv7qw0qhah7ddaXETuMgPl+5UAeWjh:PMYGwvBz7Np8N7wj1ddaUi145UArh
                                                                                                                                                                                                                                      MD5:8E8E0E35935EE264DB5552EB6F40F161
                                                                                                                                                                                                                                      SHA1:6161A72F23C4E004615215A5407692CBCC6DC835
                                                                                                                                                                                                                                      SHA-256:AA6A45A74D1EE13A2729D29F0DFA36FBC3CE0EA9E70FF47A4739B01519FE146E
                                                                                                                                                                                                                                      SHA-512:AF56EC47524863339F53E910161A18CFEEB5A0D04C493950401C32B396D1E503B8183779E62593900CCF5485B88BF3E1FCB8E323D2C278CE7AB78313D35FB2F0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Napsauta {0}, jotta voit viimeistell. WebAdvisorin k.ytt..noton.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ota laajennus k.ytt..n",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Etk. ole varma yll. n.ytetyst. viestist.? Ei h.t... Tietosuojasi on meille aina t.rkeint..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Jatka napsauttamalla {0}. Melkein valmista!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ota laajennus k.ytt..n",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Seuraavalla hakukerralla n.et pyynn.n {0} Suojatun haun k.ytt..noton viimeistelemiseksi.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "S.ilyt. muutokset",.... SETTINGS_OVERLAY_CONTENT: "Napsauta viesti. {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor -laajennus on lis.tty",.... INTRO_OVERLAY_CONTENT_1: "Avaa Edge-valikko aloittaaksesi WebAdvisor-laajennuksen m..rityksen.",.. INTRO_OVERLAY_CO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3808
                                                                                                                                                                                                                                      Entropy (8bit):5.388112307347255
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:RvCshWLo4LeWU3EWP8/41QYd2WwawjOk51nBXwQw81NimwIu4W8u4kVusc82:hVt3EWPmWFwawSkpgQNYmwIHbHMc82
                                                                                                                                                                                                                                      MD5:2A9907478E1242053238088E822E10C0
                                                                                                                                                                                                                                      SHA1:377AEF681CCFA8E1F023E5B320583AE619035658
                                                                                                                                                                                                                                      SHA-256:80C75BBB67965632561D99842398EBEB84A93304C441972702A30893FA51D8C2
                                                                                                                                                                                                                                      SHA-512:A69592750C27E8825A109B4F02C3EA969111A28F2E39A21CB043A9B7882B41F16A15E7EFD5DE7DD28A7CEC26A58D32DD66242F357A922AFEA2E0F0B25BE748F3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Cliquez sur {0} pour terminer la configuration de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Vous avez des doutes sur le message ci-dessus? Ne vous inqui.tez pas. votre confidentialit. est toujours notre priorit..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Cliquez sur {0} pour continuer. Vous avez presque termin.!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prochaine fois que vous effectuez une recherche, l'action suivante vous sera demand.e pour terminer la configuration de la recherche s.curis.e.: {0}.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Maintenir les changements",.... SETTINGS_OVERLAY_CONTENT: "Cliquez sur le message {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'extension McAfee. WebAdvisor a .t. ajout.e",.... INTRO_OVERLAY_CO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3820
                                                                                                                                                                                                                                      Entropy (8bit):5.38898451160846
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:q4Hj53EWP1ww63K2z1gUYmwEF2HfuVHfuf4t:q4HywPUYZ0C2N2f4t
                                                                                                                                                                                                                                      MD5:4D0816D122C8D7796BE201654A29CED9
                                                                                                                                                                                                                                      SHA1:7CE747A827FE2746F2BCD36E090CFFFF48470400
                                                                                                                                                                                                                                      SHA-256:4232F8FC8A5F9BCF515C8AF072ECEC5518631A1BC28FD52B7EAF60F069A61B15
                                                                                                                                                                                                                                      SHA-512:4E47761CBD1C5D32AF204C72078BCEDEBAEB572563E41E195252AFCEA3C1F6C8EE51B95F943F965252FA618C53C332A5152E94B10DE95A12FF285AB8EA9B120F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Cliquez sur {0} pour terminer la configuration de WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Vous n'.tes pas s.r du message ci-dessus.? Ne vous inqui.tez pas, votre confidentialit. est toujours notre priorit..",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Cliquez sur {0} pour continuer. Vous avez presque termin..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Activer l'extension",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prochaine fois que vous effectuerez une recherche, il vous sera demand. de {0} pour terminer la configuration de la recherche s.curis.e.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Conserver les modifications",.... SETTINGS_OVERLAY_CONTENT: "Cliquez sur le message {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'extension McAfee. WebAdvisor a .t. ajout.e",.... INTRO_OVERLAY_CONTENT_1: "Ouvre

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3559
                                                                                                                                                                                                                                      Entropy (8bit):5.506605270523123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:iKtsjv9hNkY6z3qRQRMmCxgFXNNXxXlU201Ii8tT:iKev9I3oQRMmCxgFXNNXxXlv0ii8Z
                                                                                                                                                                                                                                      MD5:EF228055678709F1A3BD90D5B819A9D8
                                                                                                                                                                                                                                      SHA1:87282ADD3C89D3DB9BC631171A0BFF49A9469091
                                                                                                                                                                                                                                      SHA-256:15CD9D16120A4C1269288F77A474F265FB231EEDDBA93CFF78A14EAE42DB4751
                                                                                                                                                                                                                                      SHA-512:9885B2742A7D585F00C1E2314274593304E7B2302C540B78E460FF0416AF9446F58F533C5A25F3FE8C519F67CACCEA819DFD384B67A667D3D94AFE9F9249EFFD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite {0} kako biste dovr.ili postavljanje WebAdvisora.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Omogu.i pro.irenje",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Niste sigurni p.to zna.i gornja poruka? Ne brinite . va.a privatnost je uvijek na. glavni prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite {0} za nastavak. Skoro ste gotovi!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Omogu.i pro.irenje",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Sljede.i put kada budete pretra.ivali, od vas .e se tra.iti da {0} da zavr.ite postavljanje sigurnog pretra.ivanja.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Spremi promjene",.... SETTINGS_OVERLAY_CONTENT: "Kliknite poruku {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodano je pro.irenje McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otvorite rubni izbornik za po.etak postavljanja pro.irenja WebAdvisor.",.. INTRO_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3871
                                                                                                                                                                                                                                      Entropy (8bit):5.602009747939861
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:BjeL2klA7qs9fOpTbYFBbyN6t6rksl9EJky2twp+2mTpTChLO:x7qwmJLrksTE74l4xO
                                                                                                                                                                                                                                      MD5:40BAC50309DE29A51FBAA7C7B7614C6C
                                                                                                                                                                                                                                      SHA1:CE3C5D5EE196CC8BF4769AB3968EA9EA9CC4ED8C
                                                                                                                                                                                                                                      SHA-256:4FD642D0EC932E954F8557914F10444DA8EDBB10051F7C2FC1D8FDC86B4C2469
                                                                                                                                                                                                                                      SHA-512:706E2BBB1D753F33DFB99BAEEC961FBF75FB7D2D498421FD170EB35EB36CD4D5420338330EA072D6F8ADF6AE36BCF39D69E5B06A661A374FF944EBECBB778AC2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kattintson a(z) {0} lehet.s.gre a WebAdvisor konfigur.l.s.nak befejez.s.hez.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "B.v.tm.ny enged.lyez.se",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nem biztos a fenti .zenetet illet.en? Ne agg.djon. Szem.lyes adatainak biztons.ga a legfontosabb sz.munkra.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kattintson a(z) {0} elemre a folytat.shoz. Majdnem k.sz.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "B.v.tm.ny enged.lyez.se",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "A k.vetkez. keres.sn.l megk.rj.k, hogy fejezze be a Biztons.gos keres.s be.ll.t.s.t ({0}).",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".rizze meg a m.dos.t.sokat",.... SETTINGS_OVERLAY_CONTENT: "Kattintson a(z) {0} .zenetre.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Hozz.adta a McAfee. WebAdvisor b.v.tm.nyt",.... INTRO_OVERLAY_CONTENT_1: "Nyissa meg

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3451
                                                                                                                                                                                                                                      Entropy (8bit):5.344589816613212
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:9w0wJWteojRUyUw5Jaw5+/3Aw+ydJPwRO:9VA0jB9aK+vA+PIO
                                                                                                                                                                                                                                      MD5:81CB8D5FD3B01083E970FFA61E010E06
                                                                                                                                                                                                                                      SHA1:7C1A0B4757C1A7E1F82CCDE8B2513B74F6D10979
                                                                                                                                                                                                                                      SHA-256:F787775A89A6092C23121166B69FBFBB35EF04F91EAB29D7A93747205CCC7193
                                                                                                                                                                                                                                      SHA-512:6FC1CD91819BD1CAB549FB566C8F1C70EF0A781B8B2FA749E2826B0A08089B8BF830ABD730B9497B7743759BA7C3D839E47E0181E559FADFA669DE5B49007579
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Fai clic su {0} per completare la configurazione di WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Attiva l'estensione",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Hai dubbi sul messaggio mostrato sopra? Non ti preoccupare: la tua privacy . sempre la nostra priorit. assoluta.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Fai clic su {0} per continuare. Ci sei quasi.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Attiva l'estensione",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "La prossima volta che effettuerai una ricerca ti verr. chiesto di {0} per completare la configurazione di Ricerca sicura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Mantieni i cambiamenti",.... SETTINGS_OVERLAY_CONTENT: "Fai clic sul messaggio {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "L'estensione McAfee. WebAdvisor . stata aggiunta",.... INTRO_OVERLAY_CONTENT_1: "Apri il menu di Edge per iniziare a configurare

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4710
                                                                                                                                                                                                                                      Entropy (8bit):5.642394532687395
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5mF9hGIitPqUUJnILJn90N3l3QLzb3Nl3CprHEwPbbDiabGdtiDR9hGml:5mF9hC91nQmLzTNoprH1b3JbctiDR9hN
                                                                                                                                                                                                                                      MD5:40EC496FF3B16AD5D9B49BC61E349777
                                                                                                                                                                                                                                      SHA1:F5A0A04E3BCA25870820FFDC0D2A2ACDA3650BA4
                                                                                                                                                                                                                                      SHA-256:20DA1F1E6EE95B6CDE92E243247E07BE6D8601D222C3C6320D1779FF066709E4
                                                                                                                                                                                                                                      SHA-512:E69A56ECD4EC4A52A27C0E9FFA2C1BD2FA207403F56FDC78E6EC2249EACECE0F9B51EFF49AC6DE104B6A4F86E11D936510A46F0BC38E9E7FB1CAAE10D6473743
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "[{0}] ..............................",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "..............................................................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "[{0}] ..................",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: ".........[{0}] ........... ........................",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".......",.... SETTINGS_OVERLAY_CONTENT: "......{0}.......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3733
                                                                                                                                                                                                                                      Entropy (8bit):5.887951192706537
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:QYCvdMrjNB9ZGI4BGSS1FdMUB2dgSG36cBJsg57AB2vCC1vyqtYIvdC3DFx:36ynuBGpFyUBkYBJsmcB2ZGQMTf
                                                                                                                                                                                                                                      MD5:78C0E3B8EF89855CF74D9735B05EB2D2
                                                                                                                                                                                                                                      SHA1:D5EC54DA3090870B487F2A4D4BBC49AB337706D9
                                                                                                                                                                                                                                      SHA-256:32AE924A8C54D177D67A8F608E0AED8D0817607BD3959E65FF22DA5EC9D26DEE
                                                                                                                                                                                                                                      SHA-512:D4A1D29B2AF6034769C8424FAEE186FE23AF89BEF591A49E94AACCFCE17711AFF29D7BFAA8CEE80F0868BA48DAA3A4195456C0829073639F0B66573B48537086
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "{0}.(.) .... ...... ... .......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: ".. ..",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: ".. .... .... ......? .... ..... ... .. ... .. ... ... ......",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "..... {0}.(.) ....... .. ........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: ".. ..",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "... ... . {0}.(.) .... .. .. ... ..... .... ......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: ".. .. ..",.... SETTINGS_OVERLAY_CONTENT: "{0} .... .......",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. ...... ... .......",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3225
                                                                                                                                                                                                                                      Entropy (8bit):5.455750009049743
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Kx63r03o9AwnQ5deXavDKYw7unkf56lQepfbVdqwqkMpHCxdnlpZ9R0lpZ9OCZ+J:JQjwncYXavDKvukfwlPpu1pHSTpJMpG/
                                                                                                                                                                                                                                      MD5:F29423841931CA660FD7D4F41B1DBD41
                                                                                                                                                                                                                                      SHA1:075ACD28B596AEE1BB36C27C475532D588D873E0
                                                                                                                                                                                                                                      SHA-256:5FBF41C522DF5051E20EE0B349F807DD0DA5C7B6691F03EB3A45D330FAAEFFC6
                                                                                                                                                                                                                                      SHA-512:327A8F8B5D4BFE052C77B244DC7CE363ABF7ADB11DC4A7D635EFEC670A6DAF0D61338C3636EC81DCB08FFB7C758635374E9F72FE1228E80EA52C9FA04EBD5B87
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klikk {0} for . avslutte oppsettet av WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktiver utvidelse",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Usikker p. meldingen over? Ta det helt med ro; ditt personvern er alltid v.r topp prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klikk {0} for . fortsette. Du er ferdig om et .yeblikk!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktiver utvidelse",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Neste gang du s.ker, vil du bli spurt om . {0} for . gj.re ferdig oppsettet av Sikkert s.k.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Behold endringer",.... SETTINGS_OVERLAY_CONTENT: "Klikk p. meldingen {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-utvidelsen er lagt til",.... INTRO_OVERLAY_CONTENT_1: ".pne Edge-menyen for . starte oppsettet av WebAdvisor-utvidelsen.",.. INTRO_OVERLAY_CONTENT_2: "Unng. risikofylt

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3315
                                                                                                                                                                                                                                      Entropy (8bit):5.385121666693169
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:hYNSUmrH9+LhVyH81/nxxM3P7zLFSOXYNXwBxrcB5w7qTF951eUq5j6YUNGUlG5h:qWoM81/3czLFLYNa4BO7qTB38/am
                                                                                                                                                                                                                                      MD5:6C112DCBFD4D10CB62944825EE3F19AE
                                                                                                                                                                                                                                      SHA1:D9E9A299492AF4264520EBFBD623B75E8FBEF83A
                                                                                                                                                                                                                                      SHA-256:8482F69E601E8547B0C2799F2ACD759E2FAD1F03BC37AD9918EF4706CB3E13AC
                                                                                                                                                                                                                                      SHA-512:246841E4873F6C068831425CFB16F014E5D9CB5FCFAA97020590929CEE1A0FE526602CC9409548791B78844DC8ADBF92B5A34D801B2BEAC1DAE4E5F93EECEEF4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klik op {0} om het instellen van WebAdvisor af te ronden.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Extensie inschakelen",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Twijfelt u over bovenstaand bericht? Geen zorgen: uw privacy is altijd onze topprioriteit.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klik op {0} om door te gaan. U bent bijna klaar!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Extensie inschakelen",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "De volgende keer dat u zoekt, wordt u gevraagd om {0} om het instellen van Beveiligd zoeken te voltooien.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Wijzigingen behouden",.... SETTINGS_OVERLAY_CONTENT: "Klik op het bericht {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-extensie is toegevoegd",.... INTRO_OVERLAY_CONTENT_1: "Open het Edge-menu om de WebAdvisor-extensie in te stellen.",.. INTRO_OVERLAY_CONTENT_2: "Vermijd risi

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3592
                                                                                                                                                                                                                                      Entropy (8bit):5.645829178436089
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:UMCvtaaOZWKfNNz9KqIbQUZW9TRNcWRlP+im+oS+oGIUwI0qUEob:UMC1aaOIxbQUI9TRpR95mhShnUB0qUD
                                                                                                                                                                                                                                      MD5:F5DC1F073659EB263F74C6CABE5C59FE
                                                                                                                                                                                                                                      SHA1:65C510E3B8DBA4EB52F1A82FF0A9561DDFFAEB09
                                                                                                                                                                                                                                      SHA-256:6E745822ADA8BA9D207CCCCF16D03CDC60E2AE3C5457F32B23AB860D804CB1DC
                                                                                                                                                                                                                                      SHA-512:C1E9553B112FA3F1F52A2A37710D8A175F0179EDF2E9F4C257A61860941A3F8CF52AAEEF11D1811B2478F28747C227B996AECC53A779D38A98F556451EB39DB3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknij przycisk {0} aby zako.czy. konfiguracj. funkcji WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "W..cz rozszerzenie",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Nie masz pewno.ci co do powy.szego komunikatu? Nie martw si. . Twoja prywatno.. to dla nas zawsze priorytet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknij przycisk {0}, aby kontynuowa.. Ju. prawie gotowe!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "W..cz rozszerzenie",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Przy nast.pnym wyszukiwaniu pojawi si. monit o u.ycie opcji {0}, aby doko.czy. konfiguracj. Bezpiecznego wyszukiwania.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Zachowaj zmiany",.... SETTINGS_OVERLAY_CONTENT: "Kliknij komunikat {0}",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodano rozszerzenie McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otw.rz menu przegl.darki Edge, aby zacz..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3368
                                                                                                                                                                                                                                      Entropy (8bit):5.413930768580624
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:tjbF/wH+Rr2fvbIvn/UL1KcIdlOd0/a6Xge+wbkQYlH1SQakQE1JsV+RUkjHFEi:tBRKXbIv/U8cc0dGvgObgbIc1JS+RUkt
                                                                                                                                                                                                                                      MD5:AD0B1C286A1EDCFCD76D7241DE966872
                                                                                                                                                                                                                                      SHA1:5824DAE43BC89A4AC9F007A860799274D89E9E94
                                                                                                                                                                                                                                      SHA-256:D33C8D9261F6590ED4C805B0D436E243D50D64FF6603FC89CB341E0D2BEF774B
                                                                                                                                                                                                                                      SHA-512:28562E30998965297D5069153F26C7A8FE37AD093305B66A041FBE23E23C37387ED17411A5D8CF3BBC81A758626FF8E06BF20C9D5E3D2C3E61520B9062589754
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Clique em {0} para terminar de configurar o WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "N.o entendeu a mensagem acima? N.o se preocupe . sua privacidade . sempre nossa prioridade.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Clique em {0} para continuar. Est. quase terminando!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Na pr.xima vez em que pesquisar, ser. pedido que voc. {0} para terminar de configurar a pesquisa segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Manter altera..es",.... SETTINGS_OVERLAY_CONTENT: "Clique na mensagem {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "A extens.o McAfee. WebAdvisor foi adicionada",.... INTRO_OVERLAY_CONTENT_1: "Abra o menu do Edge para come.ar a configurar a extens.o do WebAdvisor.",.. INTRO_OVERLAY_CONTE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3444
                                                                                                                                                                                                                                      Entropy (8bit):5.411633748019912
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:tjpqgDOioBH+uVr2fAFn/Ua15v+IX6RE70OHXd1aVrTwbX1ZH1ppxRXpxjJsJJSF:tcgHxIKIF/UyvFz7d+J0b5H3JgJSgnD6
                                                                                                                                                                                                                                      MD5:3A244FC91A287F70C3F88FA38DDA09DD
                                                                                                                                                                                                                                      SHA1:6E551D5A950EF3945A24BE7303CDB0C5F0A9FFBC
                                                                                                                                                                                                                                      SHA-256:934C199C26A23EFBF3572A5683C7BA0333F4536371A39F77724F3F561E6641A2
                                                                                                                                                                                                                                      SHA-512:7AA916F066D4D8C3BDC2B762DCF27A50DCF3D7CB177CDCA5C0DF90F6F9A22E65FA6934465E1670E9D541CAD48E8D15A0E41E70CC8273C8154205096364A0243D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Clique em {0} para terminar de configurar o WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "N.o tem a certeza sobre a mensagem abaixo? N.o se preocupe: a sua privacidade . a nossa m.xima prioridade.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Clique em {0} para continuar. Est. quase!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Ativar extens.o",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Na pr.xima vez que pesquisar, ser. pedido {0} para terminar a configura..o da pesquisa segura.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Manter altera..es",.... SETTINGS_OVERLAY_CONTENT: "Clique na mensagem de {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "A extens.o do McAfee. WebAdvisor foi adicionada",.... INTRO_OVERLAY_CONTENT_1: "Abra o menu do Edge para come.ar a configurar a extens.o do WebAdvisor.",.. INTRO_OVERLAY_CONTE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4888
                                                                                                                                                                                                                                      Entropy (8bit):5.135844832512529
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:km1cmOcoujLEUXirQfZVaSy/lcv8xv0pv6eyH5Z6LX6L0YA5ANvPuYV1kwgkebOl:bSP52Z7Iqv8IvzSt/vPuYV9gkbEYZM+J
                                                                                                                                                                                                                                      MD5:0D167E87D451A21855ED70CD6B314563
                                                                                                                                                                                                                                      SHA1:FCFCE95C861428B47CBD17E7A39778249EE1DA32
                                                                                                                                                                                                                                      SHA-256:6161E0CD535C80C8073B09EEA04E41EC393C3CD4C3E225578BFA3C8CC8896EDF
                                                                                                                                                                                                                                      SHA-512:F222578C1672F4E8D9BA94A60A555020A269F632674F7C5559CD98DD43D9DB18E505A3EDF645500C92B42E4EFAFFDA2E678E811136DAD8CD76CCB1C7B8C8D5CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "....... {0}, ..... ......... ......... WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "........ ..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "............ . ......... ....? .. ............, .... .................. ... ... ....... ......",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "....... {0}, ..... ........... ..... ......!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "........ ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: ".. ..... .......... ...... ... ..... .......... {0}, ..... ......... ......... ........... .......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "......... .........",.... SETTINGS_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3645
                                                                                                                                                                                                                                      Entropy (8bit):5.650230217070017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Za1q+c5nLPgGcp7rGEaqHNGXaGWSnEBCkt:Za1CcGcpPGEaoNGXaGWSnEBCkt
                                                                                                                                                                                                                                      MD5:ED72D7708B2D551ED68DF78FCF5B2E2A
                                                                                                                                                                                                                                      SHA1:C8C79F33E82B0D6F6A16ACA582B28589DE10481D
                                                                                                                                                                                                                                      SHA-256:49C1E8B45304E35C6B0D3040CEC7829C2433524044CB5C0F6D1210A40F1D8296
                                                                                                                                                                                                                                      SHA-512:5389733E068655B2CCF7838CFF8F024BCD8E9BB4408E87FFC44832371C77D386EEFE916E5040DCD3B75CF292B6B11C2E68943A1C35492E5A56D9BF41B7729548
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite na mo.nos. {0} a.dokon.ite nastavenie slu.by WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Zapn.. roz..renie",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Neviete, .o znamen. uveden. spr.va? Nemus.te sa b.., va.e s.kromie je na.ou prioritou.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite na mo.nos. {0} a pokra.ujte. U. to skoro m.te.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Zapn.. roz..renie",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Pri .al.om vyh.ad.van. sa zobraz. v.zva {0}, aby ste dokon.ili nastavenie funkcie Zabezpe.en. vyh.ad.vanie.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Ponecha. zmeny",.... SETTINGS_OVERLAY_CONTENT: "Kliknite na spr.vu {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Roz..renie McAfee. WebAdvisor bolo pridan.",.... INTRO_OVERLAY_CONTENT_1: "Otvorte ponuku Edge a spustite nastavenie roz..renia We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3448
                                                                                                                                                                                                                                      Entropy (8bit):5.521041895588274
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:bOKu5rhXVaOiD7jvSrPKPq/BhedVJDBDKOTV08Eyj8GmS4kSOhi7ICcX7E0o7X7g:CKwa7ruIwBho7Pjxm+FhiJcrERrEzt7
                                                                                                                                                                                                                                      MD5:C40105ED737E2E633DDC19ED6756E72C
                                                                                                                                                                                                                                      SHA1:2BC63BEFCE326D84CD609DBA90933BC24BC59BD9
                                                                                                                                                                                                                                      SHA-256:317A85AEFB469859C880AD999CEA9AD20C4F5BF5BDCE71850514F68D509EA173
                                                                                                                                                                                                                                      SHA-512:638A4399388CE8826997851587EA92C324687E1363FAC661A37CDCF9494235C9860CED7B0A7D5E9B25A2FE2AC47BECA7CEAE7043FB67B1B6124BD0E0554C5424
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Kliknite na {0} da biste zavr.ili pode.avanje WebAdvisor-a.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Omogu.i ekstenziju",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Niste sigurni u gornju poruku? Ne brinite . va.a privatnost je uvek na. glavni prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Kliknite na {0} da biste nastavili. Skoro ste gotovi!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Omogu.i ekstenziju",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Slede.i put kada budete pretra.ivali, od vas c.e biti zatra.eno da {0} da zavr.ite pode.avanje bezbedne pretrage.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Zadr.i promene",.... SETTINGS_OVERLAY_CONTENT: "Kliknite na poruku {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "Dodata je ekstenzija McAfee. WebAdvisor",.... INTRO_OVERLAY_CONTENT_1: "Otvorite rubni meni da biste zapo.eli pode.avanje ekstenzije WebAdvisor.",.. INTRO_O

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3419
                                                                                                                                                                                                                                      Entropy (8bit):5.521805415367657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:XLtr87bPTBKfvmX6L9AvAMbEFGt9M+WRRZJ1aq3CTCc2Qp:btkPdKfvLLGS3ND4
                                                                                                                                                                                                                                      MD5:AEC72920D1F5DA0AF85610AB2DAC461C
                                                                                                                                                                                                                                      SHA1:E613864613EEF534F45B6E5D3EDAB660E38D0216
                                                                                                                                                                                                                                      SHA-256:CE4290DA708FE5AA55607D16FE05389AE21EB1A8733A76ABA87D5FE5FB63CF65
                                                                                                                                                                                                                                      SHA-512:F413D67ABBDB88BB2813037608E0F9DA0C3A0C650E839674A7B6AA92707B658965839051AF469F5DF7B9F394531BD3987F7A36A534EF3A1CF929F3165A755D17
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Klicka p. {0} f.r att slutf.ra konfigurationen av WebAdvisor.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Aktivera till.gg",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Os.ker p. ovanst.ende meddelande? Oroa dig inte . din integritet .r alltid v.r h.gsta prioritet.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Klicka p. {0} f.r att forts.tta. Det .r n.stan klart!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Aktivera till.gg",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Du blir tillfr.gad att {0} f.r att slutf.ra konfigurationen av s.ker s.kning n.sta g.ng du s.ker.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "Beh.ll .ndringar",.... SETTINGS_OVERLAY_CONTENT: "Klicka p. meddelandet {0}.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor-till.gget har lagts till",.... INTRO_OVERLAY_CONTENT_1: ".ppna Edge-menyn f.r att b.rja konfigurera WebAdvisor-till.gget.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3505
                                                                                                                                                                                                                                      Entropy (8bit):5.554744362519657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:8gTrSRlazqTSoc8T4mq+pxP3yfK2XsCzjW3A/O20qVw:LMTSzUtCBwYw
                                                                                                                                                                                                                                      MD5:A7173B3EAD43A8D5301C7A5442CB3D3B
                                                                                                                                                                                                                                      SHA1:C83DC50C27DCDCC99CCC0E12C4FF259AE524BE05
                                                                                                                                                                                                                                      SHA-256:71F31DE21EFE9CFEC913EB2EEC52894A2412FBBFE741C20480D3DD045332EC45
                                                                                                                                                                                                                                      SHA-512:26D3D574348AA21BBF8B27CC5AE2F5A98310717BED45FCEA3B26695BDA2CCB1288E5A57EE536737E6E660B3B72D8AE664C98C9D2AE8FF1F53AD350AA5B961BBD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "Web Advisor kurulumunu tamamlamak i.in {0} ..esine t.klay.n.",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "Eklentiyi etkinle.tir",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "Yukar.daki mesajdan emin de.il misiniz? Merak etmeyin . gizlili.iniz her zaman birinci .nceli.imizdir.",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "Devam etmek i.in {0} ..esine t.klay.n. Neredeyse bitti!",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "Eklentiyi etkinle.tir",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "Bir daha arama yapt...n.zda, G.venli Arama kurulumunu tamamlamak i.in {0} i.lemi istenecek.",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "De.i.iklikleri koru",.... SETTINGS_OVERLAY_CONTENT: "{0} mesaj.na t.klay.n.",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "McAfee. WebAdvisor eklentisi eklendi",.... INTRO_OVERLAY_CONTENT_1: "WebAdvisor eklentisinin kurulumuna ba.lamak i.in Edge men.s.n. a.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3122
                                                                                                                                                                                                                                      Entropy (8bit):6.220541310459122
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:6UrfcU6lnW9tyEQeLJrcwfrZaq0KSVnUUJfQpro06zK:6UrkF0t2excYzSVnUU9KrwK
                                                                                                                                                                                                                                      MD5:CF9BA9622517F9642078F3C01CE61CF5
                                                                                                                                                                                                                                      SHA1:0261D3DBFE5A723017EDD9BC015C925163A13A81
                                                                                                                                                                                                                                      SHA-256:12C661C5C1F8EAE585C6D743B05BDA9096B0475CC41E9DB26387F21B4398FAED
                                                                                                                                                                                                                                      SHA-512:DA0C00FFAAF4350CB8D061C5BE33563309EDC46BD2D619BB3C6588741C559F2F9D425E8E8FA3795DC9BA7377484124F6665389CEE137DAC48E93BEA171587E50
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: ".. {0} ..........",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "...............................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: ".. {0} .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "............. {0} ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "....",.... SETTINGS_OVERLAY_CONTENT: ".. {0} ...",.. SETTINGS_OVERLAY_CONTENT_BOLDED: ".... ...........",.... INTRO_OVERLAY_CONTENT_1: ".. Edge ................",.. INTRO_OVERLAY_CONTENT_2: "..........................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3232
                                                                                                                                                                                                                                      Entropy (8bit):6.286798640112844
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Fnm6KjBr0E5eC+WKA4DKoYwWAV85brkeUwmxm3VBpRBpG2m6teF6h:JbM5dtKPDVfeZrkRwGm1pDbc8h
                                                                                                                                                                                                                                      MD5:E45EB827E5EBE243FBE994E91B00399C
                                                                                                                                                                                                                                      SHA1:39C4882C2737426D927E0A91B58413B0C1B6AA23
                                                                                                                                                                                                                                      SHA-256:E9517A04120C77F9EB73BACE215C3808FA7B6549F450033B36A1504BFE4F5CE5
                                                                                                                                                                                                                                      SHA-512:656A920AD1A7F4AE9C6C33E981180D14A9CFD365BC05CD70439AF80E394D3C983A76BCA3A427E85DAEA0CA326FF22029571AA36CBA026EB60F75122252B6E613
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrOverlay_ = {.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1: "... [{0}] ... WebAdvisor ...",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_WA_CONTENT_2: "...............................",.... ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1: "... [{0}] .........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_1_BOLDED: "......",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2: "............... [{0}] ..........",.. ENABLE_EXTENSION_OVERLAY_SS_CONTENT_2_BOLDED: "....",.... SETTINGS_OVERLAY_CONTENT: "... [{0}] ...",.. SETTINGS_OVERLAY_CONTENT_BOLDED: "... McAfee. WebAdvisor ....",.... INTRO_OVERLAY_CONTENT_1: ".. Edge ........ WebAdvisor .....",.. INTRO_OVERLAY_CONTENT_2: "...............McAfee .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.461291185013134
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRtWqUZMRPathM:pCPR+2cyeBmNEfSU8ZpoXSHaUiqnM
                                                                                                                                                                                                                                      MD5:F851EFACADD835F0159C27502E46260E
                                                                                                                                                                                                                                      SHA1:7E1B2F3B44C06237A23F1F6950FA63625839B1A6
                                                                                                                                                                                                                                      SHA-256:B6E414FAEDA10946F1BCA79E27739A197877A5193F51CB81F79D7BB7A7A26380
                                                                                                                                                                                                                                      SHA-512:BADF5CA6616D26C07BF15DABB11E7C28E3AD486F6A2E7B99DDEBEDD6269350A254E68355B7FAD3EC0153D508F3F46B52049D6CDB475E4200F8FB3A943DFF810F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//B6D270D887AA3AD5A716125ABA1EDAE8704F8734590ABD1A024EE56C72C6BA0F86EFE3A4FE091821DB0AED95400E3719260E47A0DC599B133FCE7EBCDCAAD691++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.479172348957691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHxyeddu2SyiZ9JyV+n:CRsyeBmWfV8ZSXSH0udu2diZ9k+
                                                                                                                                                                                                                                      MD5:1FCA4C01F8025426FE58612F4A712595
                                                                                                                                                                                                                                      SHA1:FEA75A5DB7E98D7B5863F85C0DFEF471FE35A2D9
                                                                                                                                                                                                                                      SHA-256:37A443BB771B6D206407A38CCBC1B114E829906A633EE288EFEFAB0682DA935A
                                                                                                                                                                                                                                      SHA-512:374CE0D0ACE099A1876DAFA83067E77DF026C09028724AAE77146737EF189543EBC9DA3BB66498F8306664160FE59F8FFB595141320D182D9FCF5AF24ECFF068
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//1E5A015257B1E89E81798BF6D2E3C4A434BE9A2D7E0F18D3C9D155D88F81C1A2D522F1A1057164E1E3C6D931AD0B4F9568D58F2470359B0891D6EB9E54C06CEF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.467402670832129
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSH7U+RRumknxVkZh:CRsyeBmWfV8ZSXSH7jRq+
                                                                                                                                                                                                                                      MD5:D4F64363675C08E40A55A3E90E8779A9
                                                                                                                                                                                                                                      SHA1:C85521A5853390431138734CFA4024372DD36BB0
                                                                                                                                                                                                                                      SHA-256:A77027313030396B803CD1E878906C47E228B8C6577F842AFCE4329DCA552DCA
                                                                                                                                                                                                                                      SHA-512:8C7D7AF0B4C607954F075E847DBE6BA5DE83FCD89E5971AAA0F383BC49BD42D4FBD9A5E33F40B8F1370A139E7813005DD461311327F4F0FE5D786BBFE416BFDC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//A768A71BCF302D4AE04575F430739FC849AF8A0EE437B3E56AEA24A3CB35EAC2EFCDFBCADA202B5D1E443C8E4F5F4D8B035E18CFD270F630D69629E19DAAB96B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.493127774604479
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHkeoGGa47JO:CRsyeBmWfV8ZSXSH7kDJO
                                                                                                                                                                                                                                      MD5:81C0A897F9D758D3F8508D35AC8D0CE1
                                                                                                                                                                                                                                      SHA1:AFD7BB0517C3DD740FBD87E04C47BA8AE6F262EF
                                                                                                                                                                                                                                      SHA-256:D642AEA76257013253505BC48C3C6BA3029A9DAA42292ABFF901DE9D5C7679E1
                                                                                                                                                                                                                                      SHA-512:01CD3E88228C524E78FC2B52749A6BF516E7411C21A0B94DA48E04E4774C70CAD4FBEACDA4ED8DC00F0E576E330E8229232ECFF25FEBBB32DE2B220771823063
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//30CA9B7D87A866D6ACF206633528D83777C8C261CFFF709F4BAB1D556E8A5FE950710B284ED167754C4B3B534DD6495B9D751FAE2EC09EC726FC4FE952315FF3++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.477918177313886
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRUkMSSjV6k2lM:pCPR+2cyeBmNEfSU8ZpoXSH3CInvNbv
                                                                                                                                                                                                                                      MD5:F53232A30B3582FE393A7F51BACF7EED
                                                                                                                                                                                                                                      SHA1:C7F04EFE60CE3D2673F322A452096A1138D24B5F
                                                                                                                                                                                                                                      SHA-256:831DDEC9F2C80E790E83C7063E6DF4569A93CD6DD5AECFC9BC1A514323F98CE1
                                                                                                                                                                                                                                      SHA-512:1FF633B6856C976049D5A2C75EF351BDD2D253B086593500806AA902E82A7C1006AEB641BB8676472950A3BB5689889F60BF5D98A848D0BDF8023C0508AA3067
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//56F5ADEEA067779F1F4B795C3714785F4871D247CFEFCF94546CD930F722CE4ECB62AEA8F0FB794583A709D6F8470C225AD053CD2ED296CD0E68F1FE980A041A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.4696829929288535
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRYD/isdshUJka:pCPR+2cyeBmNEfSU8ZpoXSHJ/XwuUO
                                                                                                                                                                                                                                      MD5:50516C839C5D8C56B88334466DD09F32
                                                                                                                                                                                                                                      SHA1:76306EED0A669FBB689D7C803B6D0F85DDF13554
                                                                                                                                                                                                                                      SHA-256:2B8FB2EF47F8302F5A2652B3D1F80C86D2A6892A32C5F0C752F02F6CCCB67525
                                                                                                                                                                                                                                      SHA-512:A5C4672D1F3D58F71F0BD253EAE17C016823417130DDEFC13EF8C14435046EAD959C4493E31685C96E3C5C7BDA81CD7D504C82000AB58BC896B2C90D179302EA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//FC3B951EC08DE164EC585A90C03639912CFA49E7AE71315B7CD6ACA0C7584560171A1584EC9A877909747B125AA2A4A4A22088A0DE2B4FA0DB225AC3AF716174++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.488376987322762
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHYS5WIJGc9ewt:CRsyeBmWfV8ZSXSHY2R42
                                                                                                                                                                                                                                      MD5:89D6C9EEB638D8DEC4E835C939FF3B7D
                                                                                                                                                                                                                                      SHA1:AC02A0B6523DB68BDC58C6156FAA33E1E4BD441E
                                                                                                                                                                                                                                      SHA-256:819A842BA403DB89F473B3626281EA2240F768DC852C22D8BFE71054C2EB5207
                                                                                                                                                                                                                                      SHA-512:27D0F0FBCBA05B9ECDCD2AA3B085755AF9332FB3998CC4E972AC95ABA6E38CB9DFB913AE7082534D30F65EB77AD2786A3485AC09C0E22E1D5F12DDAD99830329
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//D62EA0242B20D1B039933FB3E7DB642656900A575505A164BA8B93B072083A508D1D6C14255F5F3A53B1FA2191170E9E7E0A092B76819B06DA021764DFDE29E0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.492911726228479
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHWfrVl8iB/CD:CRsyeBmWfV8ZSXSHWzVlRBKD
                                                                                                                                                                                                                                      MD5:0E82D31FA650A5FB79C67093AC1F50F1
                                                                                                                                                                                                                                      SHA1:E10FAA42C905057FA474C7C4FD2F22BE22F46C85
                                                                                                                                                                                                                                      SHA-256:68BD2756ADD7789903BEEE1E7D6069D713F636018E1509326DB3B25D6858C210
                                                                                                                                                                                                                                      SHA-512:C6DDA3BD37AFA5B2731449A0652344429EB531234E8FB195614D5ECEFA4E77AEF1705908E042AF169C8B38E71915411863B9CCE50E58D9A87E8C3D274EC1977E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//6F23615C6288FC2645FF22F027EBDE5A0262899B13926A50F69E7EE5C72552CB974C8586A970DA7267BC7313FE74F8B13CAD43399A6C1C0F3AB57CF28B0419F8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.463857822769162
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHCWEk4UpdB4hs:CRsyeBmWfV8ZSXSHyk4Pi
                                                                                                                                                                                                                                      MD5:3792DE93D44D6289EE5388349D729607
                                                                                                                                                                                                                                      SHA1:815BCB52DAA7E4FDC98F1FBD8F2E3D9A8B14E4A0
                                                                                                                                                                                                                                      SHA-256:800B0417BA5C8A3DB3A243CB9254D44C0EEA953B2F544E9AF201E462C4D5AE6B
                                                                                                                                                                                                                                      SHA-512:757E13905E249BF36BC0A743B7D4A728C54633644D6E198E3231DC728A3A1A3D507AAF2EBE40C3B09794759AE458C9A3DFF5E202D528BC79B9201B230CC66641
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//66ACA5C20E972445DEB27AF18C4AE3193E49262ED3E8E38568BED15D740EBB7199AB389DCA190C46B90952420A7ADF9668DD413858E917C1247D59EE4645D18E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.48254289768309
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHVS3BImvNOMXc:CRsyeBmWfV8ZSXSHVS3BBO1
                                                                                                                                                                                                                                      MD5:45B28CDACC34949350960E06F6C98856
                                                                                                                                                                                                                                      SHA1:638E59990FA4D70D1207779F0F57A7BE018A41BA
                                                                                                                                                                                                                                      SHA-256:998ECB94CF0A065D2702BC62543989C6B23E01EC0832759481FF9E58FC43842E
                                                                                                                                                                                                                                      SHA-512:709B224AE50FD9BC0C576EC180A5D6E850DFB951E36FD9DA9519E02B0897C9BD69D367E88B561A4DAB09C8850D4038EA29F0D090328D352F7AC5E0DEE90B87FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//2C75E9CD1849B054F7046B2BA198CFDCA4D8426C5942E99E344F5FF6C8D7575BE7177A0784F986BD9D7AAF4C9008D37E3F00382CF31AA93A421F6E74A76C99EA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.492610578011585
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSH5dijZHHXtmRhuG:CRsyeBmWfV8ZSXSH5dijFM2G
                                                                                                                                                                                                                                      MD5:5ECF99BF16BC4898A39B78775C1FFAC0
                                                                                                                                                                                                                                      SHA1:059256EB40024CB0F06F9D56694A4F37AC17FDC1
                                                                                                                                                                                                                                      SHA-256:6F186379B072E3FBA8F5018F4D8F59E825458BA9BC24E24CEAEC698E6954A310
                                                                                                                                                                                                                                      SHA-512:F4EEFF34EA782407FF3AFF56790215A1934251C27CB7B883DC3D41DC5EE5748E619F7C6C7DABA770FD2F07D9AD4867EA432D6D14EF7BEB70E907D01691D0385C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//49685C4BB3F61FD03BA56D994F3EC5F2CC9121877FAE2D7BDBCB22B6DD8AFAD9044F714B954B8C514773CFA9EC14088B70A32E4848D0068742D4287630D04129++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.483922645463424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHDGXUexD6Au6Wg8nod:CRsyeBmWfV8ZSXSHDG0ARDei
                                                                                                                                                                                                                                      MD5:BD9412EDEF442D466606CF0B60C95546
                                                                                                                                                                                                                                      SHA1:52C820E3E8B2DBCD15F2364CDAAD53B96C04C737
                                                                                                                                                                                                                                      SHA-256:D61E9DAC65BE83C197C9BECFC913AF79399BFD22BB99E4506FE0CF5352F480E6
                                                                                                                                                                                                                                      SHA-512:3ED79C9183EE0C82A51DF473F15CBDD2B7DA471CBBE362F4F952F000BC725E653693C04A7592AF8161E3B97C7E6990AD2FF32275D7EDAF3589ED99FB5D9D697C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//48BB32968381D536094FBD15C9BC0F445BAD1EC06932E03B9FAC004CECAB4D2C274FE216AD06848EF648388BB3E3C88945725C85AD572227E165DF0327AEDDBF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.462293227116516
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHTmX6eNHRUo:CRsyeBmWfV8ZSXSHThU3
                                                                                                                                                                                                                                      MD5:2DBC44F9BA34A2EDA3880E0BF39A6761
                                                                                                                                                                                                                                      SHA1:10E34E1921DDE19718DC1D067097C5978E93D591
                                                                                                                                                                                                                                      SHA-256:D5313B63C8EAAED4251B5EEE3B9CF53ACA2F2C13B74C59F5B0CE94DF8D59E951
                                                                                                                                                                                                                                      SHA-512:BA1355D632C77BD096D2C9BAF01A9CB2E7DAC45058AD6842F162E640B2C9CB4320E2067C14BF1B6B50C9E7F479EFEF3A0E44F0710CB50D445DE5B9D791E81CCA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//F615E347B1727ABEE77E3FECDC21542A4266928977DE9E0AC792E34B2F9F6356BD5BDA4E8B7F279BF4367093893E959D4C9CA5C4A1E575798BC6ED267AFF8FB5++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.4717096752512004
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHY1ycmkhujWuic4sk:CRsyeBmWfV8ZSXSHY1yfWZc4sk
                                                                                                                                                                                                                                      MD5:4FB4D752F6A57E650535D6B1B9455D36
                                                                                                                                                                                                                                      SHA1:0BEA700966FD703B9B7FB0B4D5ADD214A92D16E2
                                                                                                                                                                                                                                      SHA-256:3F9DE6A678A9989FAE457B7F0066F9B9C46E32AD5E601B9A7BA30D2DCE7D8F83
                                                                                                                                                                                                                                      SHA-512:65B196A6DE0043A870C0AEE1CDCAE30C24A7BAF061677701CC3D7A2B501F0A41E5EBEB99D99D6DA6D4DFC59B38B4C5CE35F9360082F339BB9E323C60AD5EB677
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//8F40F7704B250A1D68472AFC4D67F7AF67C5FBCAF8A1CED37A9DC11B47A3C365A842CAF16345BEE2F5EF1A9DFEF5AA727360091DC4DB8AB68AA35278C3FC6D69++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.470472064074934
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRqLt57ltuUPKO:pCPR+2cyeBmNEfSU8ZpoXSHfZ5pt1T
                                                                                                                                                                                                                                      MD5:406861BD0494D46A7EB20B1821BF9529
                                                                                                                                                                                                                                      SHA1:2E039788D392FC5C59CFEC1DD21B936786CF4879
                                                                                                                                                                                                                                      SHA-256:3A3B6FE9F0BEBC41B0DD70DF811EAB2B9AFCBDD51BBB695B47BBD7BE2EB31764
                                                                                                                                                                                                                                      SHA-512:A483CFEA51109056671531905D8F4DB171C532A9943D7201670BE63A4335099016E94A0852FF246D72652DD8543092DE269B25735A548881CDFE1BF18B952CF7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//5615DB4C31FAC25E55E2C92098E555AE4B7061328BF7AD23D759202E333AA3BFEB62F9923E4F25EAB259CA520FDA4AAF17DB707C92885DD1B93D9FA968A42B89++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.471730030790368
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRjehgnQqSZ2Os:pCPR+2cyeBmNEfSU8ZpoXSHxaPSQOG/
                                                                                                                                                                                                                                      MD5:217B843ECEE12A8C67A35D06AE99D2BB
                                                                                                                                                                                                                                      SHA1:445CB8CF2BF965DBBC18854FCF0AF2B740F76174
                                                                                                                                                                                                                                      SHA-256:FF122073C8E58111616B91A39E0DFA616C11408020605D1EA1C4CA746A2455B5
                                                                                                                                                                                                                                      SHA-512:0F915C5B06493A1BF46477A81E2EAFD65B69F34CFFFB2F9CD4CB8568AF3823EFD763761B25161870DF933FF15CF87818DD940B53CD11FF60FF97DE73883DE9DA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//9F72E0FB3B27749E6171AB885A21CC3C51D315CEBAA1B5157799CF0351F1C6EA3BD3D3F8C3C7458015D97CBC9601D95A3E9666A6734491A59D96B9C2A7967328++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.473708421161808
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHFbn3bPwdWW:CRsyeBmWfV8ZSXSHlUUW
                                                                                                                                                                                                                                      MD5:098CBD8DC5053578AEF341E2A2618FDD
                                                                                                                                                                                                                                      SHA1:232EA126694E06A0A68B5A38D7CBA8FF4ECB735E
                                                                                                                                                                                                                                      SHA-256:2647296C825B78036CC30648CF4E0F744BBA48468C2419975DF762EF7A9DE156
                                                                                                                                                                                                                                      SHA-512:A3192EBAB170488774F7265F11EC78A5928CBD8366524B2222EF036396047DCBA0BF36063D33B9EC7EDFF5AF2766A15901338FEFE8A0F7A93B01B5D24A8EFCCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//48520D268612E1E85074EE09C4566105ACFA0CA6F7764818BA367FDBCE7BEAA36FC2E35712790E774372EFD3B16D68FA5C15129825CEF83A0C3A0CCB5AA81137++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.486840278540761
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHA/e6v8OghdW72dn:CRsyeBmWfV8ZSXSH4s02d
                                                                                                                                                                                                                                      MD5:4418B667658DE1FF93D1EE5BF84AB4CB
                                                                                                                                                                                                                                      SHA1:8006390A89FFECF5A04185E01117CF116CC4084F
                                                                                                                                                                                                                                      SHA-256:157541CA02923211F6915A94E86AFF5340F02A735CB068853076951717771ABA
                                                                                                                                                                                                                                      SHA-512:2C63B40F93E0C3B3777DB300CFC32ADF3DFEA436653D3A992996E8C4F5033C900B3B5552343D4AB9DDD9EDC18F0F59CF35524E9D36293D5554525A87410FA1DB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//69AC2955206173C9E6CD2A8F70BAA855A43DC3792BBD95D7909E2DAD326FC72502801B829F72955CB49087F4B7555E11729F138DF26BAA2510DD45F0AA8C43CA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.480021267330034
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeReTGqLTR4Cy7/:pCPR+2cyeBmNEfSU8ZpoXSHt9g/BDSr2
                                                                                                                                                                                                                                      MD5:CF885578AC4828AC6503BE7CA214D099
                                                                                                                                                                                                                                      SHA1:2179AB4273E58D95432D61E8C0FF883FEA763341
                                                                                                                                                                                                                                      SHA-256:D319043C24707408EB251BEC915BC7FF9FB94CE6561902152901C94DB926FF9E
                                                                                                                                                                                                                                      SHA-512:E96EE54453DCEF06E60F65B3C83504347C442C6E2C07145A35A520646C7611077B61FDDDA955D0CCBA1E6597878201EE98064516162A89482BE3D4944E13C5CC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//57A55861E6606D90F01FF3B35EF82FB0776244C8B5269BF22BDAEA80BE6AC265A27F3B6B5E5E258204D4A4A309B21BD7E004A72AF5E78C9AFB938C8ACF917ACE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.45181985428985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeR7LsMgjNY/h57:pCPR+2cyeBmNEfSU8ZpoXSHUsUr4vcn
                                                                                                                                                                                                                                      MD5:A7002E78FB59661750716B1AE19F1542
                                                                                                                                                                                                                                      SHA1:116BA5FC50FF76F83810858BEBD37BBFD3AD2DC0
                                                                                                                                                                                                                                      SHA-256:B08EE5B9D582D6223ACEEACB844732AFBF54E63C9226A8053087612DDB99BC94
                                                                                                                                                                                                                                      SHA-512:CB8D31CB53F2B948DD5815B333983B9980CCFD84CFAFC2645BADD520012624C90EFE899A7F7493557433FDF5715E5F4C54B29A8DCB2E8D0A4E130C9F20A82360
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//5DC51EAE8CBB5ECD51389CD91E8D116549D85E5CDC71133CE016EE2503A7D1B893A3CB2420FBF2548D9A8E09B7EDBE1963394BF6F6BC10B1FA8CADE14A4F8B97++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.484908383820972
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSH94UWHCeE3kw8l:CRsyeBmWfV8ZSXSHb9yl
                                                                                                                                                                                                                                      MD5:524596E2C7887EB48B2A1D8381E178AC
                                                                                                                                                                                                                                      SHA1:A7F1B1D2BEF2F9157D246DBCBAF1CA822D96201E
                                                                                                                                                                                                                                      SHA-256:7C0921E02303A4E770F15B5E456226CA1EE1DC690DAC0BD2FA8C914F55CF5E00
                                                                                                                                                                                                                                      SHA-512:22BD56A890E043CEDA054953CC96C05EA7041FEB7D8CF1484EC7BB242DCF96D5ACB273611841FA6EF8779D6379F68272CEFF3D6D49D527B88B866F2D29350866
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//EBEFF53261003409B2AAD56ADA2ABEA17103D60E9FE81FB2622FCE1BD74551F2A2FD4BA059874501C4D6E1F0597A32288394124A831FCB22694213CF9508AEEC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.503387774821352
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHXHj2nTbdRndO:CRsyeBmWfV8ZSXSHYR4
                                                                                                                                                                                                                                      MD5:7542D76C7D92823EFD4A4D611D147DE0
                                                                                                                                                                                                                                      SHA1:F5F4D5D39CC20E7E1A3FC1E7954EB80C62E305F5
                                                                                                                                                                                                                                      SHA-256:65F0A36F452344AD682CFE5BAEDE152E951EF837A7E649F973CBA5E49FCDBF19
                                                                                                                                                                                                                                      SHA-512:9F0EC700C0D339EAA810F5666723E79E2D0F74D89DB1A69B28AED41F8F856E977ECFC00AE8819241E0D82D2B06B8795C562C6A43CE114FADF4A2A44E91601F1E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//7C28FE4000A0DD98AB49410E7CF66DFFF445600629F76C9FA879D002303BA2F2F99C1282EC810614F2B369BFFA768B28558958AB0AEE495141236331D98730BF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.446185744151203
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHF5+zKlsa3O:CRsyeBmWfV8ZSXSHFFd+
                                                                                                                                                                                                                                      MD5:A6306FB31C84DAE0F03C9777BBA5970B
                                                                                                                                                                                                                                      SHA1:3AA6341E7E6CFBE232F28EFA9D67EA49F7CDCF70
                                                                                                                                                                                                                                      SHA-256:FAF7AC098A5D6F800E29D1413905BE616116A04ACA2784B6803BBBBA1C685026
                                                                                                                                                                                                                                      SHA-512:8797EA6BBD307F40257A5C5558F9E722DE27D78B38AEB0DA6B170BBEA10756F6CEFF06DEB5DB8086E3E05A09E18B00BA6BF647FB5541D0581B142712C0649B62
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//BD16C4EC7684CE8B3C31A50ED26A308128ECDCE00C2E2A87676212B09890862C031D3E848000FE97BE69B803DAD0B1CB82CD12CF4DF2D9DAC4962C93B41B1513++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.480376341970164
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeR+EHYXVXpXqAZ:pCPR+2cyeBmNEfSU8ZpoXSH0eGHDy
                                                                                                                                                                                                                                      MD5:0750287F76B0ABB7CA178C1EAEC0CC37
                                                                                                                                                                                                                                      SHA1:318882F530AEA3CA0D1C8264BE9F46356CF703D4
                                                                                                                                                                                                                                      SHA-256:3D093DC768311B7B70CFCF649A9A56CC6D1D73086606CE768AA326B82F5B15D5
                                                                                                                                                                                                                                      SHA-512:A9F4CF06E64245E9675BEC32F2848C97D2EC9EAB5F0162AA98E6426D1F36DE611CEBA88AADF01ADD564B3BEFF828A273A2750DC2AFD7520A5654E0209BDCDDF1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//100F0D7283DA156A62F5A202AB2960D43AA1C8DE03264EEFB9E2D20D77173C0D2F57EF33AC87459BBAED309FE7A931356CEC78A1F356BC193EE96117E55B4080++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.492091669465854
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHETkyvbV8cpoh:CRsyeBmWfV8ZSXSHET3DV8cmh
                                                                                                                                                                                                                                      MD5:15943C6CEB8CB108FFBE93FF4436326F
                                                                                                                                                                                                                                      SHA1:FD8E5148FE8B981077D95CDB86443A4BE00767BE
                                                                                                                                                                                                                                      SHA-256:E67C68A06890305DA1582D0CCC7306152CFBD60865F8265C4D0389B804679E0B
                                                                                                                                                                                                                                      SHA-512:7D618EB1B0B32A68A9F5A6AE7CA9A7FF4B6742BB53CC97A3FD1C5219FBB6160150936AB7D01099229984C9D7AA87A172389ACE28BF306041BFD15B382BAA0E03
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//3694E86E6C27B14695ADFEE4FD14BCBA7443F183719540185DC90D2A71E189F32938D016ABDB1F5906721179D862E70673FB9FEFA1D6E7AB60D38518BA77468D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.4636786816405465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qwBMgWkWKs5RR+2cKQzGJC8WKskeGedmLpEfSvc8GNKpoXb2JpeRfdFd+niNSVdv:pCPR+2cyeBmNEfSU8ZpoXSHB33XEubcY
                                                                                                                                                                                                                                      MD5:C3DABCD27D52EC4A729E584603E253BA
                                                                                                                                                                                                                                      SHA1:A183FCC0420C0A28107FBC19AE3D7EEA79C92AD3
                                                                                                                                                                                                                                      SHA-256:31FC3CCEEE0FC6229059BFF65181ECB837DFB648401752693582472DA7DC6B76
                                                                                                                                                                                                                                      SHA-512:F9797082009CBE7C4435017732CD09C5AEC332C830F88A1F82A5993E37A79B3F2CEC788BA38AD0FFE9B60D97841646A20E408A7E1A2AB27E4510BB26F429A2D2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//7E6F2D8C2787AB7089CEDC3A4E307C8B98B1D1265962DC587C1B625E81F9AFF9E0B41EB189ED3250DF1E88803A3BF57A5FA2E0A7AD862B9CE38F368CCBC70FAF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                                      Entropy (8bit):5.481160883204284
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pCPR+2cyeBmNEfSU8ZpoXSHoK+bSZpuQnsD:CRsyeBmWfV8ZSXSHoKcQsD
                                                                                                                                                                                                                                      MD5:C0C47BE6026E0BE8981068918F1A5340
                                                                                                                                                                                                                                      SHA1:F32C8E44E91303DC0FDF7EA745B0AFF7A616F6D8
                                                                                                                                                                                                                                      SHA-256:89C322DF5DA53A2E6226E35342C316F56AEC2A0138F531C7A45D89E48092DFB5
                                                                                                                                                                                                                                      SHA-512:96FAE08FE16A463AE89CC2200BCACE9A9289DD015E96B61BE5D6D9035ACDD60BFB4DECA2A0C3805674DAB572B5CA6FEBEEA35B8515749CC217F6DF838C45F1F9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _pscoreToast_ = {.. PSCORE_TOAST_DESC_HEADER: "Get to know your Protection Score",.. PSCORE_TOAST_DESC_BODY: "Your protection score helps you monitor your overall digital health and safety.",.. PSCORE_BUTTON_ACCEPT: "Get started",.. PSCORE_BUTTON_DECLINE: "Not now",..}..//128B8A91DA30B9760EDD2C072F99B5D6EC64F1BAE2AE7AEAA88541342DE1E44541F607D67F4ADFA2C57A36CFC00885219DC4B8BB6241F99813EC551721AAF7CA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):716
                                                                                                                                                                                                                                      Entropy (8bit):5.607011971536562
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfx6v9LuO4biqra6fMocbkLwT5zxjAHo8+9wuRTouifdRnMA2ndBN:7e9SlNLiaf4v9KO4zG6fMocWIOHo8+9z
                                                                                                                                                                                                                                      MD5:DB5296C11A4E1E23249BFBA40CE350D8
                                                                                                                                                                                                                                      SHA1:85C35D7E41A25D99378F2814874547D87010913F
                                                                                                                                                                                                                                      SHA-256:957F3FFE17A9069F4750CD36096BD997349B53A1952A67D5C1F9FD6B5851EEF2
                                                                                                                                                                                                                                      SHA-512:2D143620D9B37B28EE8F16FEBA6F422C3B4765D7D22976C941609BA283AD6636B4306C7D0E32ADF7595B7B01E0CE86F29FDF452EA6739483ACE1EF206809D77F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81042082CF7CB241A3443F862EE0EECFC8376F5C371C52B28F8DEA321E42D8840BC343D8FABC64A697B28E43C4C1C1BFA5EC01A85A0790B68226181A356241BD++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):728
                                                                                                                                                                                                                                      Entropy (8bit):5.532507354590994
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bikzbkLwT5zxjAHo8wN9wuRTo36ClngbD3CXh:7e9SlNLiafLYFv9KO4dWIOHo8wN9ZROf
                                                                                                                                                                                                                                      MD5:7B935965B36524190BD312B61B43A078
                                                                                                                                                                                                                                      SHA1:52C05B0B95461D1B80543AA032422F91BA6BC72B
                                                                                                                                                                                                                                      SHA-256:3C137CDC865081F47A2F8062CE7B9A3F951F992F236B974582589CD8014A8AAF
                                                                                                                                                                                                                                      SHA-512:2EB7186ACFC3570FA08F39225B4198616547627CFFDAB9D47A58A25FF9FEFD8EC68AEE886622983E404E87C918024888DC39FF1C94B0BA7499ADFF08864C356D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3E820E543090689D74FF63DE8AEDAAE21AE9AB8C7D697AED71A8150A8BAE9004FC3F4C908202E74DEBAF28611421437720982EFDCC7CB2A2BA103910200151AA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):695
                                                                                                                                                                                                                                      Entropy (8bit):5.523104478615486
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+p3ibkLwT5zxjAHo8+N9wuRTo4SruEFqcgZwh:7e9SlNLiafLYFv9KO4pSWIOHo8+N9ZR4
                                                                                                                                                                                                                                      MD5:40ACF45F141BA18E03507C2082902777
                                                                                                                                                                                                                                      SHA1:DAB8213D3E5FFF5838D1CB873E65784B635DE966
                                                                                                                                                                                                                                      SHA-256:CD252FEECF3EE19E9C849783C416E9B782BFD3D681C658FB1464DABFCB839019
                                                                                                                                                                                                                                      SHA-512:189881E6F381CA9F6392C7B9DBD302C119158997C1B6D9E23E9D2EB375FA54FD453DE6515E073A59F6AFC14132571B4C3ECE176DA75B9244A1CD5224D6348A99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//49321CFEBE589D1646EB716015DFBDDDBC5CB3611EF0CC5F0E546054368EF7FFF2A13B5AF228BB9481A39AE66C23F091EECA5628AEFC29837E2DAA08BDF0F01A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):750
                                                                                                                                                                                                                                      Entropy (8bit):5.752183544639771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kft6v9LuO4bi7XKfRWkGmbkLwT5zxjAHo8JP9wuRToElNyhV3eEX2:7e9SlNLiafEv9KO4mXCWkHWIOHo8JP9h
                                                                                                                                                                                                                                      MD5:25AC661CB1DA437FE20306E83B1F0752
                                                                                                                                                                                                                                      SHA1:44E4613D0C73D7A51F4C649022AD3117E4ABFD7A
                                                                                                                                                                                                                                      SHA-256:262AC8842829AFEEACDF6F83AF411381669D507CD3D60A51BA200C9F13385F28
                                                                                                                                                                                                                                      SHA-512:B8B8C5DA963A5EE2A0357C45B70A8DE1465135A8764BF8251CEA65A8F56568796C663116F2EF58B91192F538D17937CFB9A83C580247CC74E172B94A35EECB9B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA3959D20712220C1EE8D6030BFEABD0FE618A56739AEB295AA1FDD7536506322ED0BDF68CE43EF03EB8900FAD16939DE7E65016BB3BC3B1C54618D07E1FC9D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):688
                                                                                                                                                                                                                                      Entropy (8bit):5.5142215205780944
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4biqkCbkLwT5zxjmT9wuRToXk7YVbFXyREIa:7e9SlNLiafLYFv9KO4zkCWIoT9ZRekU9
                                                                                                                                                                                                                                      MD5:5B28705E4840EF14D1893BE363B803BD
                                                                                                                                                                                                                                      SHA1:10BF34AF49949E96B94A2A0E013BB156683B4D3E
                                                                                                                                                                                                                                      SHA-256:4E0D93048BB7F2995CCB68C151BDBD5D8589948F81DE2280502831DE03DCE62D
                                                                                                                                                                                                                                      SHA-512:FE75224A87BE247C7114BB049ED25F55F427F1CDBDBBD685366F036E8891B270214F77958A6D8A905B66DEC529129C644321E5125A1C5317099DA2C780A8A4B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//4880C596D977ADDC5F6D3DE47F016E24850A8A25B6B56EC102FB57BE17EF30F108D9A49AE7BFD248E08C2CE6AE5D4B173F602DEC34B0926DFA5EB9F879CC09F1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.532615699841096
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToroabkmwYn:7e9SlNLiafrFv9KO40gnWIqgV9ZR5En
                                                                                                                                                                                                                                      MD5:8E6F1DCBF2BBDD4812FA4F2DAB9C43A8
                                                                                                                                                                                                                                      SHA1:180B797F99229214046DCB1C5BC9F2D646A75E13
                                                                                                                                                                                                                                      SHA-256:D2BE5B199291B5BAB255A83AE6B0AA82D0EFE0E0DECF8937DB521C6708DCB980
                                                                                                                                                                                                                                      SHA-512:5C4373EAD81032E51B69798A250890B9A2FBC9A63D26749A72CEB93B7F43682BF883BC1C10F273C92DA13996DD466130AD28803E42A78DD5BE0FD3B3B05FCBA8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//7AA804C15F6975C084E7F423A39B1C4D1E061F52EE01933A21C16015FB0611C02DE575E939968EAE27B083C0DD9A5D7D263C3CC462F91B26A3EF4321880F1C8F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.522511534706463
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToTZ/xVUhxkeGdnEV9F:7e9SlNLiafrFv9KO40gnWIqgV9ZRK3Vw
                                                                                                                                                                                                                                      MD5:98EFE7D3B444951AFDCB0ACBB730C25E
                                                                                                                                                                                                                                      SHA1:EC3799399BA47D27AEAC09EB21B7E18714E1B2E7
                                                                                                                                                                                                                                      SHA-256:10252291B3535DBCB63E84374010830ED20530C03A4E25B2A499120FB356FAAF
                                                                                                                                                                                                                                      SHA-512:89CC94F506B6F0DCE08A037EC0ACA6821A2DBF258A2043AFA4D2884B14A21540F0467CA01E0B7909D38FE16997A034E50CCC04D9BA8BECDE2616143448128D69
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D230E1F1A500DB032A710473C3AECDA773F053E1419B3DA43B5CF22F51D59DF2B34B096545A072A09360F6AE735D8607C07EBE0C97AA8BF78D6E1D3083E3556B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):692
                                                                                                                                                                                                                                      Entropy (8bit):5.533689253513386
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfft6v9LuO4biu6gbkLwT5zxjAHo88WN9wuRToGKheR22I6n:7e9SlNLiafsv9KO4RWIOHo8Z9ZRLEA2A
                                                                                                                                                                                                                                      MD5:D0C17F7AE5C3DA9BE7BC96245E9D0F5E
                                                                                                                                                                                                                                      SHA1:9BF2CDBA16C3CCCCD7A2E069086342333B573D0D
                                                                                                                                                                                                                                      SHA-256:DCD5D47D3477438074B190ED1E00A72ACF74401354646F02CF00A1A77205D317
                                                                                                                                                                                                                                      SHA-512:48C3C0647EABF13366E919EFB7E7A24B520917098852C49DEEA36CF430A8879C2225A2997C4F8B75A1F86CE3E5C0BEC68E714BD6D1DF2B6FA8B767FD16820DEE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BC956D6A6A53E1F7AAD19F3D631FEF940A670FD790C7DEB3A241CABBBF67E2083B495DBB95B04F2262B036B552D8A56A0044921BF062E1DD666173CB9843DB94++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710
                                                                                                                                                                                                                                      Entropy (8bit):5.55151240094457
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRToEkhTpm8n:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRSz
                                                                                                                                                                                                                                      MD5:BC4A141B5CBC453B3F05FE63DF0BA5B3
                                                                                                                                                                                                                                      SHA1:0855321761C9A7035A8798FC211F597B2BCD24CC
                                                                                                                                                                                                                                      SHA-256:6C373DF185597E9B942D5738D1077919AF981DBEAE5A2DB69F7D06BB58137EC1
                                                                                                                                                                                                                                      SHA-512:85AF7B1CDD91DA5F1BBAD996866C42B6EFB2D8A35A52799F85C025361C211AA2BC40B1869CEE7A50EC9A24FC3B8862A58A290258D741018AB6E5B350541CE0B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//0F0F9CFDACF5B41C6C177531339BE320FAFEF6A800775EC347D5D488EFA8F8317B5DE20B713422F1FBFDC13EC57F67B1CC08B1A30C59525F06DEC2E0D56A5668++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710
                                                                                                                                                                                                                                      Entropy (8bit):5.530208948535214
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRToc3PJYs5aA:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRnf
                                                                                                                                                                                                                                      MD5:C44E59985A55311E7F6BAA87EF993B98
                                                                                                                                                                                                                                      SHA1:12134E8C69120B2FBC8AF82E1BE8183DB5BB898E
                                                                                                                                                                                                                                      SHA-256:32E9956A1AB7DFDC54EB77B1FFFCDADD2DFEC0CA5B4D38F2A5B950A79F5D062D
                                                                                                                                                                                                                                      SHA-512:2ADCC224B551C403FF00FC21311FF9D842027FB2BEDE9F64B66F08A128D561517721CE3C72BC5B8F38D70E7FF526C911BB99BEC23021DC5589B80BF7DF2203B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//998ED52278AF698342457AFEF2ABFC43EB8E1CA85C5511CF6E5DEEC26B18184BDA7A567652CA7982A1162D16F248961F2D98D598A2792DAA948A5069C85CE9A3++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):703
                                                                                                                                                                                                                                      Entropy (8bit):5.518105253351284
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biaBzcbkLwT5zxjHT9wuRTo9g3Zlw:7e9SlNLiaflv9KO43BoWIVT9ZRdPw
                                                                                                                                                                                                                                      MD5:DC378106F4DEAEC0CABD0F5E88A515AC
                                                                                                                                                                                                                                      SHA1:F67E647DD898830A46A8B6480D8806E2A73917BF
                                                                                                                                                                                                                                      SHA-256:CCE7D0C8F783F6D14436AEFC89B8879A4700AE8BC1DC5912D0B9C2EBF365A0A3
                                                                                                                                                                                                                                      SHA-512:39DD91FE9AFBCC7D4D31134315360D595A83A845799C256147A71B94A08696FDAF383867CD51961950821D75CCD4748EFD0D844AC6F9568038AC8649D235C4C1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A493FBFB5AE3EC66777ECF1DB2BA30F9F1F4A6E6DFCBAC4EDA0DA7443D2DC28F3CCF659841F3F6446712C6D8D47AC143ED02C8A4EAC11C700573E2C920ABF9C2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                                                      Entropy (8bit):5.599467220659489
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfQdU6v9LuO4bihIHmdcbkLwT5zxjAHo8Kwv9wuRTo4dzeBXMPjZS:7e9SlNLiafQd7v9KO4k6ocWIOHo8Kwvo
                                                                                                                                                                                                                                      MD5:04D4B5B205C463AD95BD36318E6714AE
                                                                                                                                                                                                                                      SHA1:8F2D5223224D0DB4445D37B29F624DB2C56BA0E8
                                                                                                                                                                                                                                      SHA-256:6C47EA4147DB11C121F90CB9456CCB273AB45B7D3BF291F795DE4D99CA8DA668
                                                                                                                                                                                                                                      SHA-512:DEF6234A83BC211AE3CA539A282400869A8FFF95ABCDB90C2F31436D0A27EA2BBA26A0094089196C8F1C173E52FA6A1AD1C50E369148DE4908C07BF4433AB738
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CD9F5CF6CBBBA54C3F23A659D3912D647862A87F5273FB0E2DBFF22941D2BE434F1A6538BE7A4CD09D28EF385A95B92D9C48A687DBE1B013FBAA731521673633++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):697
                                                                                                                                                                                                                                      Entropy (8bit):5.539019069592982
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfy6v9LuO4biNkbkLwT5zxjm79wuRToCaP1QsZzXt7lP8:7e9SlNLiafVv9KO4akWIo79ZRBYasZdm
                                                                                                                                                                                                                                      MD5:66DA2DC63D6A3925D48F40AEB602D502
                                                                                                                                                                                                                                      SHA1:A53F5FA1B97FC7CAFFAEDFF3E3FD7B8C0725D2A7
                                                                                                                                                                                                                                      SHA-256:1638AB11E485CA57AEC94F987B5B0CA7B9D0B8B09CD7B80A36FD3DCF0BC3F55A
                                                                                                                                                                                                                                      SHA-512:13766D0071C8B96FA222645026C7BBDF78D1C629C0C5A7FE7796A3F05384C652B36602D792A8C9106E90C1B0623DC11AEB7BFBE4DDBBDDBB1BFC7AB409B474CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//01F59DD33A54B1B634D2DAD086EB337D2F51F8692DD0CF7F590351097B7C81BBFA9106E0E29D53425605E0B0A607D8C11B05FFF8CABBAA10DA77B6B84C1D138E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):808
                                                                                                                                                                                                                                      Entropy (8bit):5.738433406660423
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7e9fLdo5ijdfA6Dlv9o4A2AWIOHo8UHv9ZRenKLs:K9fLdICdfA49XLAWIOfUHFqms
                                                                                                                                                                                                                                      MD5:AE48A5FF7596694A4FD1AB26F50B00E3
                                                                                                                                                                                                                                      SHA1:702780AC40822B2ADD3139E0B7B123834CA4B487
                                                                                                                                                                                                                                      SHA-256:6DF0DEA4086371AD6A3F1DAFA584FD2531F0229DFC518396AA3434F3DFEFF7A6
                                                                                                                                                                                                                                      SHA-512:DC188AD001508C0BAD665E7AD9886551283E5B16BC590FCD5B14373401ADB137119C93FFA68C69B939E1989D6861449A4C200D7BDACDD97BAD82190B51BC272D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1C4184071F95F14CF00EEBD3AB4A7D7995B06EC7F97188DFFC294ECA8E75AF545331449C57697749715F92FE166E2E4AE3D22882960F462CE6F6996A1E75D592++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):742
                                                                                                                                                                                                                                      Entropy (8bit):5.822041209914263
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSd6ds63i7R6ikfV/i6v9kc4biyGbkLwT5zxjsGiFW9wuRToQciKdyhQyVSTrF:7e9Ed13isnfVtv9kc4sWIViQ9ZR8yQDl
                                                                                                                                                                                                                                      MD5:DC7B76F9DE7F35276C2143C5EB102EBF
                                                                                                                                                                                                                                      SHA1:8D2AB5544CCB298761AD43B3644041023B758BDD
                                                                                                                                                                                                                                      SHA-256:B7AF107F96B56FC6FCBC642A0A6F94F0ACF0352A2FC8D6A30B0DC4F7A78F3576
                                                                                                                                                                                                                                      SHA-512:B231589775366E1B6B4D12497F321E9A93D2C8DF0C5CC1BBCBA1012CE8BD4429FEFA91BE68EEC9C797649FA2A14FA7DA8342F23023EA4B17C6F6F1B194EF7BFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//AAFA73BEEF104F5ADBF69569B45268191B8C4082876E870E1484D98FA17AC8F7275EE9083D7D9FBE552E3144770D5820AE3AA2B0FCC2E732A3BA80B338CE1904++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):696
                                                                                                                                                                                                                                      Entropy (8bit):5.563291933943177
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf3Hi6v9LuO4biqyNLMBHbkLwT5zxjmf9wuRToSdP3oynrr:7e9SlNLiaf3Fv9KO4zyNsHWIof9ZRZ3v
                                                                                                                                                                                                                                      MD5:DD4688CB4523EE561CA94C2DA49E335A
                                                                                                                                                                                                                                      SHA1:8047EC0B501FA264F945957C0E362310B1CE66E7
                                                                                                                                                                                                                                      SHA-256:3F1E1DD5CE540E4DC4C06313851F35FFD1D7DFB27961059FD32947F2D8661F05
                                                                                                                                                                                                                                      SHA-512:9FF8C8392F336D7291574542505A8175693CA1534D4BA26977F1817E261727FF5CBBC31788A23735E7617950F06DBA20EAEACA563399A492EA155E48B60CD191
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//9E9A1473D0E14AFD79647DE49EBDB6500B342965F5C3E5F660CA5BE56755AB544CE8034283771B76E169B8FCC0E95742C6CAD1E238FC2211EB505CF6BC884601++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):746
                                                                                                                                                                                                                                      Entropy (8bit):5.6087546952598295
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfP6v9LuO4biqLEnbkLAWB2CT5zxjAHo8CW9AWB2CuRTo4r/0Wp:7e9SlNLiafyv9KO4zLEnWtB26OHo8CWo
                                                                                                                                                                                                                                      MD5:12B1FCF468BEEA23810C5E29E00955A3
                                                                                                                                                                                                                                      SHA1:1C5829EDEBAB9768FA20308DE723FB452A09BD2D
                                                                                                                                                                                                                                      SHA-256:F214DF27C228AF7545300A18535433501C730B035A46E5F9C5B6D8EA134ED3E1
                                                                                                                                                                                                                                      SHA-512:8309B74B03D8D2E5F55ABA411DA06B604B74586438CF13CEF59A92E07C0EC9D5B389420B73CB98558ACD0B3266311E861CFAE71D63ADAEE639A128872461BEFF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//CB6340B4EFECAB3E71CB08FD5C0F4C5285E77639F0E2D8361F3498F4A47F78E2FAAB43BD5148673AB645AC0AC3E22C9D3110834DD0FE917B44E73BE905B94BD7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):709
                                                                                                                                                                                                                                      Entropy (8bit):5.547492619756502
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf6v66v9LuO4bipidGGnbkLwT5zxjmO9wuRToozzFT2bGG:7e9SlNLiaf6vtv9KO4oMGGnWIoO9ZRkH
                                                                                                                                                                                                                                      MD5:8826C3D661F02DF18E529EE006C0074E
                                                                                                                                                                                                                                      SHA1:3B34EB20315AC50282146A4204D3EBB1BAB9E5A2
                                                                                                                                                                                                                                      SHA-256:AADC501672DFC69A1443DB6DF6E7E265105AD0D35E2970A0BE0B581934EBFBA8
                                                                                                                                                                                                                                      SHA-512:8299A48AA7B13FB6CC757FE0D01FC33073218FCE89E0AEE014A5550FA8EB0DA43295E9B81113E523CBAB26531CDEE98EC65D7D3E3FE9742A640651381E2D934D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//17FDDA361C160E1D310873ACC18B2A0ADD5102010B762EB776BD100F17C46301160D84E653EC76428F9ED2C2B81B441B716B90800DF6CCCA3ACA5D867D193D60++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.538511894040431
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmHbkLwT5zxjAHo8kf9wuRTo1AMvVqghkK2a:7e9SlNLiafBv9KO40HWIOHo8K9ZRqA3w
                                                                                                                                                                                                                                      MD5:FDE3D3EA8FE84835283B9B56430EC29E
                                                                                                                                                                                                                                      SHA1:1264DCF81224D50E00668F2AB05954205445704F
                                                                                                                                                                                                                                      SHA-256:F320951C0B9E57DDF7A910E0B94F4125B15320C8656CAE832DA0D1DAC46604E3
                                                                                                                                                                                                                                      SHA-512:1DEE807E2BEBFDCB144421FD9CE53EF5CC26352CDC29E784498727C6966F92CDBFAFEE0E9584F25361ABA2726AB656FEAB3FC8D7A65348AA939D1BC1A398E0BD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B6B6A9911A08317B36CCB25A27F2A509E5FE6E73002120AD1BED572BE9D87A7CFDBA2607ECB9E5023860C494E0F4F0708E84CEEF8BFDA4F07F53491FD9BFBEBF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):700
                                                                                                                                                                                                                                      Entropy (8bit):5.537523162423459
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmuybkLwT5zxjmkf9wuRToc79Bz72b:7e9SlNLiafBv9KO40nWIoK9ZRHpBz72b
                                                                                                                                                                                                                                      MD5:14C56FFA20920CCDE1B19B733CB85FAB
                                                                                                                                                                                                                                      SHA1:474AC88709CE4B55BB54137F467949B09CD147EB
                                                                                                                                                                                                                                      SHA-256:9E00583D89A3A1C5717D2D1659E4AB128F86AD0801B2B3BA5F85F3CF7BF170C2
                                                                                                                                                                                                                                      SHA-512:EEF3A6C625083AFE5261ED7659B63E59D793228B7A07F791833EFCAD699F239D0C3B60BEAB2C65F194AEBF4019B16086E6D81D429DF42A96294FA15ADB83E0AB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//D630EF6834C2DF4F454AAD8AC93FCDBEA26EF7FBE1396FC5E95D2ED564E46E5A122BBC1943EB4F39BC54CD5FCC0768C696B62861C1259FF82F57120574CAC80A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):751
                                                                                                                                                                                                                                      Entropy (8bit):5.762905150784842
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kf96v9LuO4biq0epiXbkLwT5zxjhKgE9wuRToJ2UwvOlBtORchW:7e9SlNLiafUv9KO4zrWWISt9ZRfvOlDo
                                                                                                                                                                                                                                      MD5:D37EE749862FB89C64AC60108D7DFBF9
                                                                                                                                                                                                                                      SHA1:20647A50F8807D09819EEF6C2CD29230882373B1
                                                                                                                                                                                                                                      SHA-256:9F3AA8EBCDD309AFDDAE08C5331CFF223DCCDB026BBB20618A09AB84C26789C8
                                                                                                                                                                                                                                      SHA-512:F0FA804CC1DDAC94CD15B5414A12B89F97E6997B02E14337C0DEA619F5D83AAE3F78456DCAECC896E79B8DAB1074F8EDC9CC3041AC863DC55658F65B753EDFDE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//1BBCF622DFC15CFEB9A52B5F5D981C8B8413EDAEA7B714254A99AFC82C962439630225D096E319595DC777402B74CF57B39402B61FB4A77DAF7FA0278366CFF5++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):719
                                                                                                                                                                                                                                      Entropy (8bit):5.608359372203038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfa6v9LuO4biIAbkLwT5zxjAHo8+9wuRTo97tJVLLjpPhv:7e9SlNLiafNv9KO4uWIOHo8+9ZRY7jVr
                                                                                                                                                                                                                                      MD5:039A4B97702E56DDDD98E64526364190
                                                                                                                                                                                                                                      SHA1:39FE5D4FAA2B83D9F7930D5EF64711BCAD9E4830
                                                                                                                                                                                                                                      SHA-256:FB4283F741112BFA20A09C4693585AEF9521D2A7D70D66440030D957DF819DAC
                                                                                                                                                                                                                                      SHA-512:C8403E82680B6FE1E2FF9FA14969ACD4C33AE3CBF2D6C1291AAD10A10B63B4F35D6BA7F7D7614DF1C481E300564EF39FAA39D9D079DF4F6FFB9F6A99304A609F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E574C8953368BE6E9E4E2131834E332BB1EF2B469C106EA92F119638AB8BD08E79E61753671722021A4AA0BDCFA111B5319B3EAEA44DBCEA84E4DDFB9109EDB0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):706
                                                                                                                                                                                                                                      Entropy (8bit):5.563197455028977
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biagkcbkLwT5zxjHT9wuRToJhfbkEm2Z:7e9SlNLiaflv9KO4cjWIVT9ZRetRzZ
                                                                                                                                                                                                                                      MD5:0B067B696A6F2B7FDAFC6E733872401A
                                                                                                                                                                                                                                      SHA1:E804B3A048F3381C3E8DBDDD2DD51F0C11156971
                                                                                                                                                                                                                                      SHA-256:B42F2EC3B128DEA5FB95E19BF3C9B0794D7DF0E9A9CEA51199C3D69C252AF9BC
                                                                                                                                                                                                                                      SHA-512:204EE91380D9F87C8895EF29EDDD3FF2A1E4E79B423DE38DBCD6CFE79ECAF22E30CC4A79D1B756C9D9658D7347C088D89B4185D1ACAF347F91AF08391E1AA61B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//81CD68B5ABFBD1D2EFFC9A3778314BDBB771A2770E9125B7369851DF9C36434CEF054A284B0CED6E3AEF5F9E4D745F2507A51DE8375215334BA83E007F2E1661++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):690
                                                                                                                                                                                                                                      Entropy (8bit):5.533144558424333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bieGbkLwT5zxjmf9wuRTo2kRhFSVhfXn+h:7e9SlNLiafLYFv9KO4JGWIof9ZRdE/0I
                                                                                                                                                                                                                                      MD5:49BD8D622ABF07A89C6450F6760A934A
                                                                                                                                                                                                                                      SHA1:FC7C55ED457358DB7A0A34042F3E17AB21A000D0
                                                                                                                                                                                                                                      SHA-256:5491BC1348519AB1130D9E1859272FA7336B6386E6F002E92C725007E1BFC8CB
                                                                                                                                                                                                                                      SHA-512:BE3210541077EEBC083B43E330AC32C2ACD6092D658D9E725B2D1467D6A7FC5B7769506007E110DA390BFAD12C3FED038601E34E1405949AB233D42A5D51D0C3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//99592B3FDCD482063EFDD4D0D71A45608159E4B410EE9DA426896483C35C9A1576F22AF8CC2225CAB446BF6640B248A7E04B2250D9880E21EC2D34AFBA6F0592++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):696
                                                                                                                                                                                                                                      Entropy (8bit):5.546230689160202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfT6v9LuO4bij2VbkLwT5zxjAWoN9wuRToBebfZkED:7e9SlNLiafGv9KO48QWIuv9ZRpRL
                                                                                                                                                                                                                                      MD5:0A399950FB2D1D80725F3CEA6BE75322
                                                                                                                                                                                                                                      SHA1:F78707F7288CC04320CBD855830F7D0D5C5862D5
                                                                                                                                                                                                                                      SHA-256:11BCB1325493DD7886DB10309A616EA8ADF395D470759ECE01540DA39CC02B31
                                                                                                                                                                                                                                      SHA-512:3978A9F55ED7075C3642C385818C0A099FA914BDFE67CBB36AF94773BE4447D6BC838DD605D7FAFD2DA0915403BC2435B664F5AA8E88C14928B13604CB2C7EEB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//459C6B15A94C2BDDB33AC8749C4799657210EC421A307BD0DFEA6943FFE5A4E0E3F6D7E94E3FC34F7581AE498B26A46ADAC1C962E3C5AF1E01563551E7C83D3B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):713
                                                                                                                                                                                                                                      Entropy (8bit):5.911021719409146
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSuKxi7s6kfF6v9bgbiE4ebkLwT5zxjtDYv9wuRTo4QCejK:7e9uui7s/fsv9bg/HWIv49ZR7QCejK
                                                                                                                                                                                                                                      MD5:61254A9C6CE57B8FB6DAF5C47840C53F
                                                                                                                                                                                                                                      SHA1:D9B109B65B5B725D90E4366FCDEE509012FB0751
                                                                                                                                                                                                                                      SHA-256:BD6876CAE0889DB066FB4F8F7FA38ED517023806C7D41341C7522DBC0E412FC6
                                                                                                                                                                                                                                      SHA-512:31A0C944BB7EB098AAFE2FB280D21248834F3AFB7CE21D818C8CED3CFD95D0EC8F61F6023BD8EDC3178AC39AE7A9059EFBA35A474E18BC8C697DB9546B6CA9E8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//C49666C6D17B3380489032D792278402A58C50CA24B473ED94B458FE49F52BF29B7E9CBB0FC9915FCDFCE0CCE37FB45A71D3DB9EF0EF754DDD0177BFEFDAA76F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):694
                                                                                                                                                                                                                                      Entropy (8bit):5.692484981098063
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7ekSSlN95i5kfF6v9LuO4biP3emebkLwT5zxjgDYv9wuRTosTKGxVWv2KA7thn:7e9SlNLiafsv9KO4d1WIG49ZRknmhn
                                                                                                                                                                                                                                      MD5:A62FE1D5E76F93DE63A6CE0848412310
                                                                                                                                                                                                                                      SHA1:951E5AF2615D9D352124599DD8B1E0A5796479B3
                                                                                                                                                                                                                                      SHA-256:FAD192A1E13114CFC65AA7EBDA0589240B08C8516ADAE145F2CF7309B5156CD3
                                                                                                                                                                                                                                      SHA-512:FB1D86DE2F4975AB293B10062854A3D7944664109EFF5679011D4E22AEF3FAF8C6A611BCBE67BEEC343DF89B0C7DD8C062349CB223302791F595585C97657BB5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DA60579E457B68E8BEED2C221EB14808A61CCB56CE7A89168B68C6933874687459C88D14DCF7061DF466EE138F540489BDA6C24DB96B3C8D0E348B97E735E643++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3828
                                                                                                                                                                                                                                      Entropy (8bit):5.64642851315268
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ElmtVPut9muF9guJVDWtfDUEWP4gU4zTA46AOifS:ELt9mG9gMVDMfD7VgUeb6Zf
                                                                                                                                                                                                                                      MD5:9DF5817AC99A2270FD716B9FC0486028
                                                                                                                                                                                                                                      SHA1:77DEA4A2DEBE4F345D2C6C9A1C70F8F861EBE7FB
                                                                                                                                                                                                                                      SHA-256:BB094E476FD300084050EB7033F837BC2C83EB2259AD7A1E5B7423FCF47E54C4
                                                                                                                                                                                                                                      SHA-512:A66B3AB4250FAE6B14041DF5BE430D70F48D5454945C36B87E30D61EA29C895A67D8DB1BE87C9DC722DBA7EEDA1E1A7B36535C22EC2D7D89A5BCB0F9409F6738
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "M.te z.jem o je.t. lep.. zabezpe.en. vyhled.v.n.?",.. TOAST_VARIANT_CHECKLIST: "Ano, chci po restartov.n. zapnout slu.bu Bezpe.n. hled.n..",.. TOAST_VARIANT_BUTTON: "Hotovo",.. TOAST_VARIANT_BUTTON_FREE: "Hledat se zabezpe.en.m . ZDARMA",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Hledat bez ochrany",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nechci bezplatnou ochranu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.e webov. ochrana nen. zcela nastavena . aktivujte ji zdarma",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Dokon.ete nastaven. bezplatn.ho proch.zen. internetu McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chra.te sv. osobn. .daje",.. TOAST_VARIANT_1_INFO: "Proch.zejte web a vyhled.vejte s v.dom.m, .e va.e osobn. .daje jsou chr.n.ny. .ekneme v.m, kter. str.nky jsou bezpe.n. . a kter. mohou b.t nebezpe.n..",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3597
                                                                                                                                                                                                                                      Entropy (8bit):5.3842718187609355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:w/A9Lqnt+lLcLvjcU7s1KWfENcDh22BqOQiiiWmD:etCLovj5AIWfENkBqBipD
                                                                                                                                                                                                                                      MD5:809F0ECCA41097BA9C1005EA6C2315E2
                                                                                                                                                                                                                                      SHA1:239B9FC0429C831377BE3D929B747A6AD6405541
                                                                                                                                                                                                                                      SHA-256:62073A0F02AAE98F59D7F8E9DDA9963770C596BC4B2F6D2916B99127CE4AB797
                                                                                                                                                                                                                                      SHA-512:CDA586059495375AAB310B1DD86B6BAB218FE3C90600266D08A7B92B7660B8E32944D6A4059648E442057DDEC77A9F011539C7AE2C3EA695412745E4D5887656
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vil du tilf.je ekstra s.gebeskyttelse?",.. TOAST_VARIANT_CHECKLIST: "Ja, aktiv.r sikker s.gning, n.r jeg har genstartet browseren.",.. TOAST_VARIANT_BUTTON: "F.rdig",.. TOAST_VARIANT_BUTTON_FREE: "S.g p. sikker vis . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "S.g uden sikkerhed",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jeg vil ikke have gratis beskyttelse",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Din webbeskyttelse er ikke fuldt konfigureret . aktiver den gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "G.r konfigurationen af din gratis McAfee-webbeskyttelse f.rdig",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Beskyt dine personlige oplysninger",.. TOAST_VARIANT_1_INFO: "Gennemse og s.g, vel vidende at dine personlige oplysninger er beskyttet. Vi fort.ller dig, hvilke websteder der er sikre og hvilke der kan v.re farlige.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Fjern bekymringen fra

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3722
                                                                                                                                                                                                                                      Entropy (8bit):5.351128852216155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:MO3e8qGlKtiKL/7vdAmPegpo1fkJFfVQz4bLECx8Oo8Cn:xdqGYtj/7vdAjgpSfkJBVQ8bI6Bo8Cn
                                                                                                                                                                                                                                      MD5:23D9E4AF68A0DDB2CFF642923E637626
                                                                                                                                                                                                                                      SHA1:E8FE359770B47FF3F2959C45606009444B986B74
                                                                                                                                                                                                                                      SHA-256:F057D5C511C8F09F222CC3BEA9F7BD3DBC09CB63B7FBB8B2CF1A85EC637FDBBC
                                                                                                                                                                                                                                      SHA-512:A50E9EDD9333A5F6950A5D31A1CC599C674105310E8543AEAFFC763CD4D4DBB952133CB674AD767A4B3A7FCADF65A945BA65D62295E625AD1D06F06145A53441
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "M.chten Sie zus.tzlichen Schutz bei Online-Suchen?",.. TOAST_VARIANT_CHECKLIST: "Ja, die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. TOAST_VARIANT_BUTTON: "Fertig",.. TOAST_VARIANT_BUTTON_FREE: "Sicher suchen . KOSTENLOS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Ungesch.tzt suchen",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ich m.chte keinen kostenlosen Schutz",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Ihr Web-Schutz ist nicht vollst.ndig eingerichtet . jetzt kostenlos aktivieren",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Schlie.en Sie die Einrichtung des kostenlosen McAfee-Web-Schutzes ab",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Sch.tzen Sie Ihre pers.nlichen Daten",.. TOAST_VARIANT_1_INFO: "Surfen und suchen Sie mit der beruhigenden Gewissheit, dass Ihre Daten sicher sind. Wir zeigen Ihnen, welche Websites sicher sind . und welche nicht.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6107
                                                                                                                                                                                                                                      Entropy (8bit):5.027955764189223
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:3/3ftrYEERsgXRx/+P5BLE27ww5X4e0TSS8bW0u2V:33trhEfXT+P5lrMSS8bEe
                                                                                                                                                                                                                                      MD5:60A045B04FAC29D2BCDAA4D9C703AA79
                                                                                                                                                                                                                                      SHA1:E699160370D45A9C91645860E69FDC0EE7B5C9D3
                                                                                                                                                                                                                                      SHA-256:3ECAC5D0CF8C85DDEC75BBB6FF9422E70074E1BA403ED787CAF3BEC14FB1EF7F
                                                                                                                                                                                                                                      SHA-512:47BFA77E692D3FBE445E5527FC854CFE574896AD972E7695B1AE9FFB393A11389DE2E69094915906900ADFD51D8A08FD4E22FA729DBA44431CC8D765BA57DC9D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...... .. .......... ........ ......... ..........;",.. TOAST_VARIANT_CHECKLIST: "..., .. ............. . ....... ......... .... ... ............ ... ............ ...........",.. TOAST_VARIANT_BUTTON: ".....",.. TOAST_VARIANT_BUTTON_FREE: "....... ......... . ......",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".. ....... .........",.. TOAST_VARIANT_BUTTON_NOT_WANT: "... .... ...... .........",.. TOAST_VARIANT_TITLE_NOT_SETUP: ". ........... ... ......... ... ..... ...... ........................ ... .......",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "........... .. ....... ... ...... .......... Web ... .. McAfee",.. // Toast varia

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3367
                                                                                                                                                                                                                                      Entropy (8bit):5.342974172044833
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KDGTsDGspn5vrfL5mwfPUpGRtBRTyCM0RL+K8KfEKxKxUT4TyALYrkyL0LEtTC6w:XIisJlwrmtBJZM4d9AY4GbJpMlDlF
                                                                                                                                                                                                                                      MD5:1660163EE26B4229DF7E588DB2260AC9
                                                                                                                                                                                                                                      SHA1:184252895739FED4620867C8A2ACA42942D03E61
                                                                                                                                                                                                                                      SHA-256:568AEB7FC55E9D872E0D8AA8F9AC7CC30F77D4AD701E2E9EA9397F43A106EA5E
                                                                                                                                                                                                                                      SHA-512:D7A4CE1C70DACA9230D8A521257D197AB2691C6A024228CFD4406186CC722F8A3D360C7129FE32118918EBA5026A98E718F4F023EFC0946636EDA5273BEB8248
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Would you like to add extra search protection?",.. TOAST_VARIANT_CHECKLIST: "Yes, turn on Secure Search after I restart my browser.",.. TOAST_VARIANT_BUTTON: "Done",.. TOAST_VARIANT_BUTTON_FREE: "Search securely . FREE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Search unprotected",.. TOAST_VARIANT_BUTTON_NOT_WANT: "I don.t want free protection",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Your web protection isn.t fully setup.enable it for free",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Finish setting up your free McAfee web protection",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Safeguard your personal info",.. TOAST_VARIANT_1_INFO: "Browse and search with confidence knowing your personal info is protected. We.ll tell you which sites are safe &mdash; and which could be dangerous.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Take the worry out of the web",.. TOAST_VARIANT_2_INFO: "Browse worry-free k

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3632
                                                                                                                                                                                                                                      Entropy (8bit):5.364673344750352
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ks358rLYfTJnrXJm8Up0RtjRoZgeCYSL+VKDKNuKA5K7oUlYZxBOGsdUXc+Kno3l:vRg0tjy4BONb9GEjiGWPc+BIIX1
                                                                                                                                                                                                                                      MD5:BF050E49D7CAB25628DB8BCE20D14BB4
                                                                                                                                                                                                                                      SHA1:B438C3936315F9A29B33C9D138BA4E57307D3AAF
                                                                                                                                                                                                                                      SHA-256:D2F32B2596A984A5441A7831F2902E922D012D06EE4690957DB93946558174B5
                                                                                                                                                                                                                                      SHA-512:19E61DF0272AC0993DE342FEE9C087B8D4C703F2526A16FD7160B0BB7E4BD4E1F2A4060A863CADE0DCE10510A4914800D4C151DC4C73FEAFDDE3B34008F9181B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".Quieres a.adir protecci.n extra en tus b.squedas?",.. TOAST_VARIANT_CHECKLIST: "S., activar la b.squeda segura despu.s de reiniciar mi navegador.",.. TOAST_VARIANT_BUTTON: "Listo",.. TOAST_VARIANT_BUTTON_FREE: "Buscar de forma segura GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Buscar sin protecci.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: "No quiero protecci.n gratis",.. TOAST_VARIANT_TITLE_NOT_SETUP: "A.n no has terminado de configurar tu protecci.n web: es gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termina de configurar tu protecci.n web de McAfee gratis",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Protege tu informaci.n personal",.. TOAST_VARIANT_1_INFO: "Navega y busca con confianza sabiendo que tu informaci.n personal est. protegida. Te indicaremos qu. sitios web son seguros y cu.les podr.an ser peligrosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Olv.date de los pe

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3652
                                                                                                                                                                                                                                      Entropy (8bit):5.363785076218504
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KHJS5wrLYl0ImbIrXJmfUp0RtjvZgPChBxZSLWKJKDuKlZKIUldZxecemv+G0pPF:QskmV0tjvHhHs4Db+XVpIWYcXBMN5ogJ
                                                                                                                                                                                                                                      MD5:D8EEC929715A9DF9A38B29F05D80EEBB
                                                                                                                                                                                                                                      SHA1:DAE2707418EA04A61CC8AFE5032698618FD195F7
                                                                                                                                                                                                                                      SHA-256:B692A0F87B2F1E00430846CBBE62B051625678CF4FDB81C07B62B07951233C70
                                                                                                                                                                                                                                      SHA-512:602AEED3822861AFC2599CC02F8CD229CFDCB819D8917BEC44C580C271191B66009D98DAE012E15A7FD72420D703EAB06D4B1FFD2F5E87D3E36119E2D8DB2A19
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".Te gustar.a agregar protecci.n de b.squeda adicional?",.. TOAST_VARIANT_CHECKLIST: "S., activar B.squeda segura despu.s de reiniciar mi navegador.",.. TOAST_VARIANT_BUTTON: "Listo",.. TOAST_VARIANT_BUTTON_FREE: "Busca de forma segura, GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Buscar sin protecci.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: "No quiero protecci.n gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Tu protecci.n web no est. completamente configurada: habil.tala gratis",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termina de configurar tu protecci.n web gratuita de McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Protege tu informaci.n personal",.. TOAST_VARIANT_1_INFO: "Navega y busca con confianza sabiendo que tu informaci.n personal est. protegida. Te diremos qu. sitios son seguros y cu.les podr.an ser peligrosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Navega por la

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3556
                                                                                                                                                                                                                                      Entropy (8bit):5.339456377097835
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:dWem9nFXHGetHHST0of6hMJHL5Y+jMp1t3NQh8Ybw/:shXmetHyYof6hMJHLm+jEt3NSFI
                                                                                                                                                                                                                                      MD5:0C913D55EF724B8530CCF5F41CAC8B11
                                                                                                                                                                                                                                      SHA1:4826895AA14392720341E5F6F5F6BBA92A73B278
                                                                                                                                                                                                                                      SHA-256:42A1A4B21D7D2BC18CFCE115CC1B4368ABE5AA1609768F632C14DEE0DE337573
                                                                                                                                                                                                                                      SHA-512:2CC6779C1CF2E9962F1B07BA8F2B63CF073446162DBB77CD598C3E2BAF27CAC6403D87A38A38CBAD88D7A4F17295F772B4B9B9D01DDA6B9600D799743EF19860
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Haluatko lis.suojausta hauille?",.. TOAST_VARIANT_CHECKLIST: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. TOAST_VARIANT_BUTTON: "Valmis",.. TOAST_VARIANT_BUTTON_FREE: "Hae suojatusti . MAKSUTTA",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Hae ilman suojausta",.. TOAST_VARIANT_BUTTON_NOT_WANT: "En halua ilmaista suojausta",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Verkkosuojausta ei ole otettu t.ysin k.ytt..n . ota se k.ytt..n maksutta",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Viimeistele McAfeen maksuttoman verkkosuojauksen k.ytt..notto",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Turvaa henkil.kohtaiset tiedot",.. TOAST_VARIANT_1_INFO: "Selaa ja hae huoletta . henkil.kohtaiset tietosi suojataan. Kerromme, mitk. sivustot ovat turvallisia ja miss. voi piill. vaaroja.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Ei huolen h.iv.. verkossa",.. TOAST_VA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3937
                                                                                                                                                                                                                                      Entropy (8bit):5.325964821898743
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:a/ScFsBmXt/CuFCNSCAQ9BYYmWJmn9AvwuHAnp/SsQWgXmm:aKOEAt/tFqSpQ9BhrmKYEApKsQwm
                                                                                                                                                                                                                                      MD5:B4FB5C132BA39360D67409C27B22B5F7
                                                                                                                                                                                                                                      SHA1:CA34DC1A3DFF6018396C61C7926F716699876476
                                                                                                                                                                                                                                      SHA-256:9039B0D434395D14E3A4379A56D6641C1068854E3C92ED7A133D34637DB506E8
                                                                                                                                                                                                                                      SHA-512:1EA6580113C51AEDB528C44B7D04E97BE4E6C630D0702B838C0C05ABD4340CEC2227BDE7D7DD1956913AE0AB69D7239C270BF85E46ECBB0BBFB7B11C6859BF16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Aimeriez-vous ajouter une protection suppl.mentaire . vos recherches?",.. TOAST_VARIANT_CHECKLIST: "Oui, activez la recherche s.curis.e au red.marrage de mon navigateur.",.. TOAST_VARIANT_BUTTON: "Termin.",.. TOAST_VARIANT_BUTTON_FREE: "Recherche s.curis.e - GRATUIT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Recherche non prot.g.e",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Je ne veux pas de protection gratuite",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Votre protection Web n'est pas enti.rement configur.e. Activez-la gratuitement.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Compl.tez la configuration de votre protection Web McAfee gratuite",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Prot.gez vos donn.es personnelles",.. TOAST_VARIANT_1_INFO: "Naviguez et recherchez avec confiance en sachant que vos donn.es personnelles sont . l'abri. Nous vous indiquerons quels sites sont s.rs et ceux qui pr.sentent un danger."

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4024
                                                                                                                                                                                                                                      Entropy (8bit):5.315456397756804
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:b34FUJtSNXfN0SPAuWXhC00ZmnfQR9SujAnV3Jy/BXP:bQMtkWS4umSmoCgAVo
                                                                                                                                                                                                                                      MD5:BFDF3BC722A41AA7A3618F75E6E4B0A0
                                                                                                                                                                                                                                      SHA1:04881EA1236333D2CE90EB2E3D47224DC715015C
                                                                                                                                                                                                                                      SHA-256:712B394CE9F418593C3681890CE35B30DF72EC812B5C9282FEC8D82FAAFC0959
                                                                                                                                                                                                                                      SHA-512:E124F5DC32777FFCA7949BC0484F8550257DE8080485984F518C47FF8DA43FFFED6B8AC7F6F7E5A9039589567D86A9E4D0605C53BB74DEF01B31F6F1D937FC6E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Souhaitez-vous ajouter une protection de recherche suppl.mentaire.?",.. TOAST_VARIANT_CHECKLIST: "Oui, activer la recherche s.curis.e apr.s le red.marrage du navigateur",.. TOAST_VARIANT_BUTTON: "Termin.",.. TOAST_VARIANT_BUTTON_FREE: "Rechercher de fa.on s.curis.e . GRATUITEMENT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Rechercher sans protection",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Je ne souhaite pas de protection gratuite",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Votre protection Web n'est pas totalement configur.e. Activez-la gratuitement",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Terminez la configuration de votre protection Web gratuite McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Prot.gez vos informations personnelles",.. TOAST_VARIANT_1_INFO: "Naviguez et recherchez en toute confiance en sachant que vos informations personnelles sont prot.g.es. Nous vous indiquerons quels sont les sites s.c

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3635
                                                                                                                                                                                                                                      Entropy (8bit):5.452540996148989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ajcHGot9qU8FSKd49nVVtx5B9Psk+20fml6J:zBt9z8Fjd493txz/L0fml6J
                                                                                                                                                                                                                                      MD5:EAB46F6683A79D5A035E8C10CE5DD638
                                                                                                                                                                                                                                      SHA1:358C96352E9E8322F587880CC71812A7A1B63DB8
                                                                                                                                                                                                                                      SHA-256:D7603EF311B20192D352C710572CDB506E12C3FC761DA0013B47AED9971E3E4C
                                                                                                                                                                                                                                      SHA-512:03089D7109C155AAFED4A07A2480A22973B8F10196A98A7860CCCBCCC5AE03E5780C48633AD9424E41506FE7268F01BEACA148A3A3C7181DF246D956AAB873CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".elite li dodati dodatnu za.titu pri pretra.ivanju?",.. TOAST_VARIANT_CHECKLIST: "Da, uklju.ite Safe Search nakon .to ponovno pokrenem preglednik.",.. TOAST_VARIANT_BUTTON: "Gotovo",.. TOAST_VARIANT_BUTTON_FREE: "Tra.ite sigurno - BESPLATNO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pretra.ivanje neza.ti.eno",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ne .elim besplatnu za.titu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.a web za.tita nije u potpunosti postavljena - omogu.ite je besplatno",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Zavr.ite postavljanje besplatne McAfee web za.tite",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Za.titite osobne podatke",.. TOAST_VARIANT_1_INFO: "Pregledajte i pretra.ujte s povjerenjem znaju.i da su va.i osobni podaci za.ti.eni. Re.i .emo vam koje su web lokacije sigurne & mdash; a koje bi mogle biti opasne.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Uklonite

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3828
                                                                                                                                                                                                                                      Entropy (8bit):5.516462843717383
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KQpmKkwbL+sDfLlUpxKRtIC0vCGNAgc+LP+K5LK3TRKwJKV54QUQQ99P1s+l2cSm:6QtdTBPqw3Tg/UgbCx+lN4zm+n
                                                                                                                                                                                                                                      MD5:8107D162C8AA34209B289445064BEB24
                                                                                                                                                                                                                                      SHA1:1065E26A62DEFE8A31519B8F0440B7D000BE4708
                                                                                                                                                                                                                                      SHA-256:9BA9F69154AA4E6C14666300CB3A158B96929D50896034205B404FBE92B29C92
                                                                                                                                                                                                                                      SHA-512:B8229769D1610EECB7D568D9B45311C7AF2B1AD1F91C7B56736D0E73188456E5DEDF1B3DDDC0E0E55686E5EFE307F5BAA836F848C7B51E784A8A62552DEFBCCF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Extra keres.si v.delemre is sz.ks.ge van?",.. TOAST_VARIANT_CHECKLIST: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tom a b.ng.sz.t.",.. TOAST_VARIANT_BUTTON: "K.sz",.. TOAST_VARIANT_BUTTON_FREE: "Keressen biztons.gosan . INGYEN",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Nem v.dett keres.s",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nem szeretn.k ingyenes v.delmet",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Webes v.delme nincs teljesen be.ll.tva . kapcsolja be ingyenesen",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Befejezte az ingyenes McAfee webes v.delem be.ll.t.s.t",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Szem.lyes adatok v.delme",.. TOAST_VARIANT_1_INFO: "Magabiztosan b.ng.szhet, hiszen szem.lyes adatai biztons.gban vannak. Megmondjuk, hogy mely oldalak biztons.gosak, .s melyek lehetnek vesz.lyesek.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3548
                                                                                                                                                                                                                                      Entropy (8bit):5.227943418578583
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:9xj3zLp7tpe0ddA4Pxt9Qmcnq1qYENfDI/0DEof2:T17tpe0sQxt9QZ+qHY0Xe
                                                                                                                                                                                                                                      MD5:C12A415C3307B7AB0CF63DF0A06A2B11
                                                                                                                                                                                                                                      SHA1:846C220B0D489635462E1C070B5ADB04557A3C64
                                                                                                                                                                                                                                      SHA-256:35E2115826E9B7286606979AEE263AE60A58104ECA1CCC1846BC09F0EF44A8AA
                                                                                                                                                                                                                                      SHA-512:7E0D07CA9158CFCF61934C9A227406F9D269571F6AC1FCE4ACCAE44E2847D8A0F1FA1346BE142FAEE6394432D478D74B8A75DA9E296A9B562D8429ABA245A402
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vuoi aumentare la protezione delle ricerche?",.. TOAST_VARIANT_CHECKLIST: "S., attiva la ricerca sicura dopo il riavvio del browser.",.. TOAST_VARIANT_BUTTON: "Fine",.. TOAST_VARIANT_BUTTON_FREE: "Ricerca sicura . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Ricerca senza protezione",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Non desidero la protezione gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "La protezione Web non . configurata completamente. Attivala gratis.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Completa la configurazione di McAfee Web Protection",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Tutela le tue informazioni personali",.. TOAST_VARIANT_1_INFO: "Naviga e cerca senza timore sapendo che le tue informazioni personali sono protette. Ti segnaleremo i siti sicuri e quelli che potrebbero essere pericolosi.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Naviga sul Web in tutta tranquillit.",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3960
                                                                                                                                                                                                                                      Entropy (8bit):6.019688692738524
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:6hHMKEaeQVt4/aWso3rOx4mc2JYtwhnoIZH7So7:YB5ztO57Ox4mJ8Eogms
                                                                                                                                                                                                                                      MD5:3CEED803E5C3B4DD800EB04FFC037B7D
                                                                                                                                                                                                                                      SHA1:75114628EC31701F4C9534641E1985BB8F1D80C9
                                                                                                                                                                                                                                      SHA-256:2503F01DBAE81E406759D4172E508275BBA1CA5E5294C3D6A427753FB39D08CD
                                                                                                                                                                                                                                      SHA-512:2E8B64F008F3EAC25A494AD49F4636F9AB69BCC89B49C2B02D50333B46128E18FC4FF8ED1A1232CB5564DE993FAB367B6C737FAEDD012A460B3E3E9BA0BB64BE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "..............",.. TOAST_VARIANT_CHECKLIST: ".................. ...........",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: "..... - ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "..........",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Web ...................................",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "........ Web ...................",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "............",.. TOAST_VARIANT_1_INFO: "..................................................",.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3783
                                                                                                                                                                                                                                      Entropy (8bit):5.9372530028539305
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KwNX9/6gkTR6wtUp7RtlvCI/Lg7KoR/+KNM2KHK4Uq0RxIZr1ZNpiL8s/cCM7R+2:P26Ft8+W/rNIqxmQlbe6q48
                                                                                                                                                                                                                                      MD5:2B8214B6C9867827B7BA95C1EFE4B6D5
                                                                                                                                                                                                                                      SHA1:1BBD83EA79CDD9BDF98836A1FD4351958D56D67F
                                                                                                                                                                                                                                      SHA-256:452FC0B20B9DA056B9889C51B7F7AA8FB42F4F20C3DB9D3C6E8B3EB88D593560
                                                                                                                                                                                                                                      SHA-512:98A0A9A72761CA38AA9C9A29505CCD95CC10DD15555CCB176EF2F981231FDD293E2FBD4F5795EE678001E0AB1E42F26FE85CBA36DE0149FD2470C4D85F61469A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".. .. ... ........?",.. TOAST_VARIANT_CHECKLIST: "., . ..... .. ... . .. ... .......",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: "... .. - ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".. .. ..",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".. ... .... ....",.. TOAST_VARIANT_TITLE_NOT_SETUP: ". .. ... .... ...... ... ........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".. McAfee . .. ... ......",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: ".. ... ......",.. TOAST_VARIANT_1_INFO: ".. ... .... .... .... ....... ... .... ... . .. .... .......",.. // Toast variant 2 specific.. TOAST_VARIANT_2_T

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3599
                                                                                                                                                                                                                                      Entropy (8bit):5.3688204970538695
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:wMQx7teYFyZ8K3XdIcJK10kNeso2bMUaMZiBdL1:8teYFyZ8K3N9E10kNtoYMUaM41
                                                                                                                                                                                                                                      MD5:8F56E3DB852D4CC0DB086A3B41987411
                                                                                                                                                                                                                                      SHA1:71A19B8091169B39E67B66BE05D49F92F56BA056
                                                                                                                                                                                                                                      SHA-256:23E37BFEAF0BB313C6B32E248391F26B811B96FEB065D83A2F2BB7AB5CFE2463
                                                                                                                                                                                                                                      SHA-512:12E939E099DC8334DA355B8797009A2D371C0F6BD5ABB220CCD6BD271546F0F9114E1C60CAC6B783D9A831797E4C7EBE87FE4546AB9D6C1977255A4384B0A6A9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vil du ha ekstra s.kebeskyttelse?",.. TOAST_VARIANT_CHECKLIST: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt.",.. TOAST_VARIANT_BUTTON: "Ferdig",.. TOAST_VARIANT_BUTTON_FREE: "S.k sikkert . KOSTNADSFRITT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "S.k uten beskyttelse",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jeg vil ikke ha kostnadsfri beskyttelse",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Nettbeskyttelsen din er ikke ferdig konfigurert . aktiver den kostnadsfritt",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Konfigurer resten av nettbeskyttelsen din fra McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Beskytt personopplysningene dine",.. TOAST_VARIANT_1_INFO: "Du kan surfe og s.ke uten bekymringer i visshet om at personopplysningene dine er beskyttet. Vi forteller deg hvilke omr.der som er sikre og hvilke som kan v.re farlige.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Slipp . beky

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3539
                                                                                                                                                                                                                                      Entropy (8bit):5.325743038067988
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:WupCvikhC0tR356VrLrVHgKFteK5/AhK/pxFoD4QkHM5u:WupCvikbt9AVrLrVHhuk/AhK/pxOD4Q0
                                                                                                                                                                                                                                      MD5:3B7760CFBBC52770191A2C61C7B0B01F
                                                                                                                                                                                                                                      SHA1:56EDF5D22E2891E8724BDA9DCEDFFC5F20B108D8
                                                                                                                                                                                                                                      SHA-256:6D781417F65E7B1E50A493D5630C8217100EC3A4CC40266ABE4536F0AC35DB8E
                                                                                                                                                                                                                                      SHA-512:2C1A7A1777931AB7F9FDE7508683C459C53A25D7CCF62FBDA878490E8CC4116146510A915F8DC12D828CF074EB103C803E2567AED67CEB440C007AF774FD4C82
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Wilt u aanvullende zoekbescherming toevoegen?",.. TOAST_VARIANT_CHECKLIST: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. TOAST_VARIANT_BUTTON: "Gereed",.. TOAST_VARIANT_BUTTON_FREE: "Veilig zoeken . GRATIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Onbeschermd zoeken",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ik wil geen gratis bescherming",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Uw webbescherming is nog niet volledig geconfigureerd. Schakel uw bescherming gratis in.",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Uw gratis McAfee-webbescherming instellen",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Bescherm uw persoonlijke gegevens",.. TOAST_VARIANT_1_INFO: "Browse en zoek vol vertrouwen in de wetenschap dat uw persoonlijke gegevens worden beschermd. We laten u weten welke websites veilig zijn, en welke mogelijk niet.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Zorgeloos browsen",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3618
                                                                                                                                                                                                                                      Entropy (8bit):5.596787899184335
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:QrIqKLAst649Gs63IcBPevJwh8i8iiQlacMrIMXkIu:QcHtn9/pcBPevJwh8i8iiQlacMcMVu
                                                                                                                                                                                                                                      MD5:C1E51183CAB8CB6CA65D0BE6CC857675
                                                                                                                                                                                                                                      SHA1:13C4900BFF8AC98305A2A1B8B431A299179C2D3D
                                                                                                                                                                                                                                      SHA-256:03ACA4D6989F8F16E23B8AB82FE06470968DED66D27FA80B2F279085E5350788
                                                                                                                                                                                                                                      SHA-512:E1DBAFBB596DF80715A79DBAA5E3E292C2B72211C7101B3E591E353CFA89E95BB655DDA5B26517C1E81BC63CB132D788DE4D85833159882C8BFDDE7F48FFFBD5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Chcesz zwi.kszy. bezpiecze.stwo wyszukiwania?",.. TOAST_VARIANT_CHECKLIST: "Tak, w..cz Bezpieczne wyszukiwanie po ponownym uruchomieniu przegl.darki.",.. TOAST_VARIANT_BUTTON: "Gotowe",.. TOAST_VARIANT_BUTTON_FREE: "Wyszukuj bezpiecznie . BEZP.ATNIE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Wyszukuj bez ochrony",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nie chc. bezp.atnej ochrony",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Twoja ochrona w sieci Web nie jest do ko.ca skonfigurowana . w..cz j. bezp.atnie",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Uko.cz konfiguracj. bezp.atnej ochrony sieciowej McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chro. swoje dane osobowe",.. TOAST_VARIANT_1_INFO: "Spokojnie wyszukuj i przegl.daj, wiedz.c, .e Twoje dane osobowe s. chronione. Powiemy Ci, kt.re witryny s. bezpieczne, a kt.re nie.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Spokojnie korzyst

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3738
                                                                                                                                                                                                                                      Entropy (8bit):5.345649785558925
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KpaRlEpnKqfJuUuRwyUptRtbVaKjJOhCf+L7UKkKwKfK6TU0kPVdq54420uUFLt9:w3HtvJxfqFZC/tdHLwjL+zY
                                                                                                                                                                                                                                      MD5:8AD24B0F04679C8ED9AB98ED8906D80C
                                                                                                                                                                                                                                      SHA1:BAF843EAA9E41ACCD130038A189C1DB56F0229D9
                                                                                                                                                                                                                                      SHA-256:E9DFEE5E6C78E54A9D77A3F33462F256DD3A887AF1F44D5D2E2A9BD4A0FDFB53
                                                                                                                                                                                                                                      SHA-512:6E40CF4552552EB41CDE9361316371BECF4350195CEA0F54EAEC338044D44076768AE923F6B6D071681A0DC084F20F4F068285B1D490AC155481903FED9BEB6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Voc. gostaria de adicionar prote..o de pesquisa extra?",.. TOAST_VARIANT_CHECKLIST: "Sim, ative a pesquisa segura depois que o navegador for reiniciado.",.. TOAST_VARIANT_BUTTON: "Conclu.do",.. TOAST_VARIANT_BUTTON_FREE: "Pesquise com seguran.a GRATUITAMENTE",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pesquisa n.o protegida",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Eu n.o quero prote..o gr.tis",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Sua prote..o na Web n.o est. totalmente configurada. Ative-a gratuitamente",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Conclua a configura..o da prote..o gratuita da Web da McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Proteja suas informa..es pessoais",.. TOAST_VARIANT_1_INFO: "Navegue e pesquise com confian.a, sabendo que suas informa..es pessoais est.o protegidas. Informaremos quais sites s.o seguros . e quais podem ser perigosos.",.. // Toast variant 2 specific.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3683
                                                                                                                                                                                                                                      Entropy (8bit):5.333188562917313
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KVFTplRl0d61FB0yUpDRtbVaK6HOd0TZeC5p30BL7UKkKHKMKFTUBk30aB5qyQOm:GE3ttmud03zEPFqtvEezHWNdgQh
                                                                                                                                                                                                                                      MD5:5ECF28F73D41D643E7715E73141ED259
                                                                                                                                                                                                                                      SHA1:200BF26829AE61F756B992CF66C920A3B48A940E
                                                                                                                                                                                                                                      SHA-256:61B970D4DB4AB72706557984C489B15143F8805517B87FAA3D3557EC1A6EA5DA
                                                                                                                                                                                                                                      SHA-512:11F23BAA436EF6D0524DCC24D03C731BFAAAEA32C1CAB911304E144F5DFBDB6E0831E300EAD6E29DD8512A3516D4B252AC6976464890C6BE374AC80FBD879D03
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Pretende adicionar prote..o de pesquisa suplementar?",.. TOAST_VARIANT_CHECKLIST: "Sim, ativar a pesquisa segura ap.s reiniciar o meu browser.",.. TOAST_VARIANT_BUTTON: "Conclu.do",.. TOAST_VARIANT_BUTTON_FREE: "Pesquisar em seguran.a . GR.TIS",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pesquisar sem prote..o",.. TOAST_VARIANT_BUTTON_NOT_WANT: "N.o quero prote..o gratuita",.. TOAST_VARIANT_TITLE_NOT_SETUP: "A sua prote..o Web n.o est. conclu.da: ative-a gratuitamente",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Termine a configura..o da sua prote..o Web da McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Proteja as suas informa..es pessoais",.. TOAST_VARIANT_1_INFO: "Navegue e pesquise com a confian.a de que as suas informa..es pessoais est.o protegidas. Vamos indicar-lhe que sites s.o seguros e os que podem ser perigosos.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Deixe

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5374
                                                                                                                                                                                                                                      Entropy (8bit):5.132644537252728
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:/Li+T0t5WKRmY8vzQedwpNv473IdQ/NtRhB5:f0t5Dl8vzQex7DNPF
                                                                                                                                                                                                                                      MD5:BA1EB3F25F4C18FFF45C0067D52CCB8A
                                                                                                                                                                                                                                      SHA1:A6561DB59471A9EED34114F4FEC3BFEBB50CB30A
                                                                                                                                                                                                                                      SHA-256:D61068F26158E564C4DC5773312B3BDDEC5B2362DAC0BCE2FDFEFD2D403D7CD6
                                                                                                                                                                                                                                      SHA-512:AF1407FB4DAA032CF1CB99A327B01B525C3F174D1F0E1215DA4F466BADC3CA755C239CAF6AD8D76B413F3540556495EB10CBC1429D2269192A8A8A97C2D06091
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...... ........ .............. ...... ......?",.. TOAST_VARIANT_CHECKLIST: ".., ........ .......... ..... ..... ........... .........",.. TOAST_VARIANT_BUTTON: "......",.. TOAST_VARIANT_BUTTON_FREE: ".......... ..... . .........",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "..... .. .......",.. TOAST_VARIANT_BUTTON_NOT_WANT: "... .. ..... .......... ......",.. TOAST_VARIANT_TITLE_NOT_SETUP: ".... ...-...... ......... .. ......... . ........ .. .........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "......... ......... .......... ...-...... McAfee",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........ .... ...... ..........",.. TOAST_VARIANT_1_INFO:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3752
                                                                                                                                                                                                                                      Entropy (8bit):5.64500872886784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:G/v3lJ6qJt9g29MgiL+tBjYE7+R8LB0HDDx+UN:G3l4At9g29MnL+tpYE7o8LB0Xx+c
                                                                                                                                                                                                                                      MD5:2EF359E6BDF22EB8A810CCBA28D42BFE
                                                                                                                                                                                                                                      SHA1:BA94C3BAF5CD56677630339189942A3B9DB371C7
                                                                                                                                                                                                                                      SHA-256:189D8212CF6BCD87AC6226F2B9E6CE804F8BC64CAFFF144699EAD54B2C4ABBE6
                                                                                                                                                                                                                                      SHA-512:D5F91D8D8094D706A1E741401E0A5A155FDE6738EB6F8A334DB441BAF2ED3213102C5E8A25E9549AB419920452AE1E9DF3F25B9E65A05AD0D28F5B45D0D9ED50
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Chcete zv..i. zabezpe.enie vyh.ad.vania na internete?",.. TOAST_VARIANT_CHECKLIST: ".no, zapn.. zabezpe.en. vyh.ad.vanie po re.tarte prehliada.a.",.. TOAST_VARIANT_BUTTON: "Hotovo",.. TOAST_VARIANT_BUTTON_FREE: "Vyh.ad.va. so zabezpe.en.m . ZADARMO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Vyh.ad.vanie nie je chr.nen.",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Nechcem ochranu zadarmo",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Webov. ochrana nie je .plne nastaven. . aktivujte ju zadarmo",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Dokon.ite nastavenie webovej ochrany od McAfee zadarmo",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Chr..te svoje osobn. .daje",.. TOAST_VARIANT_1_INFO: "Preh.ad.vajte web a.vyh.ad.vajte inform.cie bez ob.v v.aka ochrane osobn.ch .dajov. Uk..eme v.m, ktor. lokality s. bezpe.n. a.na ktor.ch hroz. nebezpe.enstvo.",.. // Toast variant 2 specific.. TO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.442839793599894
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:5541sqXt9UFE+s49f8cQq5gAWFLrf9UQb/Ev:5Yt9UFq49LQqyfFvOQb/6
                                                                                                                                                                                                                                      MD5:88033B59E8AFB7445BDBEB2C8417993A
                                                                                                                                                                                                                                      SHA1:69D5163700EAB0CD961EB77E4657FFA778422B15
                                                                                                                                                                                                                                      SHA-256:7D97F927A48CA19CBFA1F4FAFC65092A7052BAC3CE48ED4BEAB63382FD377E8C
                                                                                                                                                                                                                                      SHA-512:AE6186EA4BB8B1ABD8043651FF96FB8B9D18009F7E27F7DA7FD4E391C4AD8A936C47F0C6BF43C9AE9D10E4B75AA482C4E2084AE319CF60408C1AEFE8DF05057F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: ".elite li dodatnu za.titu pretrage?",.. TOAST_VARIANT_CHECKLIST: "Da, uklju.i Secure Search nakon .to ponovo pokrenem pregleda..",.. TOAST_VARIANT_BUTTON: "Gotovo",.. TOAST_VARIANT_BUTTON_FREE: "Pretra.ujte bezbedno . BESPLATNO",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Pretraga nije za.ti.ena",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Ne .elim besplatnu za.titu",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Va.a za.tita na internetu nije u potpunosti postavljena.omogu.ite je besplatno",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Zavr.ite postavku va.e McAfee za.tite na internetu",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: ".titite li.ne informacije",.. TOAST_VARIANT_1_INFO: "Pregledajte i pretra.ujte bez brige znaju.i da su vam li.ne informacije za.ti.ene. Re.i .emo vam koje lokacije su bezbedne . a koje mogu biti opasne.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Uklonite brigu sa veba"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3492
                                                                                                                                                                                                                                      Entropy (8bit):5.4331381790030715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KaGqWQzrHqWU7B10Up8LRtXbY8ACXGiLuKcUCLK6LKVKo9U31Ta920FLlpx/TV5E:B6CtsQ2klVdM5+9npxU2oBZvOa
                                                                                                                                                                                                                                      MD5:EC4978D8B324AD8755EE34FF4F58B365
                                                                                                                                                                                                                                      SHA1:B8C4F863D72E4FF83A13160ADA8F0DDC30121BC6
                                                                                                                                                                                                                                      SHA-256:4A25917264498CE426AAF32DE3CA41A0EE27DFFB94C6F37A7AF223E5FAFBB072
                                                                                                                                                                                                                                      SHA-512:2CC6DF09DD0A862E8F09F1C5E29332AFE3901C5B927050B3B21D87C2D3A358D5C46DC1295E6D5FA38654A6BDDF6A6BDC31283D2D4F47D67DC060FDB89B03AF16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Vill du l.gga till extra s.kskydd?",.. TOAST_VARIANT_CHECKLIST: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. TOAST_VARIANT_BUTTON: "Klart",.. TOAST_VARIANT_BUTTON_FREE: "S.k s.kert - KOSTNADSFRITT",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Oskyddad s.kning",.. TOAST_VARIANT_BUTTON_NOT_WANT: "Jag vill inte ha kostnadsfritt skydd",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Inst.llningen av ditt webbskydd .r inte fullbordat - aktivera det kostnadsfritt",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "Fullborda inst.llningen av ditt McAfee-webbskydd",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Skydda din personliga information",.. TOAST_VARIANT_1_INFO: "Surfa och s.k tryggt i vetskap om att din personliga information .r skyddad. Vi ber.ttar vilka webbplatser som .r s.kra . och vilka som kan vara farliga.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Surfa p. n.tet utan oro",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3702
                                                                                                                                                                                                                                      Entropy (8bit):5.512861553302173
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:K2rafAlFLhKpoLQHdPUpI5LRtHyderOYC3LCyrsgLLsnLKIlIKfLKb3LKyjqMURl:CCIbtSgyGyouKx+bG/dDeFfQ3t16h87J
                                                                                                                                                                                                                                      MD5:161EB0CAC326DD8A696FF36B77B22284
                                                                                                                                                                                                                                      SHA1:A6E169A9C25928628064B0C96A1971CFEA1779BA
                                                                                                                                                                                                                                      SHA-256:304C6C77FCB0319C3BE7B2892C16901BDE5624B64F67B65C742310BDE227E3D9
                                                                                                                                                                                                                                      SHA-512:41B98683C147FF7C4B8A4AB55265798D222D8E0C142AAE243980F92082CDA83DEA7B332BC19468D807D7E209AA102006C6A58286FA4ED112E232243BBEE037DC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "Ekstra arama korumas. eklemek ister misiniz?",.. TOAST_VARIANT_CHECKLIST: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. TOAST_VARIANT_BUTTON: "Bitti",.. TOAST_VARIANT_BUTTON_FREE: "G.venli arama yap.n - .CRETS.Z",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "Korunmadan arama yap.n",.. TOAST_VARIANT_BUTTON_NOT_WANT: ".cretsiz koruma istemiyorum",.. TOAST_VARIANT_TITLE_NOT_SETUP: "Web koruman.z tam kurulmam.., .cretsiz etkinle.tirin",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".cretsiz McAfee web koruma kurulumunuzu tamamlay.n",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "Ki.isel bilgilerinizi koruyun",.. TOAST_VARIANT_1_INFO: "Ki.isel bilgilerinizin korundu.unu bilerek g.venle gezinin ve arama yap.n. Hangi sitelerin g.venli, hangilerinin tehlikeli olabilece.ini size s.yleyece.iz.",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "Endi.eleri webten uzak tutun",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3220
                                                                                                                                                                                                                                      Entropy (8bit):6.328136364005078
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:KpV0YrIr3BkaxUpYNRtt5K2dCaLQzKeKGBKHlKCQUDlFJ5g68a1MzflHS/+xKAYj:aS9KotKvaLJ8CJFPl8aSwXNtl43isG
                                                                                                                                                                                                                                      MD5:127E7A24D20FA921F2E2FD52950E9E74
                                                                                                                                                                                                                                      SHA1:F771BDDCF7E42D19A7DAB6A930215E8EB648737B
                                                                                                                                                                                                                                      SHA-256:302C3C1CE1DA31D88FB1BBDD2C3BCA5F389634E6DD139AC94CFE065F52BDC189
                                                                                                                                                                                                                                      SHA-512:BC54A1DC7B0AA96B94131B7C27F4738AF86385288E1BC6B1BF21A996259C598077417BC3C3FCDE8D9C13D9AD98C9FC8A0C1DE55C0573927525C07411AE577C3B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "...........",.. TOAST_VARIANT_CHECKLIST: "................",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: ".... . ..",.. TOAST_VARIANT_BUTTON_UNPROTECTED: "......",.. TOAST_VARIANT_BUTTON_NOT_WANT: "........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "...................",.. TOAST_VARIANT_TITLE_FINISH_SETUP: ".............",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........",.. TOAST_VARIANT_1_INFO: ".................................................",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: "......",.. TOAST_VARIANT_2_INFO: ".........................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3309
                                                                                                                                                                                                                                      Entropy (8bit):6.331568112595525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:LjGwO6t6wKA44s2xr92kwcK8jtUuhSSm7g:tt6wc4s2xrskwc3U6SS5
                                                                                                                                                                                                                                      MD5:D398AC0CF963E48913B30665F979ACDE
                                                                                                                                                                                                                                      SHA1:C182BA07A8D94F046BD5F294ACCE10870F72B273
                                                                                                                                                                                                                                      SHA-256:AFE3A6D0DE20379F3F72952EA14C7E5029ADE5574305EDCAB6FA75C04A565D19
                                                                                                                                                                                                                                      SHA-512:5ACFCEE56F632AED2EF7C399E04B2302B01493F89B5CE6A85A0CF898AFD8E843FC38526555242473C04149CFF5A5FFC4446C47C8CF16E0F1E66C76E5238A4179
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSSToastVariants_ = {.. TOAST_VARIANT_QUESTION: "..............",.. TOAST_VARIANT_CHECKLIST: "...................",.. TOAST_VARIANT_BUTTON: "..",.. TOAST_VARIANT_BUTTON_FREE: ".... . ....",.. TOAST_VARIANT_BUTTON_UNPROTECTED: ".............",.. TOAST_VARIANT_BUTTON_NOT_WANT: "........",.. TOAST_VARIANT_TITLE_NOT_SETUP: "..... Web ...........",.. TOAST_VARIANT_TITLE_FINISH_SETUP: "..... McAfee Web .....",.. // Toast variant 1 specific.. TOAST_VARIANT_1_TITLE: "........",.. TOAST_VARIANT_1_INFO: "................................................",.. // Toast variant 2 specific.. TOAST_VARIANT_2_TITLE: ".......",.. TOAST_VARIANT_2_INFO: "..........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2317
                                                                                                                                                                                                                                      Entropy (8bit):5.729487960185157
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvSUqYRSK+R28Y2zgJsQqpq/83qkj6B9nw4RJtlzgUh:C6UnSKOY2zegB6DnFh
                                                                                                                                                                                                                                      MD5:0C2C981779735C436253DA9C520B7776
                                                                                                                                                                                                                                      SHA1:441814F95F6B61F61E98FDA86F659F96A2096628
                                                                                                                                                                                                                                      SHA-256:C6D956EE51A0546A962721C68A24688E7D64A696130E7BD6D3BD653D31F3AF36
                                                                                                                                                                                                                                      SHA-512:D2D958011E8946D29306CDA774F7A2FFBF37E30EC11EE414F27FAA2065E9BF3AF7D242A0E93CDEBE9A88A247E6C203D02E9F9D3CF85D6600C5A28DA5215B6A2B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "M.te k dispozici dal.. mo.nosti ochrany",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Vy... ochrana je p.ipravena",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Vy... ochrana je vypnuta",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Tyto funkce vy... ochrany v.m zajist. v.t.. bezpe.. online. Zapn.te je.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "V.e je nastaveno! Kdy. p...t. znovu spust.te prohl..e., budete moci s jistotou vyhled.vat pomoc. funkce Bezpe.n. hled.n. McAfee, kter. v.m uk..e, kter. str.nky lze bezpe.n. nav.t.vit.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Je vypnut., proto.e bylo zak.z.no nebo odebr.no roz...en. pro hled.n., kter. je sou..st. vy... ochrany. Z.skejte tyto funkce zp.t.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Funkce Bezpe.n. hled.n. McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2319
                                                                                                                                                                                                                                      Entropy (8bit):5.4193601593801715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvJjkjVsFprf0Ksd4Ajfm0p4TS4Zudhmr:Ctk5Ux3Ajfme4TSwr
                                                                                                                                                                                                                                      MD5:3CBF25481D4328F923CE3A91A025A151
                                                                                                                                                                                                                                      SHA1:EEC5BADC3D9311E57D8494E370FF6F47B4A995CA
                                                                                                                                                                                                                                      SHA-256:DC0AA3590319A49E81989C196D2277B8C85B4881C110E5C109E1426562FA3B72
                                                                                                                                                                                                                                      SHA-512:AEFA46910EB7A4299D7EFE9BE3418E5AA5B8C405C5BE9D3FCBE35AFE8DB6E86B1D3D0E476D8FD04F879E6197DD97DB8FA0C9701576D2EE877EFF061DE95ECFEA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Du har flere beskyttelsesmuligheder",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ekstra beskyttelse er aktiveret",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ekstra beskyttelse er deaktiveret",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Disse ekstra beskyttelsesfunktioner forbedrer din onlinesikkerhed. Sl. dem til.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alt er parat. N.ste gang, du starter browseren, kan du surfe p. internettet i sikkerhed, fordi McAfee sikker s.gning viser dig, hvilke websteder det er sikkert at bes.ge.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Funktionen er deaktiveret, fordi s.geudvidelsen, der er en del af den ekstra sikkerhedspakke, er sl.et fra eller er blevet fjernet. F. disse funktioner tilbage nu.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee sikker s.gning", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} viser dig, hvilke websteder d

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2382
                                                                                                                                                                                                                                      Entropy (8bit):5.444409514726724
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvzhxfTyDKyA7h3CFycAOFsxEclSgif4r:C1xfeDS3CT2Is
                                                                                                                                                                                                                                      MD5:E6A3CB39DEEE9F591845D5F9D74A7268
                                                                                                                                                                                                                                      SHA1:2B64A66D915899E4439AB3DD9281C5988B58A4FF
                                                                                                                                                                                                                                      SHA-256:F9DB2BC91DF545C68931E42F7346B1B22CED36868C2AF20903FC5B5033275A3A
                                                                                                                                                                                                                                      SHA-512:3B96E4E6F8215AC14054173D4B86509B7A3AA88EA9E08B91D9E4529F31476B0A195F7A9DCFC1578E21CE243BF6D9F507CD812875AD974527D73B02ABC3E9C016
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Es sind weitere Schutzfunktionen verf.gbar",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Zus.tzlicher Schutz wartet auf Sie",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Zus.tzlicher Schutz ist deaktiviert",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Mit diesen Funktionen des zus.tzlichen Schutzes sind Sie online besser gesch.tzt. Aktivieren Sie sie.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alle eingerichtet! Wenn Sie das n.chste Mal Ihren Browser .ffnen, sollten Sie die sichere Suche von McAfee nutzen, um in Ihren Suchergebnissen zu sehen, welche Websites sicher sind.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Sie ist derzeit nicht verf.gbar, da die Sucherweiterung, die eine Komponente des zus.tzlichen Schutzes ist, deaktiviert oder entfernt wurde. Aktivieren Sie diese Funktionen jetzt wieder.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Sichere Suche", .. SEARC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3630
                                                                                                                                                                                                                                      Entropy (8bit):5.080980195677936
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvF/wyeEEyaSMAwEzb0h3hSBDAeuDFKUsGEE6+ihkxT7miUvX1:CNwyIyaSMAwsC38BDAeuDFKed0uHpUN
                                                                                                                                                                                                                                      MD5:456200FB474CF447722CDE0A570D3B4C
                                                                                                                                                                                                                                      SHA1:BCC8882FE28C579765B7A3F6CE9A4A3590C47CEB
                                                                                                                                                                                                                                      SHA-256:4096AFAAE89B7554E00E25C13165BF328F7C7DEE8D283BF5D9AA8C19FBEC066A
                                                                                                                                                                                                                                      SHA-512:B920C226F39E5E9304B850CD9F94DB7617886352041BE48C711565A61945AF929C9E7B1F041FF13F205F7E825E23BFA9D61862EB008238F6A76E40E2DCFA6739
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "..... ........... ......... .........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ". ........ ......... ..... ......",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ". ........ ......... ..... ................",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "..... .. ........... ......... .......... ... ....... ... ........ online. ............. ... ............",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "..... .......! ... ....... .... ... .. .............. .. ......... .......... ..., ......... ........... .. ..... .. ... ...... ......... McAfee ... ... ....... ..... .....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2039
                                                                                                                                                                                                                                      Entropy (8bit):5.450247269606277
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Cv45dlzloc0Zvdr05DJMtWXS7bJ3sLEISkv2:CKHzloLZ25DJMtiUW4Nkv2
                                                                                                                                                                                                                                      MD5:EDF64DD1F31DD3E3C4648429A2AF486F
                                                                                                                                                                                                                                      SHA1:1F758B41EDAD1C2B2A1AADBD7AB8AA82CACDC8D3
                                                                                                                                                                                                                                      SHA-256:4316024B024516146B6400F03243B6B1A266761A5EDE4CEB1ED10D31862BFF06
                                                                                                                                                                                                                                      SHA-512:0399A80B97FA745E62B9B49AABE9F71A0AC06479FDD85B31CD180E96A04F3B5A4C53D2D0433C932C5EBBA75E6D832F0DBF4A52F8D47C63E0AC2AE56D71F89510
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "You have more protection available",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Added Protection is ready",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Added Protection is off",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "These Added Protection features keep you safer online. Turn them on.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "All set! The next time you restart your browser, search confidently with McAfee Secure Search showing you which sites are safe to visit.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "It's off because the search extension that's part of Added Protection was disabled or removed. Get these features back now.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Secure Search", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} shows you which sites are safe before you visit them.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "Ad Blocker", .. SEARCH_TOAST_ADBLOCK_BULLE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2325
                                                                                                                                                                                                                                      Entropy (8bit):5.420117640626021
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Cv7MkYFXTzGFoIEWPyovzQArVZGLIqSbw:C4TzGmIn7lxq6w
                                                                                                                                                                                                                                      MD5:7658F28225786E98892301CD7477A9EA
                                                                                                                                                                                                                                      SHA1:A71584A51F5AB0B73672D7097F4B08A1F1C63032
                                                                                                                                                                                                                                      SHA-256:A588E1AC61D3D6FFAEA6D66B118DDEDC6549059099823EAA659ACC30B4B16DD9
                                                                                                                                                                                                                                      SHA-512:4C21E33956547239C775103AF6C35CEFD249431DC3E5A253E76F069408AB6CEE54102ADF7B26F8923D935B1891887FDEEBF307EF7E4B762EB2FAA23D28900308
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Puede disfrutar de m.s protecci.n",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La Protecci.n a.adida est. activada",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La Protecci.n a.adida est. desactivada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas funciones de Protecci.n a.adida le mantienen a salvo en Internet. Act.velas.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Ya est. todo configurado. La pr.xima vez que reinicie su navegador, tendr. la tranquilidad de saber qu. sitios web son seguros gracias a la B.squeda segura de McAfee.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desactivado porque la extensi.n de b.squeda incluida en la Protecci.n activa est. desactivada o se ha eliminado. Vuelva a activar estas funciones ahora.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "B.squeda segura de McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} le muestra q

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2241
                                                                                                                                                                                                                                      Entropy (8bit):5.460318416499153
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdgWQIvN6tKQtqWmwUV5mOZzZCB4vhmUwRKJhZfeT5gAdFqdVtBcwKHvcJi9T:CvlQIjWZKTZ8Kp6c0jqrtqvEIq1ktsZ4
                                                                                                                                                                                                                                      MD5:47D04FB85C253E87B85071CCA8E82C5F
                                                                                                                                                                                                                                      SHA1:8F14A14EE859FF77AF309063C528D817E85D3872
                                                                                                                                                                                                                                      SHA-256:9DC87CBB1CB275BF9357D5DE099F184A51C197E43978869CF9E1DCD4EDD2301B
                                                                                                                                                                                                                                      SHA-512:59D1B0AF90A19F5DB0CD44DE6CCB25F4ECA555CB96E0E6C9A2B99E2895A35E403036384042CF6CDCE2B44A05C39417FBFCF0C768D30DF1240D4333CBA4219406
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Tiene m.s protecci.n disponible",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Protecci.n adicional est. listo",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Protecci.n adicional est. desactivado",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas caracter.sticas de Protecci.n adicional lo mantienen seguro en l.nea Act.velas",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".Todo listo! La pr.xima vez que reinicie su navegador busque con confianza ya que B.squeda segura de McAfee le mostrar. cu.les sitios son seguros para visitar.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desactivado porque la extensi.n de b.squeda que es parte de Protecci.n adicional fue inhabilitada o eliminada. Recupere esas funciones ya mismo",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "B.squeda segura de McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} muestra qu. sitios son seguros ant

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2246
                                                                                                                                                                                                                                      Entropy (8bit):5.422506764815652
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdgGvLPUQPmMdzpP5x4bICHA4fEOGVGd1Pwsx7LmNhI+a6soNxawi9dySBx70:CvXlmMd9m6mdFwWrZ6kxuFrCQeEf9x
                                                                                                                                                                                                                                      MD5:D415538C892C4D5DE116CA7654BB9C05
                                                                                                                                                                                                                                      SHA1:3C1C2016FA75540B02A0163F3158BC7AB4EB1FD5
                                                                                                                                                                                                                                      SHA-256:04CB36F6ADD399E47D92CDED5D747BC08DB66EB42DD4D18909F798AB9AD468BD
                                                                                                                                                                                                                                      SHA-512:E2AC11C50120B94100634EFB30A148799DAEFBB72C797A684E0FF52107CDB73E191DADB4299703C130EBF1C05D9FD1845BB68CD1AAFC44444795BF2692A31B9B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Lis.. suojausta saatavana",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Lis.suojaus on valmis",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Lis.suojaus on poissa k.yt.st.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "N.ill. lis.suojausominaisuuksilla pysyt paremmin turvassa verkossa. Ota ne k.ytt..n.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Kaikki on valmista. Kun ensi kerralla k.ynnist.t selaimen uudelleen, voit tehd. hakuja turvallisin mielin McAfeen suojatulla haulla, joka n.ytt.. vaarattomat sivustot.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Se on poissa k.yt.st. siksi, ett. lis.suojaukseen kuuluva hakulaajennus oli poissa k.yt.st. tai se poistettiin. Hanki ominaisuudet heti takaisin.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfeen suojattu haku", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} n.ytt.., mitk. sivustot ovat vaarattomia ennen

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2413
                                                                                                                                                                                                                                      Entropy (8bit):5.4507518396761805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvmQM4M92AhLMdlzu5ZHl0l1nD2qqh2NW1:C+W42AhLmlzu5BkJyqNNW1
                                                                                                                                                                                                                                      MD5:A170C6231FB8E004BABB8892997722CE
                                                                                                                                                                                                                                      SHA1:FEE3EC85B9127C8C1FCDE05B80D0F48D4D815E90
                                                                                                                                                                                                                                      SHA-256:C3C8359B289DD489A17EB59AD57CFB66CAEAD4414AB199EE7CC34191A889F88B
                                                                                                                                                                                                                                      SHA-512:4AF251F416409BFF1E047C0087C6632DA3EE7B6E4AABB3DFE01BA07E7E7949240AF208F3C0328A75749887482A71C3549A3D509999D3C8A5991D3BC11716A91D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Plus de protection disponible pour vous",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La protection accrue est pr.te",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La protection accrue est d.sactiv.e",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ces fonctions de protection accrue vous apportent plus de s.curit. en ligne. Les activer.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Pr.t! La prochaine fois que vous lancez votre navigateur, parcourez le Web en toute qui.tude pendant que la fonction de recherche s.curis.e McAfee vous indique les sites dignes de confiance.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Cette fonction n'est pas activ.e car l'extension de recherche qui fait partie de la protection accrue a .t. d.sactiv.e ou supprim.e. R.tablir ces fonctions maintenant.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_ADBLOC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2494
                                                                                                                                                                                                                                      Entropy (8bit):5.455177997293483
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvqwGuHF9o9/EuB8u5J5AxHaaydCPjPXSJY:CSwGeY/EuB8u5olydCPrz
                                                                                                                                                                                                                                      MD5:03CD9B0142CADB6527FD60ECFA0960A1
                                                                                                                                                                                                                                      SHA1:ABDC1DA6CB5A857FF1AC671144AE45FDF4F16F50
                                                                                                                                                                                                                                      SHA-256:F6DBD6F2854457A60A371A8783294E0819014CD663A2FC340FC6C8EEF05C7D53
                                                                                                                                                                                                                                      SHA-512:48B1F57F21E088F0DE70A582C521C66674AE286F261ED63000C743F3F4054B9CA60303ACCFC7B108DC5BC037A88493BA6332A1E8D44BD503123D8CB3499D1537
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Vous avez d'autres protections disponibles",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La Protection renforc.e est pr.te",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La Protection renforc.e est d.sactiv.e",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ces fonctionnalit.s de Protection avanc.e assurent votre s.curit. en ligne. Activez-les.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Vous .tes pr.t.! La prochaine fois que vous red.marrez votre navigateur, vous pourrez effectuer des recherches en toute confiance . l'aide de la Recherche s.curis.e McAfee, qui indique les sites que vous pouvez consulter en toute s.curit..",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Elle est d.sactiv.e car l'extension de recherche qui fait partie de la Protection renforc.e a .t. d.sactiv.e ou supprim.e. R.cup.rez ces fonctionnalit.s maintenant.",.. SEARCH_TOAST_ADBLOCK_BULLE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2273
                                                                                                                                                                                                                                      Entropy (8bit):5.521363709106076
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvIoaSjp60i4X476LRiouHFshwFZcBwdaS3jB:CAejbVA8RcHFsh0ywAK
                                                                                                                                                                                                                                      MD5:20FDE83B61D081A8627097D33ABB0CF4
                                                                                                                                                                                                                                      SHA1:713026103FB526A6966A546773F90B6F140EE385
                                                                                                                                                                                                                                      SHA-256:757CDDF3C03FEAD14D4302DAE6EA54DF669DEDC1F1416C5B3B8CD87FAB6A7D86
                                                                                                                                                                                                                                      SHA-512:D12F6D989559564F5312B1BBAA6127114D45D19B6BC8460DDD2D71D4D025A2FB28EA4D5450A57C7FEC0AE209CAF8182695FD8538943D25BA1D524317C0BA1F61
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Dostupna vam je ve.a za.tita",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatna za.tita je spremna",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatna za.tita je isklju.ena",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ove funkcionalnosti dodatne za.tite .ine vas sigurnijim online. Uklju.ite ih.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Sve je spremno! Sljede.i put kada ponovo pokrenete svoj preglednik, samouvjereno pretra.ujte uz McAfee Secure Search koji .e vam pokazati koje je stranice sigurno posjetiti.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Isklju.eno je jer je pro.irenje pretra.ivanja koje je dio Dodane za.tite onemogu.eno ili uklonjeno. Vratite ove zna.ajke sada.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee sigurno pretra.ivanje", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} vam pokazuje koje stranice su sigurne prije nego ih posjetite.",.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2388
                                                                                                                                                                                                                                      Entropy (8bit):5.632856540882606
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvtCmH9aqAIDT5WSSWp7IpKwYnZmT+FLepwiV3lwCJh:CFCmHMVIqtYY+BWx
                                                                                                                                                                                                                                      MD5:462C0F951D1B386A4B3C5193310C0215
                                                                                                                                                                                                                                      SHA1:FB8B470AB20A208450B5C52650D1972B290B4C0F
                                                                                                                                                                                                                                      SHA-256:BEA8E0E706E9E7654A1A56ACC67F070E3C42C7AD2AF0C090EAF815F84C34C0ED
                                                                                                                                                                                                                                      SHA-512:326135218D026A433E1712A48B956F008B0B671BB3EDD2C3A71F8791BF3AB9DD59C04656AD729E10F961A2CBFCA0BC5DC42E1958059D2A07A61E1B330B8BEFD1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "M.g hat.konyabb v.delem .rhet. el",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "A tov.bbi v.delem k.szen .ll",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "A tov.bbi v.delem ki van kapcsolva",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "A tov.bbi v.delmi funkci.k m.g nagyobb biztons.got ny.jtanak online. Kapcsolja be .ket.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Minden k.szen .ll. A b.ng.sz. k.vetkez. elind.t.sakor magabiztosan kereshet a biztons.gos keres.s funkci. r.v.n, amely megmutatja, hogy mely webhelyeket keresheti fel biztons.gosan.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Ki van kapcsolva, mert a tov.bbi v.delem r.sz.t k.pez. keres.s b.v.tm.ny le lett tiltva vagy el lett t.vol.tva. Vegye ig.nybe .jb.l ezeket a funkci.kat.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee biztons.gos keres.s", .. SEARCH_TOAST_ADBLOCK_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2180
                                                                                                                                                                                                                                      Entropy (8bit):5.434245017398244
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvlUzrFEVioJofWr5HsJcxnyhXpwfJwTRraut:CpVioJoerVsJWylSm4C
                                                                                                                                                                                                                                      MD5:CD1EE3ADF45BFFFFA79AF533BC0E5623
                                                                                                                                                                                                                                      SHA1:2A26DB5D430373F5BB99B6763C6A0773AF0BE93E
                                                                                                                                                                                                                                      SHA-256:ED275192EAC0FAF9C5500BC6ED786D6538A06A645EAB4CCBFD8C6FA13C55481A
                                                                                                                                                                                                                                      SHA-512:D495A215198D8E3158A17B50292F10A9294F41BF48BA4955B55C9827FBC86DF24AEDDA8A9EC524F25AA66FE1759FB43E51960172393F661160587C55DEDE62ED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Puoi aumentare la protezione",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "La protezione aggiuntiva . pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "La protezione aggiuntiva . disattivata",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Queste funzionalit. di protezione aggiuntiva aumentano la tua sicurezza online. Attivale.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Tutto pronto. La prossima volta che avvierai il browser, la ricerca sicura McAfee ti mostrer. i siti sicuri da visitare.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ". disattivata perch. l'estensione per la ricerca che fa parte della sicurezza aggiuntiva . disattivata o . stata rimossa. Riattiva subito queste funzionalit..",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Ricerca sicura McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} ti mostra i siti sicuri prima di visitarli.",.. SEARCH_TOAST_ADBLOCK_BULL

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2689
                                                                                                                                                                                                                                      Entropy (8bit):5.794258434875549
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CDihdOhGELq02HhMyCYaYPuMLmeStoN5PcvhvD8voTG/:CDihdsjz2BMRNkmTgg5wt/
                                                                                                                                                                                                                                      MD5:BEE120816E0D810DD9EA2E487F9B3336
                                                                                                                                                                                                                                      SHA1:CDC5130EB605B4E3CF1E12D9D9F3E6705188A8A2
                                                                                                                                                                                                                                      SHA-256:67E0381E64EF4717BDD385FFEA8E8005D0F31E6754630B04EEA1DB3D8EC72845
                                                                                                                                                                                                                                      SHA-512:F5DE7E6941576E23F385051E37E82A05DC9B8ABD58CE6BF6C5491C2D3478683AA6D2D8B30C626E3B0CEE09C0E01D546EA1825558832C202DA6381CB184A34718
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_ADBLOCK_HEADING: "..............",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "............",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "...............",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "............................... .............",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".......... ....................... .... ....................................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".............................................. ...........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2396
                                                                                                                                                                                                                                      Entropy (8bit):5.921265621634402
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOVLgXlf/klv04CjUXktjHaQLKOudpQVg/xFSQXmYQgpyyqK4wQNqDhOnwIjup3:C8FJUXy6XlbSvYi3wiQbbOE
                                                                                                                                                                                                                                      MD5:D3909D0A578BD19D0A1D1670A1AAF9E0
                                                                                                                                                                                                                                      SHA1:A6BC641EDBD6990FE061B55D274EC9F56B71BFD7
                                                                                                                                                                                                                                      SHA-256:88E107147DE1C2A77D23A456AA1F6F61E8707B293A870941B086B93C8FAD2C0B
                                                                                                                                                                                                                                      SHA-512:1F918E55E8B54D265658BAEBFBEED0CA159506A94B6F63624E8D095D87D5B3CF786A9B2F4B39FA600B3699CD6CC8353E67FDE2663DCB8E4DF677D8C34C2ABB1D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_ADBLOCK_HEADING: "... ... . ....",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".. ... ... . ....",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".. ... .. ....",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "... .. .. .... ... ... ... ..... ... ....",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: ".. ........ ... ..... .. .... McAfee .. ... .... ... .... ..... .... ... . .....",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".. ... ... .. ... .... .. .... .. ... ... . ..... ... ... .. ......",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee .. ..", .. SEARCH_TOAST

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2170
                                                                                                                                                                                                                                      Entropy (8bit):5.447068933751636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvJIksPYZC/uu6YZJN5QsKYmOArOhR/QExYqm:ChI1Y0/u3YYsGKrYShm
                                                                                                                                                                                                                                      MD5:3D871FC36FEC2CCB6836529941BA5F66
                                                                                                                                                                                                                                      SHA1:80ECC18AE74CA73644F480AC5AEC3F9FA4F51555
                                                                                                                                                                                                                                      SHA-256:5327DDB24FD2877597BB58A2D91AE8486A6EF467DA7BD228A97D339EF471115D
                                                                                                                                                                                                                                      SHA-512:C2EDFDA39F5DE2847D75BA53E0FE66BB0B1302A43E6DC71BB6FACDE475B7B6E3962444CF3404E4EB3BEE5146595229F51176557ED976BD4B351B1F0E082B0657
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Flere beskyttelsesfunksjoner tilgjengelig",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ekstra beskyttelse er klart",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ekstra beskyttelse er av",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Disse funksjonene i Ekstra beskyttelse holder deg sikrere p. nettet. Sl. dem p..",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Alt klart! Neste gang du starter nettleseren, kan du trygt s.ke med McAfee Sikkert s.k. Funksjonen viser deg hvilke omr.der som er sikre.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Den er av fordi s.keutvidelsen som er en del av Ekstra beskyttelse, er deaktivert eller fjernet. F. tilbake disse funksjonene n..",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Sikkert s.k", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} viser deg hvilke omr.der som er sikre, f.r du bes.ker dem.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2216
                                                                                                                                                                                                                                      Entropy (8bit):5.441770885282106
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvKJpceq6RTcyrCBuH1ibZ/Pp93MK64kFUq5EpvnS8tYRQN:CQSN6Roy8uHwZHpi34Tqmpq8tYRQN
                                                                                                                                                                                                                                      MD5:22C7B3D0E2654924A480F7E6ED19516F
                                                                                                                                                                                                                                      SHA1:95A1DD003F4CB7503FBF5E0C84C9F7DD4205DA92
                                                                                                                                                                                                                                      SHA-256:BF35762243238E4FFCB6A4180CC26BED391392D4637AD0D6B1B04EBA774CDC48
                                                                                                                                                                                                                                      SHA-512:C7D177E122AE9EAD32DAFEC60C44642A9AFEBB5E2EB39DB0F7FAE7DE379DCFBD4B9F1653152BBE080CC673743F9DC3527120071258719883475D15BE5CEEB523
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "U kunt over meer bescherming beschikken",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Extra bescherming is gereed",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Extra bescherming is uitgeschakeld",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "De functies voor Extra bescherming verbeteren uw online veiligheid. Schakel ze in.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Klaar! Wanneer u uw browser opnieuw start, kunt u zorgeloos zoeken met Beveiligd zoeken van McAfee dat u precies laat zien welke sites u veilig kunt openen.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Het is uitgeschakeld omdat de zoekextensie die deel uitmaakt van Extra bescherming, is uitgeschakeld of verwijderd. Schakel deze functies nu opnieuw in.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Beveiligd zoeken van McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} laat u zien welke sites veilig zijn voordat u ze bezo

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2289
                                                                                                                                                                                                                                      Entropy (8bit):5.693595450677752
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Cv4058MjlxcXI9qWiXgwsIvE8QK0tKWhEZ0JILHVI16sSIIRXR6:CQ01jCI9qXXLsIvE8Q5K+EOgVIEsSFXA
                                                                                                                                                                                                                                      MD5:D46D65FD391215103DA972BFEB4AEEE6
                                                                                                                                                                                                                                      SHA1:277298EB45E5010CCB5DF90784CADFBE7AAA911E
                                                                                                                                                                                                                                      SHA-256:ABC58810ABDE7908191E393DBBF4746AB19FCE5AD87002671E43E35308BEA252
                                                                                                                                                                                                                                      SHA-512:88B1A9D613CFA99016640152DA7553B18A1672A27DAAC456FB2E81EF8DF4A41DB10C605C401CDFE600518CC61B0BD9C12B0A2E75C1E0E572FCA6874C8917E3FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Dost.pne jest wi.cej ochrony",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatkowa ochrona jest gotowa",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatkowa ochrona jest wy..czona",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Funkcje Dodatkowej ochrony pomagaj. chroni. Ci. w Internecie. W..cz je.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Konfiguracja zako.czona! Po nast.pnym ponownym uruchomieniu przegl.darki, Bezpieczne wyszukiwanie McAfee pomo.e spokojnie wyszukiwa., informuj.c o bezpiecznych witrynach.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Jest wy..czone, poniewa. rozszerzenie wyszukiwania b.d.ce cz..ci. Dodatkowej ochrony zosta.o wy..czone lub usuni.te. Odzyskaj teraz te funkcje.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Bezpieczne wyszukiwanie McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} pokazuje, kt.re witryny s. bezpieczne,

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2225
                                                                                                                                                                                                                                      Entropy (8bit):5.468802888887182
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvVVlKrZ/ez2L3dpZszSJEufUo7G+DOHbO9R:CNq62LizsUoC7S
                                                                                                                                                                                                                                      MD5:C5479A775A940AB8B006F5AC52D0AEF5
                                                                                                                                                                                                                                      SHA1:B1C2DC285835D9CFFE5D5EC5119BE43B8B845639
                                                                                                                                                                                                                                      SHA-256:D57610A7870EF33E78F512D0E2939326AEEAFE6C92C7C971F68133ACAD088896
                                                                                                                                                                                                                                      SHA-512:D926A25E8F32E9F5BFAAE26E3416E33F8B471D6C038426074F36C4525B3BA052D3E6791D36418B17395491FB9A6CB8B7BFD6E1871941BFE51B5D754725691146
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Voc. tem mais prote..o dispon.vel",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Prote..o adicional est. pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Prote..o adicional est. desativada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Esses recursos de Prote..o adicional o mant.m em seguran.a online. Ative-os.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Tudo pronto! Na pr.xima vez que reiniciar seu navegador, pesquise com a Pesquisa segura da McAfee que exibe os sites seguros de visitar.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Desativado porque a extens.o de pesquisa que . parte da Prote..o adicional foi desativada ou removida. Traga esses recursos de volta imediatamente.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Pesquisa segura da McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} mostra quais sites s.o seguros antes de voc. visit.-los.",.. SEARC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2324
                                                                                                                                                                                                                                      Entropy (8bit):5.472455841275005
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvOb9fKjnZdVrzzHUUFZeEi351TgV4/QbG9yluHNs:CWJmZTLUUFZgLQi9H2
                                                                                                                                                                                                                                      MD5:4C9823C8BEF5A2C734BB53FC9E257DDE
                                                                                                                                                                                                                                      SHA1:FBF3A15F971729070BD00B46CC47CAA462B4B31B
                                                                                                                                                                                                                                      SHA-256:639F197D8F8C3202303433B4BD2840AFF969827666CF9A542A37296389A89EC5
                                                                                                                                                                                                                                      SHA-512:EB716D33547A3ECEC0BFA183A068F1E15DD05B43B08D5FEC44218BBD800551BAF38B7A0B12BF71B1481AEB6E8A3B4AEE637D33F955B81F9D0D49B3033A8DC8A1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Tem mais prote..o dispon.vel",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "A prote..o adicional est. pronta",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "A prote..o adicional est. desativada",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Estas funcionalidades de prote..o adicionais mant.m-no seguro online. Ative-as.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Est. pronto! A pr.xima vez que reiniciar o seu browser, pesquise com confian.a com a Pesquisa segura da McAfee a mostrar-lhe que sites pode visitar em seguran.a.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Est. desativada porque a extens.o de pesquisa que faz parte da prote..o adicional foi desativada ou removida. Obter estas funcionalidades novamente agora.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Pesquisa segura da McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} mostra-lhe os sites que s.o seguro

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3288
                                                                                                                                                                                                                                      Entropy (8bit):5.141059039479208
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:COrsBqgVZBkBuYVCdpLVREi4c1rTZPNiNbdYH99W:CCsBqgVZiuYV8pLV16hz
                                                                                                                                                                                                                                      MD5:22D735EEF522C4E8170F5102EEDDCA1C
                                                                                                                                                                                                                                      SHA1:958829FA45AA5F1BBD8608B231B2119664B7CC09
                                                                                                                                                                                                                                      SHA-256:85EF45E27F4196799E789F2AB383E95AA512C9CA8298BE050E88E0AA413E2D5E
                                                                                                                                                                                                                                      SHA-512:C5C099C5DD551E5D8D11E5519A88C7B0FF9A31C2C874D017F053912C6A8BA7D40968E6113A3655B2807C9DF9C6ECC1FB66E4ADCD5DDC8354F71D3380FC61F0AE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: ". ... .... ...... ............ ... ......",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".............. ...... ......",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".............. ...... .........",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "... .............. ....... ...... ............ ............ . .......... ........ ...",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "... ......! . ......... ... ..... ............ ........ ......... ..... . ....... ....... ........... ...... McAfee, ....... ........., ..... ...-..... ......... ... ..........",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADIN

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2276
                                                                                                                                                                                                                                      Entropy (8bit):5.757275405968279
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdg0FQ8YIcT3JOzrgffdIxL8EHbgnDHKXldVV/aVcFUC7wQi0o0ekfSanwIN7:CvW8zM6pE2VDVGc377SI//Dn
                                                                                                                                                                                                                                      MD5:DA9A233D89807AD112E53DF4098035AA
                                                                                                                                                                                                                                      SHA1:0801012D61EBF23C3F84395E0C015CED5678EEEA
                                                                                                                                                                                                                                      SHA-256:466B8D3ADD30EFAAA43FAB8EF5D08DE24DF27F6D1A55AABCD51A11EBAD036561
                                                                                                                                                                                                                                      SHA-512:D27142F059B5ACD4C6EFC6AF0F598E0E6377409791F1ADD1C2DC9E4459352CA3A1BE443A566A59F67B57E4CF3A57A82923DE2580B40D97824D2533C540A13C40
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Pon.kame v.m viac funkci. na ochranu",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Zv..en. ochrana je k.dispoz.cii",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Zv..en. ochrana je vypnut.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Uveden. funkcie zv..enej ochrany v.s ochra.uj. online. Zapnite ich.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "V.etko je nastaven.. Po re.tartovan. prehliada.a v.s zabezpe.en. vyh.ad.vanie McAfee ochr.ni pri prehliadan. a.zobraz. str.nky, ktor. je bezpe.n. nav.t.vi..",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Funkcia je vypnut., lebo roz..renie vyh.ad.vania, ktor. je s..as.ou zv..enej ochrany, bolo vypnut. alebo odstr.nen.. Z.skajte tieto funkcie sp...",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "Zabezpe.en. vyh.ad.vanie McAfee", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} v.m porad., ktor

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2217
                                                                                                                                                                                                                                      Entropy (8bit):5.546873505900963
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:CvzaSNcoHl5A0Pt0opbUbFpGbQg55EfVL0Bv:C5NH5AatiFpNMcu
                                                                                                                                                                                                                                      MD5:B05426DC1028FBA92476ED1E97886139
                                                                                                                                                                                                                                      SHA1:B15C22AC569DF5AFB856374FBFB31189FE852D47
                                                                                                                                                                                                                                      SHA-256:D09F32E45B16CB2E09059D2AB07D97CE0C1387479016396E4E3CCA95E4998562
                                                                                                                                                                                                                                      SHA-512:112583445439E3B9A2CCAF443A963B3804C308CC19EAD5F019F79E0B8D45EF0E7D4AE3020EF39ADDA4B5C9775433DCE4F44556C1C5F085D6C15E0108528FD17A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Imate na raspolaganju vi.e za.tite",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Dodatna za.tita je spremna",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Dodatna za.tita je isklju.ena",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ove funkcije Dodatne za.tite .ine vas bezbednijim na mre.i. Uklju.ite ih.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Sve je spremno! Slede.i put kad budete ponovo pokrenuli svoj pregleda., pretra.ujte sa samopouzdanjem uz McAfee Bezbednom pretragom koja vam pokazuje koje lokacije su bezbedne za pose.ivanje.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Isklju.ena je jer je ekstenzija pretrage koja je deo Dodatne za.tite onemogu.ena ili uklonjena. Vratite odmah ove funkcije.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Bezbedna pretraga", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} pokazuje vam koje lokacije su bezbedne pre nego .to i

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2111
                                                                                                                                                                                                                                      Entropy (8bit):5.543696804404092
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Cvg5Lf7jC1iVJkbJ1YJbYChTRpe4ScwPJ:Co53MbUJbYChTJSZPJ
                                                                                                                                                                                                                                      MD5:24BB8DA8AB968CD1B7CD5EFC8B031399
                                                                                                                                                                                                                                      SHA1:6CE449ED4A4F0D9DEBBC0B670D59A00B62BA2D1C
                                                                                                                                                                                                                                      SHA-256:124ABE68CEBA14043CDC616E2C63D8917A1560F8517B4757C74D8BDBC3B8EFE9
                                                                                                                                                                                                                                      SHA-512:0899F7F92DD79C9852A7E4004F76E6D007807B2A81F04B9F46CE50A1A0EB5E47F6717A6AAD46B01C13EB3BAEAAE9F50558BB45F26645518C83984E17FC6F6281
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Du har mer skydd tillg.ngligt",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ut.kat skydd .r redo",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ut.kat skydd .r av",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ut.kat skydd-funktionerna h.ller dig s.krare online. Aktivera dem.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Klart! N.sta g.ng du startar om webbl.saren kan du s.ka tryggt d. McAfee s.ker s.kning visar dig vilka webbsidor som .r s.kra att bes.ka.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Det .r av eftersom s.ktill.gget som .r del av Ut.kat skydd inaktiverades eller togs bort. F. tillbaka funktionerna nu.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee s.ker s.kning", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} visar dig vilka webbsidor som .r s.kra innan du bes.ker dem.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "Annonsblockering", .. SEARC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2206
                                                                                                                                                                                                                                      Entropy (8bit):5.575774364688543
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdg/UOH95vCfoXiRvLa/sGcdDSqi+2O1ebxZQ25BMblR/B2sK3SZ/Z9vKlmCX:CvSG/GoSqi+Z7bQspvKG68ddHO
                                                                                                                                                                                                                                      MD5:31B4A818999F869C3F9D44F0BFAA17EF
                                                                                                                                                                                                                                      SHA1:18476D058236619E2858AB88CBAC5CC1046458D9
                                                                                                                                                                                                                                      SHA-256:67776DD645C1890363D09DBD04DB8ABAE442C47B984926DBB61633874E622ECA
                                                                                                                                                                                                                                      SHA-512:253FD4EEB0B9F9B6E50386C405722371BFAF717796F9B4C75FA97A40C69971D91CDE54ADD324E0A27CC51D90E1B040950BF58DA162511EB1156124BBCC6A9CA8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: "Daha fazla koruma se.ene.ine sahipsiniz",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "Ek Koruma haz.r",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: "Ek Koruma kapal.",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "Ek Koruma .zellikleri sizi .evrimi.i korur. Hepsini a..n.",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "Her .ey haz.r! Taray.c.n.z. bir sonraki ba.lat...n.zda, hangi sitelerin ziyaret edilebilece.ini g.steren McAfee Secure Search ile g.venle arama yap.n.",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "Ek Koruma'n.n bir par.as. olan arama uzant.s. devre d... b.rak.ld... veya kald.r.ld... i.in kapal.. Bu .zellikleri hemen geri al.n.",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee Secure Search", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0} ziyaret etmeden .nce hangi sitelerin g.venli oldu.unu g.sterir.",.. SEARCH_TOAST_ADBLOCK_BU

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2043
                                                                                                                                                                                                                                      Entropy (8bit):6.269213588165262
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOZgVstn8dWjt8EWNjtM7LLyllJtjEcjt/dcz58qNAMdstxjl7BnwIj8WvPJb4:CjBt/wppKWMGzRl9Tc
                                                                                                                                                                                                                                      MD5:27FC42112C8774D79FE7F38F66CC78EA
                                                                                                                                                                                                                                      SHA1:9C1ED6314E0C4ABE96B19618226A42D357E31D64
                                                                                                                                                                                                                                      SHA-256:E15A74C80A1DA6EB4093EDE2B8AB165693EBF82F580199494C18CB44DA6C7455
                                                                                                                                                                                                                                      SHA-512:C7D3F4670E555C1D5B9B62AF5AE3B2DE964BFFA69B790FACDD406C7AC7085C9AFD8FA82C8F44E5059E75932545E5731E101C8047F536F01D09E031B09362E88D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_ADBLOCK_HEADING: "..........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: "..........",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "...................... .....",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "..... .................................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: "........................ ...........",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: ".......", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: ".......{0} ..........",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2: "......", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_2

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2123
                                                                                                                                                                                                                                      Entropy (8bit):6.276375097282816
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdgQyNha9y+lmmhIlHCbMKEW2+Z8d/9t6Hj4mQjKKgcjSlMXmIyuiSlGlSBYx:CvaX+Mm6t8MZoD+KKtSr5FlITWiyv9R
                                                                                                                                                                                                                                      MD5:D67C4BE258B6A5B138519361D4336203
                                                                                                                                                                                                                                      SHA1:2F89EE3093715E40469FA2EF519C53A1FBAB1AB6
                                                                                                                                                                                                                                      SHA-256:22C8E78F51D823C588A37B1205E6DEE2DEFEF49CD9873E34C333AD94A0566333
                                                                                                                                                                                                                                      SHA-512:51D308902A38FEF1053DC1D9BBA5259E8C433A999ADD2325E52063A8617CF50CE4542F34DD174D96AC5AE294B3B307397B6D2E7773255C00CF145F7F70E9D1DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_ADBLOCK_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_READY_HEADING: ".........",.. SEARCH_TOAST_ADBLOCK_REENABLE_HEADING: ".......",.. SEARCH_TOAST_ADBLOCK_SUB_HEADING: "............................",.. SEARCH_TOAST_ADBLOCK_READY_SUB_HEADING: "................McAfee ..............................",.. SEARCH_TOAST_ADBLOCK_REENABLE_SUB_HEADING: ".............................................",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_1: "McAfee ....", .. SEARCH_TOAST_ADBLOCK_BULLET_NORMAL_1: "{0}.......................",.. SEARCH_TOAST_ADBLOCK_BULLET_STRONG_2:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):908
                                                                                                                                                                                                                                      Entropy (8bit):5.696241443857236
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HUDAS6FXOqZG1g4zBFU+K6IPHf7q4qtoxmqDR3nC8+U:7HbzFOKGy16IPTq4pDRy8z
                                                                                                                                                                                                                                      MD5:DD3EB93CFAD57A236C56A67FB7AD27BD
                                                                                                                                                                                                                                      SHA1:6725B767017A6ACB38A7762F84D58E8338E7E390
                                                                                                                                                                                                                                      SHA-256:6D8BD93EC30E7C6953F30F1C52FE28CDF79939BDC62397A0CEE216F14E89545A
                                                                                                                                                                                                                                      SHA-512:88D7EC9B31E932A4C914979E8F9FC3466EC3925DA85469318E0AD1FAB959047FE6DBC1DC069583AFD57CC8809D404A1F05C3F7AC4FE796A1325FA48953AA2F41
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nem.te slu.bu Bezpe.n. hled.n. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. prov.d.n.ho pomoc. vyhled.va.e Bing upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT: "Chcete vyhled.va. Bing doplnit o slu.bu Bezpe.n. hled.n. a b.t v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_SUB_FOOTER: "Po restartov.n. prohl..e.e zapneme slu.bu Bezpe.n. hled.n. a nastav.me vyhled.va. Bing jako v.choz..",.. SEARCH_TOAST_YES: "Ano",.. SEARCH_TOAST_NO: "Ne, d.kuji",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Zapneme slu.bu Bezpe.n. hled.n. a nastav.me vyhled.va. Bing jako v.choz.."..}..//D7EB2E15A2D79597DB8F40F5083DBAE181A55570F4ED79308B7B1DC57D78F01829B4F39E5D6D7810B4116C5FEBB7F979514F2911CB1788FC63390A39458A9552++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):807
                                                                                                                                                                                                                                      Entropy (8bit):5.47273821285326
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HaufsEtijFTUd42Vd+PQhF2FAZeP/dHIpn:++s9TUd42Vd+Y3Vetopn
                                                                                                                                                                                                                                      MD5:A8C3214F1586406617F656FC1DD0ADEC
                                                                                                                                                                                                                                      SHA1:A154A57FB180B327110722D2855E99AEEEADC491
                                                                                                                                                                                                                                      SHA-256:C200CBFC4E420DEA2449FDE09C6444AA7DF7F76937AB1315CC943903C1E73296
                                                                                                                                                                                                                                      SHA-512:696686241938EEC2B1F74ED81DDD78F5C970826F9057EFF2C9C05C11465336430C1C74A9E4FD0A743581A1E94D770674F374105D775E2E94101FA5740C2B85D9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har ikke sl.et Sikker s.gning til . s. v.r forsigtig!",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning leder dig v.k fra risikofyldte websteder i Bing-s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT: "Vil du f.je Sikker s.gning til Bing, s. du undg.r at komme ind p. grimme steder?",.. SEARCH_TOAST_SUB_FOOTER: "Vi sl.r Sikker s.gning til og .ndrer standards.gemaskinen til Bing, n.r du genstarter browseren.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nej tak",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi sl.r sikker s.gning til og .ndrer standards.gemaskinen til Bing."..}..//17E2B22C86716230707468D6124D7090117EB949499397E6EA74F15018667CA2E9D5DDEC4C672AEECFCEF2936B2F9D3D463A2D24A7E80550BDAA1B6018BF8424++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):863
                                                                                                                                                                                                                                      Entropy (8bit):5.342626850424149
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HGgFJZ+X0qvX66Q+3F2wlPQ+1EbieAeZ6:SAJZcVQ+VjVQ+1wieAeZ6
                                                                                                                                                                                                                                      MD5:984A84E9EB0DF6990A5CA3BA724B530D
                                                                                                                                                                                                                                      SHA1:6F4BD231789F7A1BD46F994F785476DC29667313
                                                                                                                                                                                                                                      SHA-256:520764E44EDFF4530473733213179C3080361436EF2B13638B55B3A8029181CE
                                                                                                                                                                                                                                      SHA-512:9AE5BAD02EED8328D480E7E54E907D67C382D3E43BA2028E2839067510D206E814E855C3D8D09137B8351F3A91C9D8B0B3BCFC9BFD4A89F4BE15AF38DDE6FA78
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Die sichere Suche ist nicht aktiviert . seien Sie vorsichtig",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Bing-Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT: "M.chten Sie die sichere Suche zu Bing hinzuf.gen, um Kriminellen immer einen Schritt voraus zu sein?",.. SEARCH_TOAST_SUB_FOOTER: "Wir aktivieren die sichere Suche und .ndern Ihre Standardsuchmaschine zu Bing, wenn Sie den Browser neu starten.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nein danke",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Wir aktivieren die sichere Suche und .ndern Ihre Standardsuchmaschine zu Bing."..}..//CBB43CC5690BD038A2C9F7B1B839D27E63D21EC139ADDAB553E9856DE1108F7234CF148D821C8D640CCE92F107696F10D2BD60C64ACA78CAC2A740DA131DFF0C++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1522
                                                                                                                                                                                                                                      Entropy (8bit):4.961078917753637
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HB3IsMXLr2bnATla3ybWG2hbiLy+wgjxUbiPjghEa3V:W2UTlaLvbiVGbibghES
                                                                                                                                                                                                                                      MD5:FD9D39C2CFFE3721AAC272095F403247
                                                                                                                                                                                                                                      SHA1:E31565B1A9E0037D288C5210A9641ED0B12C1D7B
                                                                                                                                                                                                                                      SHA-256:CF96779344B9198ED791D9619656F6821250BBC43D98509321F4A713736D7782
                                                                                                                                                                                                                                      SHA-512:45D234AFB354AF918D505A5408C508B97701DBDC774F6CC3A967F4EB1455C937A2376D6328D3BC36F5F4EE7F3A6A210D5462D3E231057D856B185AB6453B5AF5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "... ......... ... ...... ........., .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ .......... ... ... ........... ... ......... .. .. ......... Bing.",.. SEARCH_TOAST_BODY_TEXT: "...... .. .......... ... ...... ......... ... ......... Bing ........... .. ..... ..... ... .... ....... ... .... ............. ...........;",.. SEARCH_TOAST_SUB_FOOTER: ".. ............... ... ...... ......... ... .. ........ .. Bing .. ............. ......... .......... .... ... .....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):780
                                                                                                                                                                                                                                      Entropy (8bit):5.351505252116324
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HdW9H3npSuVNTzLo4uiJH7IyOtS9eDqt1IyX3G6TPDXqJKen:7H8XpSuVNTzxcCeD7MTPLden
                                                                                                                                                                                                                                      MD5:33B5D4E23441E8CDFA7823C883E8DC4E
                                                                                                                                                                                                                                      SHA1:D3579E81762BE74A21B18C41264D1FE132C9DF8E
                                                                                                                                                                                                                                      SHA-256:2A034AF44E3438B62F295FFCC14779101307AF4859B87171285A41944CB441A4
                                                                                                                                                                                                                                      SHA-512:9F5228D13BADBB67E03F2C78170F93B34FB9F6F5D2D4DF5B9F7068AF4A856984C6707461D3359F304F0F791AAF78A575EBC9440083CA2AD741881F44DD25B91B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "You don't have Secure Search . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your Bing search results.",.. SEARCH_TOAST_BODY_TEXT: "Would you like to add Secure Search to Bing and stay ahead of the bad guys?",.. SEARCH_TOAST_SUB_FOOTER: "We'll turn Secure Search on and change your default search user to Bing after you restart your browser.",.. SEARCH_TOAST_YES: "Yes",.. SEARCH_TOAST_NO: "No thanks",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "We'll turn Secure Search on and change your default search user to Bing."..}..//3572B3EC5B96E0F453F52C9E4EEF39B10422EA66B892E912C0AC5FE7C3BBA2D6F765A72FD10A7A2234D87166AB0E02749010A06B5B8CDD3A39F4F1B19E656836++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):834
                                                                                                                                                                                                                                      Entropy (8bit):5.410440212659386
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HTOW06YIJHM8MEIoyLLQZSUJHHrSXXY0Vqt15ZSUJk8jjDhgT3ZWR:7HqpQJHM8MnoyEpmHYGm5e87huUR
                                                                                                                                                                                                                                      MD5:64FA1A2146949BA2CE54A2C21CAEDEB8
                                                                                                                                                                                                                                      SHA1:0604273B4AE5A3806B7E40D59104651EA798B57A
                                                                                                                                                                                                                                      SHA-256:EC4A20CC30EAC23D0E6E5C3DE5E5DB22B0835A0E5379035510318FCE0668471F
                                                                                                                                                                                                                                      SHA-512:B44575C3D1A60C497C1B7C2AF19269AF01F6CA07BD571E1789379817E3CC326DA1FA7816DACB9443468F844175834D7547312EECFB74E37AEFFA93DC5E8C0ACB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "No dispone de B.squeda segura, tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura elimina los sitios web peligrosos de los resultados de sus b.squedas en Bing.",.. SEARCH_TOAST_BODY_TEXT: ".Le gustar.a a.adir B.squeda segura a Bing y olvidarse de los malos?",.. SEARCH_TOAST_SUB_FOOTER: "Activaremos B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing despu.s de que reinicie su navegador.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, gracias",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Activaremos B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing."..}..//AD4D9869FF7C931A6EE9C8188F2C40B6BEFB49285151A178DF339E3F4578DC51B4DB016F088D01F5BD10713BD152B02C1973717C2D3C64B943A144D72EF64D22++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):848
                                                                                                                                                                                                                                      Entropy (8bit):5.368189199328249
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HT9+6YzsinKM8MEIe4LyO3KVoqZSUJHHrSXXY0Vqt1BbSUJbTpYnKETh:7HCsiKM8Mne4X3QpmHYGmbxTpKNh
                                                                                                                                                                                                                                      MD5:2256AA263A7FFD9F065A11C9E8B2F474
                                                                                                                                                                                                                                      SHA1:0715100326101923F8953CA06FB14D9DEFF48020
                                                                                                                                                                                                                                      SHA-256:D33F96BAA5CA443B31B663B1488FE03CDBDF3E6C7EABFFF4768671651D81B964
                                                                                                                                                                                                                                      SHA-512:E21DCF768DC8E7F526608262582EE407EF9CF8239A527B92782DD7E69354928CB12823810E3FC6902DCB3990EAE0923ED9AAF59D6D95DB59A2AD0C9758D67F2F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "No tiene b.squeda segura: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura lo aleja de los sitios peligrosos de los resultados de sus b.squedas en Bing.",.. SEARCH_TOAST_BODY_TEXT: ".Le gustar.a agregar B.squeda segura a Bing y mantenerse por delante de los malos?",.. SEARCH_TOAST_SUB_FOOTER: "Activaremos la B.squeda segura y cambiaremos su motor de b.squeda predeterminado a Bing despu.s de que reinicie su navegador.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, gracias",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Activaremos la B.squeda segura y cambiaremos tu motor de b.squeda predeterminado a Bing."..}..//8C18292FED9BF5DEA2CD9FBA50BE97B4BBC3AA57198F476873FB4E128F8A80FA44406056C5CFF292A644F1E087F93B02D8371A3F56A66E8BC85FFCC56E4564BA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):837
                                                                                                                                                                                                                                      Entropy (8bit):5.413595987636439
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HMljiYYtHMjpJNnR9k9flAgPMfoRGpWfUfqt7foRjG8rCQbnYI5hn:7HQ2htHsNn+dWfoRVfeEfoRJFbYIb
                                                                                                                                                                                                                                      MD5:01E041903397BBD803C9A41B39680EE5
                                                                                                                                                                                                                                      SHA1:63E1302DAFD6BDB52527AC711180F9109A5104CA
                                                                                                                                                                                                                                      SHA-256:0E2FBA1D2DC805FDC2F61338758B29710C55CCD98A1A0C0754079BE7711DA3A9
                                                                                                                                                                                                                                      SHA-512:4C40AAF6A4BAB8D793600557922A9BE784E0DE17923756181AAD9E19FB96423AE19E0274BBFD17AE1DF5F131DAED7D14FD1E0B7A7FC471575D11AF6ADE92AAB9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sinulla ei ole suojattua hakua . ole varovainen",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat Bing-hakuja.",.. SEARCH_TOAST_BODY_TEXT: "Haluatko lis.t. suojatun haun Bing-hakukoneeseen, jotta pysyt jatkuvasti muutaman askeleen rikollisten edell.?",.. SEARCH_TOAST_SUB_FOOTER: "Suojattu haku otetaan k.ytt..n ja oletushakukoneeksi muutetaan Bing, kun k.ynnist.t selaimen uudelleen.",.. SEARCH_TOAST_YES: "Kyll.",.. SEARCH_TOAST_NO: "Ei kiitos",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Suojattu haku otetaan k.ytt..n ja oletushakukoneeksi muutetaan Bing."..}..//9B162E46E49C55FE52EB159C5E336BC07FB14F3710C03576967ECE86BE1AFF0275EDFC643D4DD27F5E81429DAA30B5999D23FC4033A704150F1B82297618970B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):927
                                                                                                                                                                                                                                      Entropy (8bit):5.367945636332484
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HW5WFTGeg5rqskm8wwbY6xQam8wwbYp1oOfLi:uWFTGeg5Wwv6Bwvpq
                                                                                                                                                                                                                                      MD5:735E07D182A659392D5E36CD8564C9A4
                                                                                                                                                                                                                                      SHA1:3099997B07EFE9EC6C0E29CF1AB3302FCA5C3D4A
                                                                                                                                                                                                                                      SHA-256:2350FCBF7993D758897689F974EDC97558C7C488A89AF6EDAA23371ABA991DA6
                                                                                                                                                                                                                                      SHA-512:F8D45D88B606762F746AC955F8A97DDCA0D039D157487503893AEF2450B94A10259CA3AD348FB2F9C1F1AD40F6C5064158EBED099DE4139F1741F60BED32FDE8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attention! Recherche s.curis.e n'est pas install.e dans votre navigateur.",.. SEARCH_TOAST_SUB_HEADING: "Recherche s.curis.e vous met . l'abri des sites Web dangereux figurant dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Souhaitez-vous ajouter Recherche s.curis.e au moteur de recherche Bing et d.jouer les escrocs?",.. SEARCH_TOAST_SUB_FOOTER: "Nous activerons Recherche s.curis.e et configurerons Bing comme moteur de recherche par d.faut apr.s le red.marrage de votre navigateur.",.. SEARCH_TOAST_YES: "Oui",.. SEARCH_TOAST_NO: "Non merci",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Nous activerons Recherche s.curis.e et configurerons Bing comme moteur de recherche par d.faut."..}..//296B3AE03EB2D7BFBB0F186D36F0F9E259E40494184686308D86F1B94AF369B7016746D61EC238990A28C63894FF20BDFF7609367FEA89A49786D602530749DC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):940
                                                                                                                                                                                                                                      Entropy (8bit):5.364304281579993
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HNL7EemtP5RTOpwemfw8uWY6xxAamfw8uWYFrxyf:R7EemtPaiwX6CwX4
                                                                                                                                                                                                                                      MD5:236667171852EF648521EF5B366443BF
                                                                                                                                                                                                                                      SHA1:CF15ED38382501ECEC3A8D2B155BE19D28D494E7
                                                                                                                                                                                                                                      SHA-256:6ACB967A8769208ADD33DDD92A6C44DCB6C1746421A0131E5E98C44F8F5DDAE8
                                                                                                                                                                                                                                      SHA-512:7461E755BEA89B29D0A23C3A4817E076829A8EA2FF9343D823A2ED9725576112C5B0843162C4217D6A1960DF97975E7C7920E7953ED8FDB1FFD498CA48C9C406
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Soyez prudent, vous ne disposez pas de la recherche s.curis.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche Bing.",.. SEARCH_TOAST_BODY_TEXT: "Voulez-vous ajouter la recherche s.curis.e . Bing et garder une longueur d'avance sur les personnes mal intentionn.es.?",.. SEARCH_TOAST_SUB_FOOTER: "Nous activerons la recherche s.curis.e et d.finirons Bing comme votre moteur de recherche par d.faut apr.s le red.marrage de votre navigateur.",.. SEARCH_TOAST_YES: "Oui",.. SEARCH_TOAST_NO: "Non, merci",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Nous activerons la recherche s.curis.e et d.finirons Bing comme votre moteur de recherche par d.faut."..}..//6BC507515415E4D4E6A970BEBA7E853F6DDDF786145A9E40422517F4D2E872C37B73364D9716F65B74188B3212124E7AAF108A9ACA0C4422C8D88881344AA791++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):798
                                                                                                                                                                                                                                      Entropy (8bit):5.445519478078725
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HM+9DuIg9sCZwzJl//L9hd9MuGvPJHCqtL9MuGtcqD0COjJGNOjR8ue3e:7HMogol25vxHCD5uqwCBsjBeO
                                                                                                                                                                                                                                      MD5:F63EF0EDBA3F7F47C6001BCCC9081AA7
                                                                                                                                                                                                                                      SHA1:6B66CDEACE72C521FF3A5AD4280A1B53410B89ED
                                                                                                                                                                                                                                      SHA-256:BF0DA0B58390029FF6F01DB672F95AABDF2BE3E4D9607D76B3E48162AFA862B3
                                                                                                                                                                                                                                      SHA-512:18C3F4DD438BEF24D320670F26CBECD74091FF49559F3C9A8D91FFCEC9A84EBA87B22B4D04C6A4C96DF2237AAE1770CA14789404ABD828871CD28B0E13615FD5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nemate sigurno pretra.ivanje - budite oprezni",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata Bing pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT: ".elite li dodati sigurno pretra.ivanje na Bing i ostati ispred?",.. SEARCH_TOAST_SUB_FOOTER: "Okrenite sigurno pretra.ivanje i promijenite zadanu tra.ilicu za Bing nakon ponovnog pokretanja preglednika.",.. SEARCH_TOAST_YES: "Da",.. SEARCH_TOAST_NO: "Ne, hvala",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Okrenite sigurno pretra.ivanje i promijenite zadanu tra.ilicu za Bing."..}..//FF26113F8919556172AA2BC37C22B26D3FA4C542F4317596D0097D13D9284DD5F8E5CF67A60111F5CB4C764C8DAE658BD2E2BCABF6CC1347F49E37FF905A05A8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):922
                                                                                                                                                                                                                                      Entropy (8bit):5.580797666794498
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HL8d6oBd5US6Xdd7qQpuYeBdyEpFnY45EgpuYeBddpFtyXdM:q6ojijX/+QpuJjTYH+uJjj6M
                                                                                                                                                                                                                                      MD5:C06E19A977F89C7C5AE85A66858095A5
                                                                                                                                                                                                                                      SHA1:077F9BAFFE643F1A3596532870D694B4E21276D6
                                                                                                                                                                                                                                      SHA-256:12FC4F66F509BB73DA40762544CF5F83424DBA6DF6256274586E4F289DCA03B6
                                                                                                                                                                                                                                      SHA-512:1C92C05349800F641BEE7790812B41985C4EF6A9008459BA6B20803313817E95DFEA867438B4853E20CDB4DC1419203228ECC94F518F2C0B199516F0A375BB23
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nincs biztons.gos keres.s funkci.ja . legyen .vatos",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a Bing keres.si eredm.nyei k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT: "Szeretn. hozz.adni a biztons.gos keres.st a Binghez, hogy n.h.ny l.p.ssel mindig megel.zze a rosszfi.kat?",.. SEARCH_TOAST_SUB_FOOTER: "Bekapcsoljuk a biztons.gos keres.st, .s a b.ng.sz. .jraind.t.sa ut.n az alap.rtelmezett keres.motor a Bing lesz.",.. SEARCH_TOAST_YES: "Igen",.. SEARCH_TOAST_NO: "K.sz.n.m, nem",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Bekapcsoljuk a biztons.gos keres.st, .s az alap.rtelmezett keres.motor a Bing lesz."..}..//471C611C98D3BA8221C1ACA0A99109228A467912EB9CB1F7F6AF71BF86C83AE891BF60E895200AE9E1A63C51F66D79F9F19E61C23BCFD441826D4E787A9C8A5C++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):819
                                                                                                                                                                                                                                      Entropy (8bit):5.271148302854568
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H1J1Z2psz/XEKapHoCv815HFl+pqtKHoCv8FC+hHDQ0sE:7HB8OXEhpICvoFlIhICv5eHDpsE
                                                                                                                                                                                                                                      MD5:BEF2FA55D0CFE8B5271EB3317B400AFF
                                                                                                                                                                                                                                      SHA1:D6E84964A6CEA618AFF8532232ACD7CD8363128C
                                                                                                                                                                                                                                      SHA-256:4AAED94035BE232F25668FC307BB5CF244BB6B2598A5D5D96059270DCCD5CA0F
                                                                                                                                                                                                                                      SHA-512:9636B0D2E9A1399807826F6571C541570ADA57DB6826775558929B8BE80F4FA4577D5F9C83AB6CF781043EE76EC08F06F3B0BDF7835A1AE6218C87532FB616FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attento, non stai usando la ricerca sicura",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche con Bing.",.. SEARCH_TOAST_BODY_TEXT: "Vuoi aggiungere la ricerca sicura a Bing e tenere alla larga i malintenzionati?",.. SEARCH_TOAST_SUB_FOOTER: "Attiveremo la ricerca sicura e imposteremo Bing come motore di ricerca predefinito dopo il riavvio del browser.",.. SEARCH_TOAST_YES: "S.",.. SEARCH_TOAST_NO: "No, grazie",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Attiveremo la ricerca sicura e imposteremo Bing come motore di ricerca predefinito."..}..//A94CF7A8F20E7D838A2EF39EBEA9C85B84E062DB01DFEE8FF87194BD733AD683846F5323706D6B8BB054F22F44925091F7F4F116A9C769ADDEBAB2930D6FB7D9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):943
                                                                                                                                                                                                                                      Entropy (8bit):5.7284548371061454
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7H8PQbHaQ4gy2XLCreYv6RlqkYvwLHCnxWmFfP:4PQzanP2XLInvKc1vwLHCxBB
                                                                                                                                                                                                                                      MD5:DE01EB6387B38E1E0EE3448AB7F782DA
                                                                                                                                                                                                                                      SHA1:1FF3EDA3605D809CCB2FBA0EA76DC36833F951E1
                                                                                                                                                                                                                                      SHA-256:E1059730310785486F3B86F6EE15728A243309E209762A170AF4A0F856792215
                                                                                                                                                                                                                                      SHA-512:7511D0A40EF12356FFF670D1D95FE5DED6AC1EE8FC30558AA9422DE9A7F354E259F35DF40CA24D615A5B296AF790C0E58CCDB125BBAA9DC605C5F5F4237E801F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".... ..........................",.. SEARCH_TOAST_SUB_HEADING: ".... .....Bing ....................",.. SEARCH_TOAST_BODY_TEXT: ".................. .... Bing ........",.. SEARCH_TOAST_SUB_FOOTER: "................ ...................... Bing .......",.. SEARCH_TOAST_YES: "..",.. SEARCH_TOAST_NO: "...",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".... ....................... Bing ......."..}..//58DB55B3768E0E6E5B5492445CE9B4E38FB5F9BBDA9B546A5B090B8EBCEB8E96149E38216C1E37F3BC813D568C76D476AC69C4BF160C8D4A9B4466B0FF469418++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):823
                                                                                                                                                                                                                                      Entropy (8bit):5.90121582199106
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HN1I68EVZFj2F/40kOv8k16xQl07Cqtk16xQl8QxXenV1vg8EVb:7Hx9E7ka8kg7CtgcevIbt
                                                                                                                                                                                                                                      MD5:190F5726DCF5FB58506EE92817E8D160
                                                                                                                                                                                                                                      SHA1:BB13E30432E3DFFD21329DBFFD2988DABE0F73D8
                                                                                                                                                                                                                                      SHA-256:6CE05219284984C0C84E81A3D76155C0E56A4DFD0C3E8544BAA6A96366C68FD1
                                                                                                                                                                                                                                      SHA-512:1367264FB7565CEF51D3C4803A9D6601BD02F92C361C19202359BEADCC6E3792D83E0B58A645034375E8C9500386706C09FC090D41CCE836A23C126BB562B75C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".. .. ... .. - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... Bing .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT: "Bing. .. ... .... ... .. ........?",.. SEARCH_TOAST_SUB_FOOTER: "..... .. ... . .. ... ..... .. .. ... Bing.. ......",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "...",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".. ... ..... .. .. ... Bing.. ......"..}..//6505EAE079072CF03C35A0BCF324EDF0D051C9A29CE6A157D13EA99A3269B773D7EDD57CF7CE2765BA0CD491BBC4C1E07B1385B92D348479FD502592D69CEB51++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):759
                                                                                                                                                                                                                                      Entropy (8bit):5.397673684344552
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H4jM/QjBU4dkyU/6FkbS7CWJCYfUfGKF2cFqtEFJCWJCYfUqdDigYc6u:7H0MojXdUCFHtrfyGKF2yZtrfbdDigbp
                                                                                                                                                                                                                                      MD5:2E99E308D1F2109E3EB5673418D1E170
                                                                                                                                                                                                                                      SHA1:D4069DCB8A7807B36F899B7E37120789948C6505
                                                                                                                                                                                                                                      SHA-256:757AA5D109D04E8736E95CE0DAC5DE31C355B3BCD87BECC41C266E6BB02DDD72
                                                                                                                                                                                                                                      SHA-512:4811D2C0DFE9EABCC48474D427ACCFB961D992929FB5D5C92D93E555E6D09C1B5E23AAB412A08381C0EDE200F75F5E572E3410A2BD9E9EB08F3A630ABF7A5710
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har ikke Sikkert s.k - v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna skadelige omr.der i Bing-s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT: "Vil du legge til Sikkert s.k i Bing for . ha et forsprang p. skurkene?",.. SEARCH_TOAST_SUB_FOOTER: "Vi sl.r p. Sikkert s.k og endrer standard s.kemotor til Bing n.r du starter nettleseren p. nytt.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nei takk",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi sl.r p. Sikkert s.k og endrer standard s.kemotor til Bing."..}..//5F0ACA02384B0B1DDEDDEA4E622C6ACFBBA9AC775E501D9AA7BCD803CE206F4D00DDA9AA4B2C4E834447944DBB382629EA1E7B92C97E8AA6639D3B2445535F5A++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):807
                                                                                                                                                                                                                                      Entropy (8bit):5.371941033340013
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HrtakxOEfqPZq7oYde5XPCF2sbde5XXg4ivXv:vkk8jPtYwRoDw/ivXv
                                                                                                                                                                                                                                      MD5:6ACA59654E636A6256A885C5FF7AB285
                                                                                                                                                                                                                                      SHA1:A362EB6309DEBDF4B4C7B3A84CCC53545EFE7A97
                                                                                                                                                                                                                                      SHA-256:15D4F2213D58FE81AE887323842D53C371C44304F721651D2A182C567B00D09C
                                                                                                                                                                                                                                      SHA-512:B6F063277F94B87C323F31ECECDEAB7E0579CEC3E996690E175EE212ABACA18C99FA2557F0F6EAF4DB98E8FB2C7C35788EF8E5EA6AB004D14126E351B3C4BDF1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "U hebt Beveiligd zoeken niet: wees voorzichtig",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten op Bing vermijden.",.. SEARCH_TOAST_BODY_TEXT: "Wilt u Beveiligd zoeken aan Bing toevoegen om criminelen een stap voor te blijven?",.. SEARCH_TOAST_SUB_FOOTER: "Wij schakelen Beveiligd zoeken in en maken Bing uw standaardzoekmachine nadat u uw browser opnieuw hebt gestart.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nee, bedankt",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Wij schakelen Beveiligd zoeken in en maken Bing uw standaardzoekmachine."..}..//90A3C2CC16DD6E61DF50513E9CF12D4ACEBB880C8488D129EF4128793ADBABEFEFD3CC681DDAFC05DA209CAC09F7E42F310A0E32E4D5592DB871020DCF1DF2DA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):840
                                                                                                                                                                                                                                      Entropy (8bit):5.569683330534252
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOnXZoB12oBsflpBcPMfaBpgXJveZsBpgXJM2oES:qXZI12IAdcMGaX7aXmpES
                                                                                                                                                                                                                                      MD5:29AF94AE64518FABD05859E537859B27
                                                                                                                                                                                                                                      SHA1:8D3235231EDB044ADCA790A4EC661593A0C47783
                                                                                                                                                                                                                                      SHA-256:335098AEA3C6AD604D368E8874F18C00DF4DC2362DC774AA1809D8D8588433A5
                                                                                                                                                                                                                                      SHA-512:5DD5A6E06D88CD4FDBEC8F3320F5A30BF63314B1A986B41ED92971812302E5C862197DDEC81D5D4B2845A351C1B650CFFFB7F1B37BBE087581B11BBDB681044A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Uwa.aj, nie masz wyszukiwarki Bezpieczne wyszukiwanie",.. SEARCH_TOAST_SUB_HEADING: "Bezpieczne wyszukiwanie eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT: "Chcesz doda. bezpieczne wyszukiwanie do przegl.darki Bing i uprzedzi. zagro.enia?",.. SEARCH_TOAST_SUB_FOOTER: "Po ponownym uruchomieniu przegl.darki w..czymy bezpieczne wyszukiwanie i zmienimy domy.ln. wyszukiwark. na Bing.",.. SEARCH_TOAST_YES: "Tak",.. SEARCH_TOAST_NO: "Nie, dzi.kuj.",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "W..czymy bezpieczne wyszukiwanie i zmienimy domy.ln. wyszukiwark. na Bing."..}..//1416BAEAA1E8DC9FB01CC5942B7AB32E55C269AC1C447F8C8E0C5A4DB34067B054951D5DF878B3FF22D63DE711A63AC949E05F1A448BCFC873064D418B8B3AED++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):836
                                                                                                                                                                                                                                      Entropy (8bit):5.285589242432961
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HEJVEPlVLVGGWF/7Qy7XTLYG7MJgZ6GuISWM8jgqtNpG7MJgZ6Gu9dw1bYgkeKT:7HouiF/rDTLdtZy6MTZtZy9dw1kglRMn
                                                                                                                                                                                                                                      MD5:186BA2F89FFD742BCD852FD64928555F
                                                                                                                                                                                                                                      SHA1:C78CAAF5419A0D97149A5E37EEDFDDD4C6291C90
                                                                                                                                                                                                                                      SHA-256:0B2ED9A1F7D9AE3A7D49C39D77129865A2D8B555EFD32817A12C8FF8A0A0360A
                                                                                                                                                                                                                                      SHA-512:A24A7BC4B22C7D8C6B0DEEA5E513061E71AB56ABD98491222B864B70A863DDE3184E733EF3824DDEA22E32EA358629B7E46ED652815778F77501C55675D7F46C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa segura n.o est. ativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura evita os sites perigosos nos resultados da pesquisa do Bing.",.. SEARCH_TOAST_BODY_TEXT: "Gostaria de adicionar a Pesquisa segura ao Bing e se antecipar aos criminosos?",.. SEARCH_TOAST_SUB_FOOTER: "Ativaremos a Pesquisa segura e alteraremos seu mecanismo de pesquisa padr.o para o Bing depois de o navegador ser reiniciado.",.. SEARCH_TOAST_YES: "Sim",.. SEARCH_TOAST_NO: "N.o, obrigado",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Ativaremos a Pesquisa segura e alteraremos seu mecanismo de pesquisa padr.o para o Bing."..}..//3DFC3ED64CF5624A5C95AB95672C228197C6D2946C2630444B8C504FF1BCCAAC7D78C10DB0C2369ED9A1D5CCBCD237394E6FB02902E2180E9FEF0141B33CBC75++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):823
                                                                                                                                                                                                                                      Entropy (8bit):5.326116036965008
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HR7EVLOEcQWFnQgj7366Jb7yg4HjSa8jgqtMJb7yg4HjmHmnKkiej/hUB1pfpN:7HRrnFjjhJbOg4uaTRJbOg4UmUffpN
                                                                                                                                                                                                                                      MD5:814E9FD99597DF428A1C96BCA8EF54D3
                                                                                                                                                                                                                                      SHA1:747780C6757006DF7C37507C6CF3D2C386088D03
                                                                                                                                                                                                                                      SHA-256:5FD74B8D86978592C99797C82C9B5DBCF4DF39A4966FC9D49122201EBB9DEE00
                                                                                                                                                                                                                                      SHA-512:148A23C5A74B80DE5122270267FDDC2A788340493E32027D9E399C09111EF5E546400067411BE805F1E071D8A1B74F115F225475FBAF04C6130F1E0C80E92CEE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "N.o tem a Pesquisa Segura, tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa Segura ajuda-o a evitar os sites perigosos nos resultados de pesquisa do Bing.",.. SEARCH_TOAST_BODY_TEXT: "Pretende adicionar a Pesquisa Segura ao Bing e antecipar-se aos malfeitores?",.. SEARCH_TOAST_SUB_FOOTER: "Vamos ativar a Pesquisa Segura e definir o Bing como o seu motor de pesquisa predefinido ap.s reiniciar o browser.",.. SEARCH_TOAST_YES: "Sim",.. SEARCH_TOAST_NO: "N.o, obrigado",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vamos ativar a Pesquisa Segura e definir o Bing como o seu motor de pesquisa predefinido."..}..//3ADD7AA81BB1F718C16F08CBB9278CA002CD88F68AAFF2805ECA9E2CE610ED7CA8D1D6936868D43FCA7435F670972AFFC1C52FEDD361A9E73E0713D32630CFA6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1189
                                                                                                                                                                                                                                      Entropy (8bit):5.119818521492952
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7H0i5Cke6gyt20qJNs2OSVptfnZMtXye4qfjFsX58cMtXye4qfGbuRrXC:IMCke6gyJqjbOSfNnS9yHiT9yH3bu4
                                                                                                                                                                                                                                      MD5:60AB3B563463A9E08D4B64FFFBDA895E
                                                                                                                                                                                                                                      SHA1:79825BBCAA5376E308AB42CF13F25D354CB73BA6
                                                                                                                                                                                                                                      SHA-256:A95637B3BD5ED6E4023316D04DCA914475270E22DD28F748BA2D50A75F2AAABF
                                                                                                                                                                                                                                      SHA-512:6A7BF0422EAF98E9864621FF4DD7AC193397C0D16FA4FF4C5E7D8B37FA2811EC54A0F8BFF028D977E4C6C20C459E7622BEA089A858D9478946DAA427649EDBEC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "...... ........., .. ... .. ........... .......... .....",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... ...... Bing.",.. SEARCH_TOAST_BODY_TEXT: "........ .......... ..... . Bing ... ...... .. ...............?",.. SEARCH_TOAST_SUB_FOOTER: ".. ....... .......... ..... . ....... .... ......... ....... .. ......... .. Bing ..... ........... ...... .........",.. SEARCH_TOAST_YES: "..",.. SEARCH_TOAST_NO: "..., .......",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: ".. ....... .......... ..... . ....... .... .........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):959
                                                                                                                                                                                                                                      Entropy (8bit):5.6939003261924
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HUMukzWX/lJxvkgn45U1bORyg+yqto3botZcH7GujcO:7HmVXDxTbOsg+yR7GY
                                                                                                                                                                                                                                      MD5:7E6A7D98F075CC06A999D86E0B1CAB85
                                                                                                                                                                                                                                      SHA1:BC307DB0C63AF504DF6D818CA74652C80058FFF3
                                                                                                                                                                                                                                      SHA-256:8E697444A3FA730E04678223A65A399EE128654946BFF9B22057408424949098
                                                                                                                                                                                                                                      SHA-512:29A905E185B9A866B286657FBFF3C7FD3FF5A89C59A859013725290276ACDD4D511BFB6D775A0ECDBA350B4504A93A1E9567CA872290684194EB1AE654E76A40
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nem.te zabezpe.en. vyh.ad.vanie . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s vo vyh.ad.vacom n.stroji Bing chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT: "Chcete prida. zabezpe.en. vyh.ad.vanie do vyh.ad.vacieho n.stroja Bing a.zachova. si ochranu pred mo.n.mi .to.n.kmi?",.. SEARCH_TOAST_SUB_FOOTER: "Po re.tartovan. prehliada.a, povol.me zabezpe.en. vyh.ad.vanie a.zmen.me predvolen. vyh.ad.vac. n.stroj na Bing.",.. SEARCH_TOAST_YES: ".no",.. SEARCH_TOAST_NO: "Nie, .akujem",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Zapneme zabezpe.en. vyh.ad.vanie a.nastav.me vyh.ad.vac. n.stroj Bing ako predvolen.."..}..//F30FBBFFAC8BF094BA0C9CC48B559167997843BBE1434D1E74F5C047BC4A24AFB168958537A233543B1CB6A644A0E23B23BE45C128E3F122DD0615A423A69218++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):791
                                                                                                                                                                                                                                      Entropy (8bit):5.510569695619325
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HM3Rzi2T//nHkpIUaSB1kd1BgqDHCqtMB1kd1Bgq+gJXUVkfMYQe2:7HM3B0T3kd/DDHC53kd/D9Xl2
                                                                                                                                                                                                                                      MD5:138F2D03891CC914DB968E5416D50FE5
                                                                                                                                                                                                                                      SHA1:3B903BA97391A41DFE5C2C2138BEA4BAD2C22700
                                                                                                                                                                                                                                      SHA-256:0AD9A41B3DD75050132E9FD59F809550932D22C99C9DA77F66FF77343CA8C925
                                                                                                                                                                                                                                      SHA-512:33C07B186D87ED9B74C41E59EABDCCAAD35FF7968545B224A4768D4E5A035B27AF2FAE8ECE15BC06DBBAF1AAEFF252F50304BC81675035B108179142C0271360
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Nemate bezbedna pretraga - budite oprezni",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u Bing rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT: ".elite li dodati bezbedna pretraga u Bing i ostanite napred?",.. SEARCH_TOAST_SUB_FOOTER: "Uklju.ic.emo bezbedna pretraga i promeniti podrazumevani pretra.iva. na Bing nakon ponovnog pokretanja pretra.iva.a.",.. SEARCH_TOAST_YES: "Da",.. SEARCH_TOAST_NO: "Ne, hvala",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Uklju.ic.emo bezbedna pretraga i promeniti podrazumevani pretra.iva. na Bing."..}..//14F2F27F742F0C235064833749659CBF24E64C422A910B0DBDC0C638D8BF82FA963093E972C3E9C97D6B5E720751A8ADDD2D7B173B820D6406A0EAD561948605++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):847
                                                                                                                                                                                                                                      Entropy (8bit):5.461375321474466
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HBZa8gL2eN/Ttn2gW6DTXMoOF2FTnZ2gW6DT+f4aB0Am+rn:CuY/ZrT70GZrT+f4aB0yr
                                                                                                                                                                                                                                      MD5:344D3D96A37024A2610FB88876243AEE
                                                                                                                                                                                                                                      SHA1:B1F1E91403336B0194A093D094D1C996A2C8FE74
                                                                                                                                                                                                                                      SHA-256:F9738A002C0FA2AC1AAB24310785077752D3705FF38E14AFF118055829162A91
                                                                                                                                                                                                                                      SHA-512:9CAAF541069DACA9E313D66AFC70BC41A0CBEC399B1C39E00AC322F19B885D937A84E5524FA6BE715AAD8294EB6FDFE7A43E8DC2D7A44B6C7C092878A6864A0D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Du har inte s.ker s.kning . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i Bing-s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT: "Vill du l.gga till s.ker s.kning till Bing f.r att h.lla dig steget f.re skurkarna?",.. SEARCH_TOAST_SUB_FOOTER: "Vi s.tter p. s.ker s.kning och .ndrar standardalternativet f.r din s.kmotor till Bing efter att du startar om webbl.saren.",.. SEARCH_TOAST_YES: "Ja",.. SEARCH_TOAST_NO: "Nej tack",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "Vi s.tter p. s.ker s.kning och .ndrar standardalternativet f.r din s.kmotor till Bing."..}..//1520C61D58008FABF3DA731DACF866BCE4D03BAD4FAA6F82AACB04EC99F8E81D61EEC696FBF7C17AE7CB843D0B5F292DA58616632E8E98BB4BE82E6C010E2A15++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):857
                                                                                                                                                                                                                                      Entropy (8bit):5.548557917975657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HMhMT4PwAf00hBLUF8Tt7zYE3MKUR59HQmeonSqt9UxQme7ozWANgzCp:7H8O44Yh88x/YE8PJfTnStf5Go
                                                                                                                                                                                                                                      MD5:8F03A0C6AFDB9EA1B61946EA897FFBC8
                                                                                                                                                                                                                                      SHA1:C5BA6537AFD26F948906197BE3F43B5A1649F982
                                                                                                                                                                                                                                      SHA-256:FC62A59023C589C69AE3CFCBE7292FA08586E3B51DE5F755C9B8F429218A1AD6
                                                                                                                                                                                                                                      SHA-512:43D24278E0E0CE37B157B1D917D4725860BD5571B8B9F6982522CA810680273B88553D82AD7AAC596188D5A0E99AEDD4F53F996F1898CB664CA4884041AA811F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "G.venli Arama'ya sahip de.ilsiniz, dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi Bing arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT: "G.venli Arama'y. Bing'e eklemek ve k.t. ama.l. ki.ilerden uzak durmak ister misiniz?",.. SEARCH_TOAST_SUB_FOOTER: "G.venli Arama'y. a.ar ve taray.c.n.z. yeniden ba.latt.ktan sonra varsay.lan arama motorunuzu Bing olarak de.i.tiririz.",.. SEARCH_TOAST_YES: "Evet",.. SEARCH_TOAST_NO: "Hay.r, te.ekk.rler",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "G.venli Arama'y. a.ar ve varsay.lan arama motorunuzu Bing olarak de.i.tiririz."..}..//56D0EF1182A907986B6143F6F690B3F277FCD2C934EC21D77F347D44053DA14D3C0E2F5A21BA5123CDF5C283D239F4A31E5C9391C9A0A9766AA9739B91C877A1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):777
                                                                                                                                                                                                                                      Entropy (8bit):6.208889278971132
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HujCHVLkr96S4fnyHd99zfnyHfvOkdAh:UCHVA92fnyLhfny/7a
                                                                                                                                                                                                                                      MD5:E067F30453C3DBD99C807C35788FEE99
                                                                                                                                                                                                                                      SHA1:9B1ACB0A8462EFFE93419FCD7F8948BF6F0FDEC2
                                                                                                                                                                                                                                      SHA-256:4BDD9BA9581F906D6B2FD6F4090D684B64D2619FCC9D4126F32CA3BE134D98B8
                                                                                                                                                                                                                                      SHA-512:15E6528227B6E38FD60A27E689FD169F582CF2D5C992DDB4EB57418C158B60F83A37A657D689AE9AB0FAB022667E31A5FBDA1132DD04D8ED7BA9E0D4EB5A931F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "......... . .....",.. SEARCH_TOAST_SUB_HEADING: "......... Bing ............",.. SEARCH_TOAST_BODY_TEXT: "......................... Bing?",.. SEARCH_TOAST_SUB_FOOTER: ".............................. Bing.",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "....",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "..................... Bing."..}..//30FB0E9A5DC41B33AFED3B5F39C6874384159243470B0CBCE5A1EBCF9158A048DC626A4DEEF154B8E4B9FFAAEC6EF8214C55057158C3DEA450E29AC4E5260487++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):747
                                                                                                                                                                                                                                      Entropy (8bit):6.166050030834144
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HdRjeD31S5BdlevclAZKdKX0S19HS8KFy9qtNSNv7l2Hc47PgOUXjdqQ78wh:7H76D31Sy8AZKIz19Hd79qU7l2H2dqQd
                                                                                                                                                                                                                                      MD5:042C0ED212E913678C438F32BC026798
                                                                                                                                                                                                                                      SHA1:DA1A55A9DCC752E235D8C910D378A9FA4EC97631
                                                                                                                                                                                                                                      SHA-256:EE8ADE895B4752D9CC7D2D3C5EC9E8CABDBBA885B27E4E2066EDE1003FE0EBCF
                                                                                                                                                                                                                                      SHA-512:A0D83FCBFDA09A23CDEC5BB31DA01F0BCC1E985FEA34EF10BAAA607B0540A02AD5D939B8C1F9B0920BCE958B732347739A9557423FE9691E7BCBE6C39A6CDBB3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "...........",.. SEARCH_TOAST_SUB_HEADING: "......... Bing ............",.. SEARCH_TOAST_BODY_TEXT: "......... Bing...........",.. SEARCH_TOAST_SUB_FOOTER: "............................. Bing.",.. SEARCH_TOAST_YES: ".",.. SEARCH_TOAST_NO: "....",.. SEARCH_TOAST_SUB_FOOTER_NO_RESTART: "...................... Bing."..}..//E96E16E118F9E42ECC89746E36A0B0A17DAF6227A4374B0E468DBE596B524F2CDBEBEE5554876658A5E252FC1116E6AFAA058E6A87B59C9615AC199781EF7B71++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7420
                                                                                                                                                                                                                                      Entropy (8bit):5.693322683746733
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CXLFSeinF0GY2zegRdgmgV+2bt9kuB9Ouy9kuv9FoEGopoMgLmVvuuxng:CXLF5WF0SHMt9kg9O39kIOEGQZVdxg
                                                                                                                                                                                                                                      MD5:D5934F97950F53B9FCDE4EC2CFE82361
                                                                                                                                                                                                                                      SHA1:AB406A46A03D3E76FE2B2953FC8E06CD750C1CD9
                                                                                                                                                                                                                                      SHA-256:A0D44A8D763DAD8349B3582D6DF339E704EEEFD1DE5F88629EC104D282A220F6
                                                                                                                                                                                                                                      SHA-512:3F62689B964572C5334CE0E72AD777C23C5ADA7200CA7C6EC70D511BB87F20184985F3ACBCD3F81573353237514D28D96D611E3776A216053BF8A2E17E864D24
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Slu.ba Bezpe.n. hled.n. je vypnut. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT: "Chcete zapnout roz...enou ochranu p.i hled.n., abyste byli v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_OPTION: "Ano, chci po restartov.n. prohl..e.e zapnout slu.bu Bezpe.n. hled.n..",.. SEARCH_TOAST_DONE: "Hotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nem.te slu.bu Bezpe.n. hled.n. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcete p.idat slu.bu Bezpe.n. hled.n. a b.t v.dy o krok nap.ed p.ed podvodn.ky?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ano, p.idejte slu.bu Bezpe.n. hled.n.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6899
                                                                                                                                                                                                                                      Entropy (8bit):5.421929762886686
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CjNwgL2CS6ddGw2jKK3A/BZ6mQNeTNlspRmbM1BM0t+lWcoLa8XcZ+lWch9FF/3k:CWToK3A/Bj32ttCWy8XgCWSj/o03Wwuz
                                                                                                                                                                                                                                      MD5:C13A15425F870AF8A11C3D490D5B3223
                                                                                                                                                                                                                                      SHA1:7E46762D8E0B2FC59F62A2DBDCC69DD5C85BEEFD
                                                                                                                                                                                                                                      SHA-256:E8DE0042408ADC517DC3D9FC11144FBC2153B5F0334C95527979E6EC56D088A5
                                                                                                                                                                                                                                      SHA-512:B43BAD94D60A76406D9094AA2A4C1A4431B5E069829488BB414EFDC751B711A050C9F0332BDC0A665C342ABEF88A05AA8D5C9DDDA2594DA18B1BD9D152EB6B51
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sikker s.gning er sl.et fra . v.r forsigtig",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning leder dig v.k fra risikofyldte websteder i s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT: "Vil du v.re et skridt foran forbryderne og have ekstra sikkerhed, n.r du s.ger p. nettet?",.. SEARCH_TOAST_OPTION: "Ja, sl. Sikker s.gning til, n.r jeg genstarter browseren.",.. SEARCH_TOAST_DONE: "F.rdig",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har ikke sl.et Sikker s.gning til . s. v.r forsigtig!",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sikker s.gning leder dig v.k fra risikofyldte websteder i s.geresultaterne.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vil du tilf.je Sikker s.gning, s. du undg.r at komme ind p. grimme steder?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, tilf.j Sikker s.gning til min browser, og s.g som standard ved hj.lp af {0}.", // {0} SEARCH_TOAST_*.. SEAR

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7159
                                                                                                                                                                                                                                      Entropy (8bit):5.354772773199427
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:C9EB5FeK92iZaU3vFJMGNMmXdtUGj/7vFyDGkHEXcFtPV:C+5/btltJ/7vFOEMh
                                                                                                                                                                                                                                      MD5:BC1F9F2BEC75574822B896D291779811
                                                                                                                                                                                                                                      SHA1:8D46CD1C5921988F8EBA829720A3FABC95D40FA8
                                                                                                                                                                                                                                      SHA-256:FB447279FE6D13E4A7C00032BCE88C08796B82CF88D574CBBCE452D3F8F3076C
                                                                                                                                                                                                                                      SHA-512:94010C73B38C5EAF38488913783B3D6816D1392CC226BAFDFC50CF74B505C841DACDD2F9B39A07304CF075E358B2496A93AC9D145B384CDE311C96BCC86735C2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Achtung: Sichere Suche ist deaktiviert",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT: "Wollen Sie Internetkriminellen mit zus.tzlichem Suchschutz immer einen Schritt voraus sein?",.. SEARCH_TOAST_OPTION: "Ja, ich m.chte die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. SEARCH_TOAST_DONE: "Fertig",.. SEARCH_TOAST_HEADING_COMPLIANT: "Die sichere Suche ist nicht aktiviert . seien Sie vorsichtig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "M.chten Sie die sichere Suche hinzuf.gen, um Kriminellen immer einen Schritt voraus zu sein?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, die sichere Suche in meinem Browser hinzuf.gen und Suchen

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):991
                                                                                                                                                                                                                                      Entropy (8bit):5.781833738030561
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOM3oeWURG11jdHDUUOSj6TrY3jdHjdVtiSTj6cUnjdMA8Y9pcO4FSp6CHwYn:7HOvMrWh1WTMBgF5Rj4kV9DD
                                                                                                                                                                                                                                      MD5:E43A4FB3E24BDC02C36E10D415BA8526
                                                                                                                                                                                                                                      SHA1:18B3CFF092C1DCBF3D1E1797EEF88DF9171F2448
                                                                                                                                                                                                                                      SHA-256:7CE2DD673C1216ED61CD89746B70693F57A1D74DD723AA3411AC1480C5795791
                                                                                                                                                                                                                                      SHA-512:C9AB248686ADB738008DBA744B7250220B7FF8CB171A9878B573E46A9109AA0590494584D8B872335CD089A981D9384208D400176EA44DD4616C39B5BC25E80F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "D.l.te si starosti s t.m, .e budete sledov.ni online?",.. SEARCH_TOAST_SUB_HEADING: "Pou.ijte prohl..e. DuckDuckGo s ochranou McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Soukrom. hled.n. s prohl..e.em DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} zaji..uje, .e historie hled.n. z.stane v soukrom..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Funkce Bezpe.n. hled.n. McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokuje .kodliv. odkazy ve v.sledc.ch hled.n..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bude pou.it jako v.. v.choz. vyhled.va..",.. SEARCH_TOAST_YES: "Vyzkou.et soukrom. a bezpe.n. hled.n.",.. SEARCH_TOAST_NO:"Ne, d.kuji"..}..//B499664F4A4A52410F8A08F84BABCC773351199F0F0030779C08E339926E52529489B4B079B0E2024D2E7861F1F9EE1D74F31BDCED6951D85BE35DB280CE7E4B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):900
                                                                                                                                                                                                                                      Entropy (8bit):5.597464826785457
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyODmFK9r7NWME1jdHvyjC8C9JYBjdHjda88SjNwojdbnEl48twdBP4LMCJVj:7HOvCQ9NWMEcCrYFnwinQ4KwbP4JJx
                                                                                                                                                                                                                                      MD5:24455D50D7EEE6F4CCDBE337D62B0362
                                                                                                                                                                                                                                      SHA1:470E4884F90666CE16C9EC9C1539609361FBD181
                                                                                                                                                                                                                                      SHA-256:8A445CCD25F08BECD73CBCF08573DAD4718743393792A5245D32FD81D1410193
                                                                                                                                                                                                                                      SHA-512:7F8120FE1D35EFE7A9AD03CD5D8ACEA4FCD54605C2CD6C520E4AEDDB0D36DDF57167608ABAD8B69F91F221B3254136C5DC5139F557F2FF43C827BFC4CD415312
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Er du bekymret for, at der bliver holdt .je med dig online?",.. SEARCH_TOAST_SUB_HEADING: "Brug DuckDuckGo sammen med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Anonym s.gning med DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} s.rger for, at din s.gehistorik forbliver anonym.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sikker s.gning", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokerer skadelige links i s.geresultater.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bliver din standards.gemaskine.",.. SEARCH_TOAST_YES: "Pr.v anonym og sikker s.gning",.. SEARCH_TOAST_NO:"Nej tak"..}..//DF0DCAC24738D7493C2C09E7A0EB75E0FFFBCA2D3F769358A23886734A084558449C11CE5F147B5704253CEAD27239601039E72183310290E7388AF76CD29095++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):936
                                                                                                                                                                                                                                      Entropy (8bit):5.563732858745097
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOIV8tfCIjdHkjPqqbjdHjdar9jICnqjkjdAhalRVnzQYjLr3bAuna0qZtpvw:7HOvc8yqrLLBQ8avt5w
                                                                                                                                                                                                                                      MD5:5D65D15474D9205751CE3A1611749407
                                                                                                                                                                                                                                      SHA1:A6D1879485DBF7A3D869588A331B418060212ED5
                                                                                                                                                                                                                                      SHA-256:608A42E0BEE34D686CA023C26D00047A51F69C5DCC2C80B68EEDFEAA3EE5A531
                                                                                                                                                                                                                                      SHA-512:5FF3B3E149FA45B282FAEDBD22CC01525117F2861EB581477DD42E42288C4E403B7EE3CC1D7CD01DE9677D515C2FA96F03570EDA0DCEF840F1708D039D8EB991
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sie wollen keine Online-Tracker?",.. SEARCH_TOAST_SUB_HEADING: "Verwenden Sie die McAfee-Erweiterung in DuckDuckGo.",.. SEARCH_TOAST_BULLET_STRONG_1: "Privater Suchmodus in DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} . damit ist Ihr Suchverlauf f.r andere nicht sichtbar.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sichere Suche", .. SEARCH_TOAST_BULLET_NORMAL_2: "Die Erweiterung \"{0}\" blockiert b.sartige Links in Suchergebnissen.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo wird als Ihre Standardsuchmaschine festgelegt.",.. SEARCH_TOAST_YES: "Private und sichere Suche testen",.. SEARCH_TOAST_NO:"Nein danke"..}..//68872893187EE67E1977E1DF4CD23A9D328D613FA7371BDC0F74A3C2C241B30EC0A34DA82D15A4022BE41A5578FCF6815DCD7C69B872A1A720440552C1AFF4F0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1278
                                                                                                                                                                                                                                      Entropy (8bit):5.509993877320771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvdVOfNkrI8gvMi3QonM4diUPg4qjulqCX2e:CvdAVktgfQoMmiUDqjfCn
                                                                                                                                                                                                                                      MD5:8BBF4C888A46AA04BBAA23E0D99AA0F4
                                                                                                                                                                                                                                      SHA1:51323E1A56885D18C488368156894348B7107A02
                                                                                                                                                                                                                                      SHA-256:5A4CB6352FFE9A7808379D0912079062AFA450E5B2F7B300113DF4B9AFCA7630
                                                                                                                                                                                                                                      SHA-512:D4219751DC4437B551A1E18FDBA59692C5113B335C720E5BFD2B4CCEBBFDE12DA639118B6151955E54AFD302357F27FA3CE01D2EF6599E6A625092F897816842
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "... ........ .. ........... . ............. ... online;",.. SEARCH_TOAST_SUB_HEADING: ".............. .. DuckDuckGo .. .. McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "........ ......... DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: ".. {0} ..... .. ........ ... ........... ... .........", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "....... ......... McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: ".. {0} ......... .... ........... .......... ...... ... ............. ...........", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: ".. DuckDuckGo .. ..... .. ............. ......... .......... ....",.. SEARCH_TO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):851
                                                                                                                                                                                                                                      Entropy (8bit):5.505361138842353
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyO8zqqNPR4t1jdHMLBjaPCuYh8jdHjdatBjPvkTzgjdA8xvsHActb4konXX6L:7HOv8moyALKFYhl5kTzqsH5ttgsq61n
                                                                                                                                                                                                                                      MD5:6C30E1FC090621A871A0C5DD98326CFC
                                                                                                                                                                                                                                      SHA1:B439284FB7FD74264386C7FBDE69341003765CE4
                                                                                                                                                                                                                                      SHA-256:3C7EC9030FB45C9A6ABE8E46722AF93ADBEF57FF92D24CBD66644FC0AEF1DCBC
                                                                                                                                                                                                                                      SHA-512:5B562A9C5244D7A1EEFD5DA90A141458A6B68C7E77B5ADB124ECEA2B69F80D1728C790A19EB5470A127D62AFB7843004F99D408DEA32F35DE0D6A969578C84EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Worried about being tracked online?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo with McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} keeps your search history private.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Secure Search", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blocks malicious links within search results.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo will become your default search user.",.. SEARCH_TOAST_YES: "Try Private & Secure Search",.. SEARCH_TOAST_NO:"No thanks"..}..//0579669A157CB193AA997D744467D04A267A99377EDC42B77DE70547A69D316A4DCD19ED1A1930CA64A12878447CBDB698B70259C0C49C1AA85A9C72A7BECD82++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):945
                                                                                                                                                                                                                                      Entropy (8bit):5.57326836935389
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyO9ocZRs11jdHCajW7SuTQQQjdHjd0Fmzjq0KdQjdEiSZSUjETASKsUm14hJK:7HOvy71A7JPmS0gR54TYXm1sPk
                                                                                                                                                                                                                                      MD5:E654E9B01500A59552095197CC10F2CD
                                                                                                                                                                                                                                      SHA1:AB40A2740135253E3DD3FB1FFCA54CD0090FF672
                                                                                                                                                                                                                                      SHA-256:D18BEC9DDE86CB05A5A71CF04499AAD47A59130C27CEE6957A6DF9AF1C2E2538
                                                                                                                                                                                                                                      SHA-512:33DEDA26681141A9A7C42F8B3833207BFAECFEBE1BD2597A9470A1290B8FF88A4D18305D5092D5791F7A06A1EBA777B6C0D46B172AF7E3C1829E7DA3EA34841D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".Le preocupa que rastreen sus actividades en Internet?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "B.squeda privada de DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} garantiza la privacidad de su historial de b.squedas.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "B.squeda segura de McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloquea los v.nculos maliciosos en los resultados de sus b.squedas.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ser. su motor de b.squeda predeterminado.",.. SEARCH_TOAST_YES: "Pruebe las b.squedas seguras y privadas",.. SEARCH_TOAST_NO:"No, gracias"..}..//38602E3924E0AC97FDD2F28BF92A68497D1246D984345D4ED3444C34A6922FB1F4946D3239C01D6D89A04A0043361505ACE0FBA51B51118DCB538FBDE8BD29FA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):925
                                                                                                                                                                                                                                      Entropy (8bit):5.571395957656369
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyO9ZHhHmdks11jdHCajZyFK2jdHjd0Fmzjqrpo3FK2jdEDE/ZSUwIesY9qkj6:7HOvdHmdN1nnzmSiA74HcBQ5
                                                                                                                                                                                                                                      MD5:4328ECCDBBAE0C6C817C6BB970CDB53A
                                                                                                                                                                                                                                      SHA1:3D196DB2ED066DE3B45C0322D9DDE13A34D23340
                                                                                                                                                                                                                                      SHA-256:86A13707A2B762B94511B3C23F570C4CEC01A11E0EDD9153DB7FEFD3FC827CE9
                                                                                                                                                                                                                                      SHA-512:35FE6D8DE1594A5D4C1768233D2634D78892EEBAB6268CF4D2347515E876F9195A60DE9F5E21EAE8E56C90B345626D59668F6B7D4FE5BE67F9EB44E0C405E7FF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".Le preocupa que lo rastreen en l.nea?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "B.squeda privada de DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mantiene confidencial su historial de b.squeda", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "B.squeda segura de McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloquea v.nculos maliciosos dentro de los resultados de b.squeda", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo se convertir. en su motor de b.squeda predeterminado.",.. SEARCH_TOAST_YES: "Pruebe B.squeda segura y privada",.. SEARCH_TOAST_NO:"No, gracias"..}..//B5EFE5AD53EF1A1AE099705CD17324B96AD7756C9FDE64B27A56DB1CA5AF61C4BAB96377237DE84984FD914E443D1574210D10DBEE3F8D3C1F4AD2F8E75B4678++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):870
                                                                                                                                                                                                                                      Entropy (8bit):5.536596307306761
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOmciWozjdHJmavj+rUEpjdHjdXpvjm0QCojd6U9hl5l0X+M/qid:7HOv7iWoCUEBJOhfGX+mDd
                                                                                                                                                                                                                                      MD5:7CA06D89A766844EACA83E704178B943
                                                                                                                                                                                                                                      SHA1:70FC92C3B58A8C3636081B7C558B2D104F535C2E
                                                                                                                                                                                                                                      SHA-256:326215F6A40A9860725DAB621A351106BBDBFEC6D604F213E66C58455FA7D7C5
                                                                                                                                                                                                                                      SHA-512:7C66C93343B1B23C8220D0B2EACBFB129EAF5D6A52EE0BFA3CCE5E2D52AAAF1178ABFBA5813729C8700B0988838904500C2271BA9574BF8F911A7BF11211ABE9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Huolestuttaako seuranta verkossa?",.. SEARCH_TOAST_SUB_HEADING: "K.yt. DuckDuckGota yhdess. McAfeen kanssa.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGon yksityinen haku", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} takaa hakuhistoriasi yksityisyyden.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfeen suojattu haku", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} est.. haitalliset linkit hakutuloksista.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo valitaan oletushakukoneeksesi.",.. SEARCH_TOAST_YES: "Kokeile yksityist. ja suojattua hakua",.. SEARCH_TOAST_NO:"Ei kiitos"..}..//3AC363F840D3476D6543B0B79FAB1CD74C1BDA408C607121AF95633ED6E8690261BEFCB0287B5067CF46500FC71EBBA65759B3BC5E47AB74ED16A60BC20210DE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):954
                                                                                                                                                                                                                                      Entropy (8bit):5.558741350359142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOZKM/Jvf1jdH+9kRjBjdHjd55wjq39M5vjdShWvw/jFe9TsY9Te0:7HOvBRMkbb7Wvw/jFe9TL9f
                                                                                                                                                                                                                                      MD5:9886F9A46BC1F4916D838524F24B5C45
                                                                                                                                                                                                                                      SHA1:6B6FD3580A54AE2D822031E3361E7AEEC2F8AA69
                                                                                                                                                                                                                                      SHA-256:33C699200A170C9FE29446E264EA43CD8E3254625B57F9056A9871A886376FED
                                                                                                                                                                                                                                      SHA-512:6853355DC691407CB525E52734FBF2F95D1E7FF88981260BE4F24D157F45C50ABF6CC55E1AAAAA1EF7F835DC4BAACBD0FB6218D0A759D5A7B2EEC465C7050F43
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Inquiet d'.tre surveill. en ligne?",.. SEARCH_TOAST_SUB_HEADING: "Utiliser DuckDuckGo avec McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Recherche confidentielle DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} pr.serve la confidentialit. de votre historique de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloque les liens malveillants parmi les r.sultats de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo deviendra votre moteur de recherche . d.faut.",.. SEARCH_TOAST_YES: "Essayer la recherche s.curis.e et confidentielle",.. SEARCH_TOAST_NO:"Non merci"..}..//42DD6867F547A1648337E56C79C407F66734905856A67BCE69572C0969C316A17602C13CF26273B3556A18DFCA04F24D3DE01DEBC058FA54EBC8B2522D51C8C9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):949
                                                                                                                                                                                                                                      Entropy (8bit):5.562640385109174
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOR04/yohvf1jdHUzhCSjm+MjdHjd55wjDDJ3tp5vjdG4kWYXF9owhBbRMHSg:7HOvVyoRAzhNwKTkWYcwh5qHS42E
                                                                                                                                                                                                                                      MD5:70D962B10D4A84A235F2D500670390B0
                                                                                                                                                                                                                                      SHA1:25DBEFF551A8D8623EC1D94BA59A236726285B0E
                                                                                                                                                                                                                                      SHA-256:10514442DA4B30C51808CB31E79CCDC024196C9B0000CE996C4C66EEEC8AFF8E
                                                                                                                                                                                                                                      SHA-512:45F2FCDA68E45D0C19FAD7FD5D62C5A0CF018A90E20E8CEBD3E660C903B9E0D8644C34CEDFBBF15DC360B78C5B897116A48AE792410700DB1FF786F0CCEB8329
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Vous avez peur d'.tre suivi en ligne.?",.. SEARCH_TOAST_SUB_HEADING: "Utilisez DuckDuckGo avec McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Recherche priv.e DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "La {0} assure la confidentialit. de votre historique de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Recherche s.curis.e McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "La {0} bloque les liens malveillants dans les r.sultats de recherche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo va devenir votre moteur de recherche par d.faut.",.. SEARCH_TOAST_YES: "Essayer la recherche s.curis.e et priv.e",.. SEARCH_TOAST_NO:"Non, merci"..}..//B9FE7A71488535CBBB895BDDF185642891100BDEA3B4A1B945C642258829A8B32AAB979183BF2AA22B4C18A2796C8C81C620F7DD9309F2086F88420866E90799++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):931
                                                                                                                                                                                                                                      Entropy (8bit):5.6018404862091975
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOXmRUFqyW+1jdHOhjsgv2jdHjd6D39hjpfzJujdXoBcBw1S9IeFXslRb+4h:7HOv2iYT+0vBZflUZVWlRbnh
                                                                                                                                                                                                                                      MD5:D79F8D4990C3305E11E939ED158D1980
                                                                                                                                                                                                                                      SHA1:A3AA7B9C1EE956F0391E73EF0EC286773E3B7C19
                                                                                                                                                                                                                                      SHA-256:201F79263DB403A02FA7DF5D91DED21337F3DD8592F385EFA0B38A0B8881814B
                                                                                                                                                                                                                                      SHA-512:847B1BB5D21DB53BCCEF033EC1A0ABA89A4351AF6407C17217BD3D808C7B4D4B94AAF76FB7839AB6042FAA463609D0110A3AE4FB266D4CB32965439935A50561
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Zabrinuti ste oko pra.enja na internetu",.. SEARCH_TOAST_SUB_HEADING: "Koristite DuckDuckGo s McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo privatno pretra.ivanje", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} dr.i va.u povijest pretra.ivanja privatnom.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee sigurno pretra.ivanje", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokira zlonamjerne poveznice unutar rezultata pretra.ivanja.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo .e postati va. zadani alat za pretra.ivanje.",.. SEARCH_TOAST_YES: "Isprobajte privatno i sigurno pretra.ivanje",.. SEARCH_TOAST_NO:"Ne, hvala"..}..//57BE5FDAE2873FFCB5F6A004F3086C4C9E41512E7DDC4112439F39F421D0B3FEF5EF98E7EF295F8FAE31E6957DDA5B3D6BF1D697EE38748C720636EEE3E738B1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):989
                                                                                                                                                                                                                                      Entropy (8bit):5.707564230510723
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOaC24TjrjdHGSHBjXllzFrYjdHjd8dHBjzEfCsbV0kjdUcjaSC65dGE76BU3:7HOvaH6ESZzFddFE8dTadv6BkZYu
                                                                                                                                                                                                                                      MD5:0914F70709DD492EE40FA46BB37BE457
                                                                                                                                                                                                                                      SHA1:0AAED8CBC367968F84991DD81864C2FDD3FA8AC3
                                                                                                                                                                                                                                      SHA-256:B095A2041DE02199A7F14C02B28AD6E0CC13DF74BB9A6EFC5342C2823CD87087
                                                                                                                                                                                                                                      SHA-512:49FD8A0FCB168497B9FC45DA096F2590F653BCD709FBDCF469EDD125F5F6BEF3722912FB74E1463346DCE25175E6A204190C7DDDE6EDC1E9FEA4D8E3469E1F58
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Agg.dik, hogy k.vetik online?",.. SEARCH_TOAST_SUB_HEADING: "Haszn.lja a DuckDuckGo szolg.ltat.st a McAfee-vel.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo priv.t keres.s", .. SEARCH_TOAST_BULLET_NORMAL_1: "A {0} gondoskodik arr.l, hogy keres.si el.zm.nyei szem.lyesek maradjanak.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee biztons.gos keres.s", .. SEARCH_TOAST_BULLET_NORMAL_2: "A {0} blokkolja a keres.si tal.latok k.zt a rosszindulat. hivatkoz.sokat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "A DuckDuckGo lesz az .n alap.rtelmezett keres.motorja.",.. SEARCH_TOAST_YES: "A priv.t .s biztons.gos keres.s kipr.b.l.sa",.. SEARCH_TOAST_NO:"K.sz.n.m, nem"..}..//78060E3879464A381C7F6C530D550BEE4C97FBC809B63CD656960A6554B8B71EC4DA93472877432C97ACCD251EA348055323E50797C0EA7FD5C4788B0A24FCC6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):886
                                                                                                                                                                                                                                      Entropy (8bit):5.475999829226977
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOfOMUUAR11jdHbFLjichFDojdHjd1TzjX+BbtAfpPjdEira8KF6wGn/G3WCd:7HOvfa1fhFwTv+MfQiraewAG3kS
                                                                                                                                                                                                                                      MD5:D08EA0DD3E9EDCECA0507EFA9C3CD03A
                                                                                                                                                                                                                                      SHA1:7D95351F6B5824E2D1290F2BB3B57E061FE1AA6E
                                                                                                                                                                                                                                      SHA-256:61E224DDB068F86657E172E91AB079C7BB77BD4E9BF51431625685A461EAA03A
                                                                                                                                                                                                                                      SHA-512:4ECC0F7A9A7978B124EB2D6189D6538CAAB09B7A96F83456B5DFFA815E03352E29093051B44B50611BF3A63EC3642CDDC4ACD254F5108038A6638EE2B06C39F8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Temi che le tue ricerche online vengano tracciate?",.. SEARCH_TOAST_SUB_HEADING: "Usa DuckDuckGo con McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Ricerca privata DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mantiene private le tue ricerche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Ricerca sicura McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blocca i link pericolosi nei risultati delle ricerche.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo sar. il tuo motore di ricerca predefinito.",.. SEARCH_TOAST_YES: "Prova la ricerca privata e sicura",.. SEARCH_TOAST_NO:"No, grazie"..}..//6BBE04EEF70DAF7D6713141503461E8E92079C26C3183B95CBEB311D2E5168B03AC533A2444A891292D9EF34FB38DD40A89ACCF7818682153BFCF7106FA93A74++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1089
                                                                                                                                                                                                                                      Entropy (8bit):5.902465062464743
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HO+ok2PLDnWzuynP6aG3/jD9vEU0nWzAAH9rck28GRw:CZPQiaG3/v9v39caGRw
                                                                                                                                                                                                                                      MD5:A0D4588D92434812021657CDB3357EDF
                                                                                                                                                                                                                                      SHA1:26396B1906BED1E9F8140A916E4C1032D251925D
                                                                                                                                                                                                                                      SHA-256:BFCC9E7BB44B402FDDBCD69412B74C3AF15F08B41FFE2D848FCC2E52846574C5
                                                                                                                                                                                                                                      SHA-512:B3D4E5293CB381C407AAE02D6568E4941784BC0EA25B63097EB0D4AC0EB4DEB55D328C6F610A94451C42A3D694596BB3F6B756A7CFDFDCB0714EAAF5E3CB186C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_HEADING: ".......................",.. SEARCH_TOAST_SUB_HEADING: "......... DuckDuckGo .........",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo ...............", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0}...............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "..... .... ...", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}............................", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ...................",.. SEARCH_TOAST_YES: "....................",.. SEARCH_TOAST_NO:"..."..}..//889B3FEEDC666EEEC3137F195FCF91734EDBEB334

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):961
                                                                                                                                                                                                                                      Entropy (8bit):5.994042617417198
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOVlzFX8YwOhLRjdH2Zvj0qSwjzjdHjdipvjZF3jlESzjdQecDhLpjEl+f5XzQt:7HOVsYwO9mpSP3REz59pXfFQsEYHO
                                                                                                                                                                                                                                      MD5:1A1CD2290937CE430F5BB4169498BD08
                                                                                                                                                                                                                                      SHA1:203D1C5F774FE1EB72F1FF9EF2FD4F22029E5DE6
                                                                                                                                                                                                                                      SHA-256:5CE0C076BA236E8200DD99ACD1AB309EB2E9923E7B9BE493FEC28875DDE2324B
                                                                                                                                                                                                                                      SHA-512:92183827863A707C3A3981C70127AD2441629F1813D5EF68FA6462717DF6C687C3C834D66066CFD31559870F862F08F0DA1281576C6E1B339C8C9AC81A0CD871
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_HEADING: "... ... ......?",.. SEARCH_TOAST_SUB_HEADING: "McAfee. .. DuckDuckGo. ... ....",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo .. .. .. ..", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0}.(.) .. ... .... ......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee .. ..", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}.(.) .. .... .. ... ......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo. .. .. .... ......",.. SEARCH_TOAST_YES: ".... .... ... ...",.. SEARCH_TOAST_NO:"..."..}..//1D180F552A3CB36CE0E1DD91C722A7970EF5D2FD670FD3BD6508B8F1CC9D71E623DC329AD49B89A12DA5564A47838861158EC3E2F6E132E83BBB5610B6E35891++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):845
                                                                                                                                                                                                                                      Entropy (8bit):5.539728959456167
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyORW/G1jdHMLBj+WjdHjda+jns4jdHnfUMX4Msu5RUDWIhWtzn:7HOvmGAL4mnfoM3PUDWIAn
                                                                                                                                                                                                                                      MD5:4F141A76096D7C422A817DCC7DF4DD66
                                                                                                                                                                                                                                      SHA1:B9CA649B2E54D70B6A247E2734E6D41B17010360
                                                                                                                                                                                                                                      SHA-256:A9929536B1FA16C62A8692BE6F6B5B0EC7C271E3B8C23C4D01FB8F6ECC43A321
                                                                                                                                                                                                                                      SHA-512:7B62D99BE20D9C9D39AB21850377EBF4DB3EAFD77A39449E4248CAD9720E034926744A0B1928BF99CBF7EBD0AC11677C116FF1F9963B3A35D84D714AF944E49F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Er du redd for at du blir sporet p. nettet?",.. SEARCH_TOAST_SUB_HEADING: "Bruk DuckDuckGo med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} holder s.keloggen din privat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Sikkert s.k", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokkerer skadelige koblinger i s.keresultatene.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo blir standard s.kemotor.",.. SEARCH_TOAST_YES: "Pr.v Privat og sikkert s.k",.. SEARCH_TOAST_NO:"Nei takk"..}..//EA1EDAEDA1C4B69EAC976C4076E1E29EF6BA94203AAE9B8B53CC90ADB81D4F14C2296F8747475686B6B71A3F0945A3E831A9F87FD1E67034681FCCE1246F3E60++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):872
                                                                                                                                                                                                                                      Entropy (8bit):5.573280174787083
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOEKAQ1jdHcxRVjWw5KAjdHjdJMyVXjjvc6jdAYy0IYywQsH0CA3jUzDIt0Cj:7HOvEPQCRsFCZ6dwQgSTmDKj
                                                                                                                                                                                                                                      MD5:3EA2BC4DBC838A4585D9EECDC91F2435
                                                                                                                                                                                                                                      SHA1:9DCD0C8D814B7B6E9B524B002CE6015D5AB95A5C
                                                                                                                                                                                                                                      SHA-256:B0DBF83366C539F11DCD00B21AE9F11698A451F2F6E0FAA43BEE5CE01BB903A0
                                                                                                                                                                                                                                      SHA-512:66B6005D117BB83EBB403F7853ED636692C6FECEF81564F8C10EEF469AB78C573A4A59C041483DCC863E493E5522792946DD594C7F08C82AA30D3CCD29099587
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Wilt u niet online worden gevolgd?",.. SEARCH_TOAST_SUB_HEADING: "Gebruik DuckDuckGo met McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Priv. zoeken met DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} houdt uw zoekgeschiedenis priv..", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Beveiligd zoeken van McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokkeert schadelijke links in zoekresultaten.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo wordt uw standaard zoekmachine.",.. SEARCH_TOAST_YES: "Probeer Priv. zoeken en Beveiligd zoeken",.. SEARCH_TOAST_NO:"Nee, bedankt"..}..//2B2EA6D7599D5A4FF4D04E292153CC8466E9B5C13ECAC7360B4CE4AF8208FBDAF0BAC52F3A42F7B79CFA4AE1F84798C22E54EA28F90DDD64877448C7457510ED++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):954
                                                                                                                                                                                                                                      Entropy (8bit):5.739936707414578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyO7RR9AOx1jdHZ3LPjgnH8co3L/ujdHjdJ+ot3LwjNIg/Q3L/ujdEv3X2WJtE:7HOv7riOxBHc8doB0k/fX2eB1WvSp8Vd
                                                                                                                                                                                                                                      MD5:A4CBF60DC98963EBD4CA75431F05749E
                                                                                                                                                                                                                                      SHA1:17EF26930E4ED6A67033134665E70CD4D8E7F2D8
                                                                                                                                                                                                                                      SHA-256:2CBDC9D9C0506D57627D6B1F044BF7AFC53D2F6E960DB86B96A1B38F9CD904FB
                                                                                                                                                                                                                                      SHA-512:1F9F7CDA511FA2F199A2641BDB451F43D371A83ECC4A64CE7ABDE6DF99D8E71BD62882E2EAB6ACC224EC5090D902D6665F6D88AA3CB15569539C1FF399624F12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Obawiasz si. .ledzenia online?",.. SEARCH_TOAST_SUB_HEADING: "U.yj przegl.darki DuckDuckGo z produktem McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Prywatne wyszukiwanie DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "Przegl.darka {0} zachowuje prywatno.. historii wyszukiwania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Bezpieczne wyszukiwanie McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "Przegl.darka {0} blokuje z.o.liwe ..cza w wynikach wyszukiwania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo stanie si. domy.ln. wyszukiwark..",.. SEARCH_TOAST_YES: "Wypr.buj prywatne i bezpieczne wyszukiwanie",.. SEARCH_TOAST_NO:"Nie, dzi.kuj."..}..//66A0B24365A48742EBEE0A7B2DE36FCEB9D50C8F1E0F01C5A37767303C48E631A2466EF868396414A66BC8D54AA1E1949EBC125548C8A8DAD8304767E725CC8F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):905
                                                                                                                                                                                                                                      Entropy (8bit):5.5489931188105155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOamduRsK1jdHMLBjSHajdHjd2OtFcjq/C9yd+WFujdEiXGunNwDFPGtjjXB:7HOvam9KALhB60FDYnNsPG9x
                                                                                                                                                                                                                                      MD5:BCF5F30808A4EF0D14FB93884B7A07F0
                                                                                                                                                                                                                                      SHA1:8D3E5AE887BFE8AC017D9CCF0DCEF91C0C00874A
                                                                                                                                                                                                                                      SHA-256:18406A8FB31ED1CB19A19589AFDD4409D27A9CFD0E6F1CDA06B7A2E8504FC1A2
                                                                                                                                                                                                                                      SHA-512:1F21EF015A0A80173F387F166F24DA9748E3E4283C23AE3E7A987BCFD44D03F0AA7EE592B5BA0E959C82F0B99DD612D62EEE3E68AA7BAA748A3FB9AA6FC02927
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Preocupado com ser rastreado online?",.. SEARCH_TOAST_SUB_HEADING: "Use DuckDuckGo com McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mant.m seu hist.rico de pesquisa em privacidade.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Pesquisa segura da McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloqueia links maliciosos nos resultados de pesquisa.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo se tornar. seu mecanismo de pesquisa padr.o.",.. SEARCH_TOAST_YES: "Experimente pesquisas privadas e seguras",.. SEARCH_TOAST_NO:"N.o, obrigado"..}..//CA1833EFEE1D10CB59402E19CB7BC3A7D6E4A0114EB10C49FB9BAC525F41BB39607A016867DDC3E54A12BEB2FF6265C2E7581512EFE0EB8E24BBF4A817359AFE++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):949
                                                                                                                                                                                                                                      Entropy (8bit):5.586279598571526
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOwON2GFfK1jdHcwOFoSjPH5jdHjd2OtFcjq/CGMoujdvIjmg57IIePGtj8GA:7HOvwONFFfKEG+B6Ur5wPGVdRSxgIv
                                                                                                                                                                                                                                      MD5:D8148A68506AF771DA165C472323DE58
                                                                                                                                                                                                                                      SHA1:1DEA3519F0B37CE1CB3E2973E6B6AD12112B1E02
                                                                                                                                                                                                                                      SHA-256:98FDFB4C5747C941D6E5BB3B5CFE72F814E23321592ED9C8BE521BE4559749ED
                                                                                                                                                                                                                                      SHA-512:BC726EA66C90A009B85FDBA3059F078A45CD47FB13E306F6AA576A744FD2B5ED9959892A9DFF05A2084F9D99D2463F86E1D2423B92A496CBD40EA54F7F8FF9A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Est. preocupado com a possibilidade de ser monitorizado online?",.. SEARCH_TOAST_SUB_HEADING: "Utilize o DuckDuckGo com McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Pesquisa privada do DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} mant.m o seu hist.rico de pesquisa privado.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Pesquisa segura da McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} bloqueia liga..es maliciosas nos resultados de pesquisa.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "O DuckDuckGo vai tornar-se o seu motor de pesquisa predefinido.",.. SEARCH_TOAST_YES: "Experimente a Pesquisa segura e privada",.. SEARCH_TOAST_NO:"N.o, obrigado"..}..//BA975A8009C6B44D296076F08705FAD5282B6485C72C95BE6727EA7308FB6D2F184EAEF4A66CD87C6C644666D45997E507E2C3DB97619846B2234FD7F569D2B7++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1248
                                                                                                                                                                                                                                      Entropy (8bit):5.4513689789193185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HOvEzOMHAIonuRIovfPFt5rNlvytaiSAF+RQX/XJfzntcNiQ7nA9I:CvEK6AuLfPFPfvyciSAFffJjtWbjb
                                                                                                                                                                                                                                      MD5:539E3E07CE1272FDA04385C5E106677B
                                                                                                                                                                                                                                      SHA1:5445C7485D3F7148B7C60CD0358BF7C06100380F
                                                                                                                                                                                                                                      SHA-256:DAEF609319F22CDF913A8E466AFAA5FDFD1DF7CEF6438A22DB101FD643898620
                                                                                                                                                                                                                                      SHA-512:BDBD109FF023004B7F7F98BF624B6660C991C2D8D4DFBAAF3BFE916DD124663B3E83D7DBD5E561F4578EE0CCDB7566A4253BA00BF2F9EFF5B3E2747C48369FA2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "............ .. ...... ............ ...... . .........?",.. SEARCH_TOAST_SUB_HEADING: "........... DuckDuckGo ... ......... McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "................ ..... DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} ......... .................. ...... ..... ....... .......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: ".......... ..... McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} ......... ........... ...... . ........... .......", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ...... ..... ......... ........ .. ..........",.. SEARCH_TOAST_YES: ".......... .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):959
                                                                                                                                                                                                                                      Entropy (8bit):5.794635940060764
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOuKOG811jdHvXjy9RDujdHjdVlj6cKj/ujdDEmy9g72b48RpF3dAQ:7HOvuKp81rOOI7jRN9Y2b48RLNP
                                                                                                                                                                                                                                      MD5:318C6A22B3D461A6867FA99882403140
                                                                                                                                                                                                                                      SHA1:701E461FC12532BAF939D57CFC64DE14741695BD
                                                                                                                                                                                                                                      SHA-256:B18133A60D83CB24DA4EF0CBBFE656D1EDC6BE38059B5BEC217073D31BAA896B
                                                                                                                                                                                                                                      SHA-512:AF17165D7A185B77511DA7D93917F483CE1B5DCAD85D48681CBEE9DD14534601B2F47FCB296F263D27FA4252978852A47C4E1EE17AA9DA048B7C474045FC4579
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Ob.vate sa, .e v.s niekto sleduje?",.. SEARCH_TOAST_SUB_HEADING: "Prehliadajte pomocou DuckDuckGo s.ochranou McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "Anonymn. prehliadanie DuckDuckGo", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} zabezpe.uje va.u hist.riu vyh.ad.vania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "Zabezpe.en. vyh.ad.vanie McAfee", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokuje .kodliv. odkazy vo v.sledkoch vyh.ad.vania.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo bude predvolen.m vyh.ad.vac.m n.strojom.",.. SEARCH_TOAST_YES: "Vysk..ajte s.kromn. a.zabezpe.en. vyh.ad.vanie",.. SEARCH_TOAST_NO:"Nie, .akujem"..}..//E6D4FB83ED7B4A79E585ED4FB98DCB78B149E417D4CA925D8CAF8D3995BE27D3C8FAD26A60498A5EDB5B6EE721FD7B6B6DC83F165FCAACE3039A293314FED8D8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):899
                                                                                                                                                                                                                                      Entropy (8bit):5.578822627011768
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyO5bp57xqyeE1jdHqj81jXjdHjdSjqQf7jdXoBSLgOYk/BftVNwkTfD:7HOv5rcsh1jlQfddLj/BPakTr
                                                                                                                                                                                                                                      MD5:3CB0A8727BEB6AC93716A8237C4FC422
                                                                                                                                                                                                                                      SHA1:54B3F851C35E7B11907D006100025E5AE34385ED
                                                                                                                                                                                                                                      SHA-256:4ABE5BCF2FBA084F199207BB51C70DF8D50E8E38607856AFDABDCA02B949B6AA
                                                                                                                                                                                                                                      SHA-512:10D564E9C144AA35B800A858492DCBC3ABC49D9D8522C4ED96D816C888C754DE3A34AFD2AD8AB203F3A55F65495C0E26219CA301740CEB65CAA5156E78D6ECB9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Brinete da ste pra.eni na mre.i?",.. SEARCH_TOAST_SUB_HEADING: "Koristite DuckDuckGo uz McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo pretraga uz privatnost", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} .uva privatnost va.e istorije pretrage", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Bezbedna pretraga", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blokira zlonamerne veze u rezultatima pretrage.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo .e postati va. podrazumevani pretra.iva..",.. SEARCH_TOAST_YES: "Isprobajte pretragu uz privatnost i bezbednost",.. SEARCH_TOAST_NO:"Ne, hvala"..}..//77E75F42ADEED375A644E18B387E57D7814B5E6A41754AF9C258C4B1E5A8191BAD48FA8B95D66DEB12E20B9FE126F8C2AD07F1AEBCBB1AD11DC45CABA30B7A05++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):855
                                                                                                                                                                                                                                      Entropy (8bit):5.6070687329669155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOP10P/1jdHgjNejdHjd6HjSEqNjdc+yJLzwdanxTSLdGcvm2AiQk:7HOvt0XKYEV+yJ/wMxeFmsQk
                                                                                                                                                                                                                                      MD5:6CA3B31EC1520D88021716667D47E15C
                                                                                                                                                                                                                                      SHA1:4D92E682A49A53EE80D4E893D8F84CC2B89FE510
                                                                                                                                                                                                                                      SHA-256:6F9717BF852368E51C22B933DBEC72A4D46F9CD3A8F6E5B1AEF55F91D8EAAB75
                                                                                                                                                                                                                                      SHA-512:6005C41A1B5827D9C4223DBECEBD266C4E22D15BDE99E6FB2EED6D3C9B7E18B4572B7F7B0E9564CE415C3F98142580247E59CD47DC45D42053626C84AA04E064
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".r du orolig .ver att bli sp.rad online?",.. SEARCH_TOAST_SUB_HEADING: "Anv.nd DuckDuckGo med McAfee.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Privat s.kning", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} h.ller s.khistoriken privat.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee s.ker s.kning", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} blockerar skadliga l.nkar i s.kresultaten.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo kommer bli standards.kmotorn.",.. SEARCH_TOAST_YES: "Testa privat och s.ker s.kning",.. SEARCH_TOAST_NO:"Nej tack"..}..//BF3DE95DE781F826D36ED0B1A7FACF5D9E2F4199F42AE4390BB43180D83232A91F0DA18EC9BCA40C0AA054A32C58DC7CFF107459B7DEA50D49EE2B59873472BA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):907
                                                                                                                                                                                                                                      Entropy (8bit):5.673435471439294
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOb0kPX0jdHCZjHvLWjdHjdatBjQ8JI3chAjdKlaUAcYQHcPTmsFmHfjMnUIK:7HOvb023vLrubY/YQ+TmsFSfjMnUIwh
                                                                                                                                                                                                                                      MD5:1A0184452CAB014B591371EE898988F7
                                                                                                                                                                                                                                      SHA1:C7160818636988656CA13CBED5EB47B54BBED58C
                                                                                                                                                                                                                                      SHA-256:BA8716317A24C874C42F21E349955CE917CB217C590DA92777A808EF0FDDAE97
                                                                                                                                                                                                                                      SHA-512:22B3F607EB8150DE609A35F3DBD7B63E92C6C52BBFB1221BD9E6E78647558336D4251BEB8843B8F0DBADFB5C4608F0E84DA62744B3A3692ECBFECA30F015ADF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".evrimi.iyken izlendi.inizi mi d...n.yorsunuz?",.. SEARCH_TOAST_SUB_HEADING: "McAfee ile DuckDuckGo kullan.n.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Gizli Arama", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} arama ge.mi.inizi gizli tutar.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee Secure Search", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} arama sonu.lar.ndaki k.t. niyetli ba.lant.lar. engeller.", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo varsay.lan arama motorunuz olacakt.r.",.. SEARCH_TOAST_YES: "Gizli ve G.venli Arama'y. Deneyin",.. SEARCH_TOAST_NO:"Hay.r, te.ekk.rler"..}..//9232A4B87AAD8EED3ECC66C32007B3CEF6DC0AFEF995183493F53C57065DB5109717D5EFAFEDAA627C412849A58077D1AC24807402EF307B7A0FE571A35ABD95++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):848
                                                                                                                                                                                                                                      Entropy (8bit):6.095129870449148
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HO+9p0jdH4Ly0jJwCjdHjdOZLy0j2u1AjdKeNygHChAKINWLOfOAhT:7HO2Lyyw5LyHf8gHzKINWLOfDB
                                                                                                                                                                                                                                      MD5:001B0BCFD89E2910D1E2C8B89B46FC5D
                                                                                                                                                                                                                                      SHA1:8250FF2DE6FE6605B02AB4D7D57069A1DBC96EF4
                                                                                                                                                                                                                                      SHA-256:6940551A5EAA31249477A8AB1D4127C1D443475084B5AB55FBC562CDC3F0E49C
                                                                                                                                                                                                                                      SHA-512:F3D023C707E2B1454F53036FDC38B4A5D0B3818655482A75CCBB2456CEF94DA06384F7665910B8E62A62AB590966F780F217645638FD291918F5E7EA0D82B03C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_HEADING: "........",.. SEARCH_TOAST_SUB_HEADING: "....... DuckDuckGo.",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo ....", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} .............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: ".......", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0} .............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ............",.. SEARCH_TOAST_YES: ".........",.. SEARCH_TOAST_NO:"...."..}..//066C126F47EF439FA4D6B9A745F4D2A428B57E15FB9C3E9EDF30FD7D885A76DCD30578CC3ABAEA2D9FF8670A5EA463617B30A2F3669BC4E34F6EBBFEE62FE034++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-duckduckgo-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):863
                                                                                                                                                                                                                                      Entropy (8bit):6.122936740230889
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HOyOOcMZGjdHMLBj8SC5jdHjdtjkYjd/eBAM+bCvk+aWR9Lp:7HOvupLyFeF0j+9Lp
                                                                                                                                                                                                                                      MD5:73A12263B4162A648426D9353C912863
                                                                                                                                                                                                                                      SHA1:4F5BFE5517106A0C43583DDE52D944CE3E66EADC
                                                                                                                                                                                                                                      SHA-256:FBE2134B1B94B760EA12DFC1DB89CF84EF6A19993467455FF4335A7675B69E05
                                                                                                                                                                                                                                      SHA-512:202B852E1C4838953D39A3AD6CDDDC64A6E919DA23496A993A2C991491BEB4F0168DA97B48F9C66DB5D3F69BC23DF7D30C910059A1A38553DDD29ACB6740D1DC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".........",.. SEARCH_TOAST_SUB_HEADING: ".... DuckDuckGo . McAfee ..",.. SEARCH_TOAST_BULLET_STRONG_1: "DuckDuckGo Private Search", .. SEARCH_TOAST_BULLET_NORMAL_1: "{0} ...............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_BULLET_STRONG_2: "McAfee ....", .. SEARCH_TOAST_BULLET_NORMAL_2: "{0}..............", //{0} SEARCH_TOAST_BULLET_STRONG_1.. SEARCH_TOAST_SUB_FOOTER: "DuckDuckGo ............",.. SEARCH_TOAST_YES: ".........",.. SEARCH_TOAST_NO:"...."..}..//A6414BA834CEB056D1F20F675ECCD13789B7F792B5AB4CE8768275998C4502FB956AD5D935C752225D2FC7C7B5E2E4747290C227B073497F043B12FD5EE9D6CB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (307), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11879
                                                                                                                                                                                                                                      Entropy (8bit):5.0054514669898325
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CBketuJEUrvtH9Ai5trhElBXXrhEN1QtfT6G8:CBksuJEUrvNyi5tKBnkQVOG8
                                                                                                                                                                                                                                      MD5:F014E6A3EFE798D4EB47841DFA2307A0
                                                                                                                                                                                                                                      SHA1:30A7389BE80B85E23951740EF8315EF7A0330351
                                                                                                                                                                                                                                      SHA-256:D268E526C00DCC7D819DBD128569B2A1746FFE1527A402336CE333F2E6A5FB69
                                                                                                                                                                                                                                      SHA-512:AE18F2D654823C3116EEC050F997572C541D4CA61560A0A9D6AF7BC71726EC0773A273DA34187857CAC70B067A72510DC74D27E7EF38AFE8E8496250739E0862
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ". ....... ......... ..... ................, .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ ...........",.. SEARCH_TOAST_BODY_TEXT: "...... .. ......... ..... ... .... ....... ... .... ............. ........... .. ........ ......... ..........;",.. SEARCH_TOAST_OPTION: "..., .. ............. . ....... ......... .... ... ............ ... ............ ...........",.. SEARCH_TOAST_DONE: ".....",.. SEARCH_TOAST_HEADING_COMPLIANT: "... ......... ... ...... .........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6293
                                                                                                                                                                                                                                      Entropy (8bit):5.375969242474785
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Ckl7LklkKuaz45DJMtR4fAgK0vQ8jwsClwJcv+ztBDABrBN9FC1WgjsRBva54ApY:CkWF+Uturjjj42tBABrFoUgOBixY
                                                                                                                                                                                                                                      MD5:C3DB8EFD81BED2AB98E32AF88AF1235D
                                                                                                                                                                                                                                      SHA1:8E84A93C74FC84CD26B1E27ED6888FFFB69504B9
                                                                                                                                                                                                                                      SHA-256:25CAC11A7D0C9DB43F4EDCE1986EC8B0A5D437E5952A72DDA1D68F4A9B25BEA9
                                                                                                                                                                                                                                      SHA-512:3BA4B3E7CE67B77181E0FEF52356008BC45C66241C58F8A63BB86C931D94B5806F4596EB7E6AEA037CFD2A12F5369F7C870C7A0A6EBAA622E17C8524A9CF94DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Secure Search is off . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your search results.",.. SEARCH_TOAST_BODY_TEXT: "Want to stay ahead of the bad guys with extra search protection?",.. SEARCH_TOAST_OPTION: "Yes, turn Secure Search on after I restart my browser.",.. SEARCH_TOAST_DONE: "Done",.. SEARCH_TOAST_HEADING_COMPLIANT: "You don't have Secure Search . be careful",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Secure Search steers you away from risky sites in your search results.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Would you like to add Secure Search and stay ahead of the bad guys?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Yes, add Secure Search to my browser and change my default search to {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHOO: "Yahoo",.. SEARCH_user_YANDEX: "Yandex",.. SEARCH_user_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7166
                                                                                                                                                                                                                                      Entropy (8bit):5.358441925510331
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CikaW+DI24sA0etjy/gsjyw9FsBR52/MGSrZcUyxITK3mvQ0:CNL+DI23ktjy4sjyGeR5jKnOKWv9
                                                                                                                                                                                                                                      MD5:BDBE27216014018CA7E49C5BDD02E35F
                                                                                                                                                                                                                                      SHA1:53132EC75BF76F0DE4E918BB22220208501DAF9A
                                                                                                                                                                                                                                      SHA-256:5BB5302B2377172B45D67FA9CA76150BBB79951916DD4CE49D8ECC2EA21DB7BB
                                                                                                                                                                                                                                      SHA-512:CACB868C31FF0933CADEA9B23A86BB87358BF639F1575D1AF6C30623FD312FEE75746AEE6C638A60EBA416F17C24F5CBAA935F7C5BD9E8CC2E1B8ACB952C8143
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "La b.squeda segura est. desactivada: ten cuidado",.. SEARCH_TOAST_SUB_HEADING: "La b.squeda segura elimina los sitios web peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT: ".Quieres ir un paso por delante de las amenazas con una protecci.n extra en tus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar la b.squeda segura despu.s de reiniciar mi navegador.",.. SEARCH_TOAST_DONE: "Listo",.. SEARCH_TOAST_HEADING_COMPLIANT: "No dispones de la b.squeda segura, ten cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La b.squeda segura elimina los sitios web peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".Quieres a.adir la b.squeda segura e ir un paso por delante de las amenazas?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., a.adir la b.squeda segura a mi navegador y cambiar mi b.squeda predeterminada a {0}.", // {

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6972
                                                                                                                                                                                                                                      Entropy (8bit):5.38156402946273
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:C7nHt6A2Av8eK1mD8OOtjvQxj4jJ5QXGfTB9W:C7nN6dABK4wOOtjvQxj4lomTB9W
                                                                                                                                                                                                                                      MD5:1EC390B035D776856A9A321A1145178B
                                                                                                                                                                                                                                      SHA1:A4F3F2FB708FD9F34E13C2816D279EC2DE88AE5E
                                                                                                                                                                                                                                      SHA-256:0D9FB333B8B0F0E14571CB19EFAC5DA01893D283B8C699DE65C63C2BAB3F84BA
                                                                                                                                                                                                                                      SHA-512:F3E04400A5DF8A8BC420992E97A5B921A08503822317AF84BA35C0F7D20762329825284FDFD1FDE8F9A0A17029E8DD70D1B7720BF797D98E7FC6D1A28FB5C482
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "B.squeda segura desactivada: ten cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura elimina los sitios peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT: ".Quieres ir un paso por delante de las amenazas con una protecci.n extra en tus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de reiniciar mi navegador.",.. SEARCH_TOAST_DONE: "Listo",.. SEARCH_TOAST_HEADING_COMPLIANT: "No tienes B.squeda segura: ten cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "B.squeda segura elimina los sitios peligrosos de los resultados de tus b.squedas.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".Te gustar.a agregar B.squeda segura y adelantarte a los malos?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., agregar B.squeda segura a mi navegador y cambiar mi b.squeda predeterminada a {0}", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6713
                                                                                                                                                                                                                                      Entropy (8bit):5.3999395489388125
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Cf5VcSzQubYOrlY0XRMYSJd1VtHyYZN66mHyY4XubW:CfWJXecJtlf6vl8ubW
                                                                                                                                                                                                                                      MD5:3E335D695F7DB82D87608C72A16A1327
                                                                                                                                                                                                                                      SHA1:9E7B3368781D86DAF254E42B500E2589F276ACD3
                                                                                                                                                                                                                                      SHA-256:62CCCE41461596BB9FF5DDDF9B197E5025D66FBCDC1D0672BF0D151D2D957A38
                                                                                                                                                                                                                                      SHA-512:C4B4F71231182A914D4E9DBCADE2A5A457FE112EDEAA1304622560FA660CF7B81112C44816E52CCF2554C41390B6D4BFD026D34C52BE6FFDD2A21051801423C9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Varoitus: suojattu haku ei ole k.yt.ss.",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja.",.. SEARCH_TOAST_BODY_TEXT: "Haluatko lis.suojaa hakuihisi?",.. SEARCH_TOAST_OPTION: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. SEARCH_TOAST_DONE: "Valmis",.. SEARCH_TOAST_HEADING_COMPLIANT: "Sinulla ei ole suojattua hakua . ole varovainen",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Haluatko lis.t. suojatun haun, jotta pysyt jatkuvasti muutaman askeleen rikollisten edell.?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Kyll., haluan lis.t. suojatun haun selaimeeni ja muuttaa oletushakukoneeksi {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHOO: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (322), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7707
                                                                                                                                                                                                                                      Entropy (8bit):5.3381416544994575
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CNztZLR3dPCgbg0LUaJbQA1A/6yb2qz2KAnt/rF43U/HqBosOCA2FSQ:CB/CqQaKA1i64z27t/rF43U/KBosOCAo
                                                                                                                                                                                                                                      MD5:FA26B4A72E2782DEA4DE026BA74B3E13
                                                                                                                                                                                                                                      SHA1:69FB4CF6B00C2C9FFBFE9911A83BE43BFE47EEB6
                                                                                                                                                                                                                                      SHA-256:9C15FCEBEF8D2E48CB0073055A93920D1E7AA8E6AC7D6169ED616AAE9B1A66AF
                                                                                                                                                                                                                                      SHA-512:44B6877C4E6463DFFD354C24C4929E3779444EED79B86E63E56A9ADE1832F2681BAA4DC53A46E98ECC40F8918BBE71A0ED9E97266425C49C3E7331185328E293
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Attention! La recherche s.curis.e est d.sactiv.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e vous met . l'abri des sites Web dangereux figurant dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Voulez-vous d.jouer les escrocs en vous dotant d'un moyen de protection suppl.mentaire?",.. SEARCH_TOAST_OPTION: "Oui, activer la Recherche s.curis.e une fois que j'aurai red.marr. mon navigateur.",.. SEARCH_TOAST_DONE: "Termin.",.. SEARCH_TOAST_HEADING_COMPLIANT: "Attention! La recherche s.curis.e n'est pas install.e.",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La recherche s.curis.e .carte de votre recherche les sites internet risqu.s.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Souhaitez-vous installer la recherche s.curis.e afin de garder une longueur d'avance sur les escrocs du Web?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Oui, ajouter la recherche s.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7690
                                                                                                                                                                                                                                      Entropy (8bit):5.335738313754324
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CsERzSimDtBPs31a2/DMEopt+3eOpPZA2XYGAlfu:CXFABPq1x8t+3HZA2IGAlfu
                                                                                                                                                                                                                                      MD5:58F730659AEA6BFB14DC505701FEB4EC
                                                                                                                                                                                                                                      SHA1:63095BBB45DDB2514B613FDF38062D653311721A
                                                                                                                                                                                                                                      SHA-256:D33338E420F6F40106E7230FFEEF1699C0714EA7AA9BD8ECF7037EB1FFE692D7
                                                                                                                                                                                                                                      SHA-512:D968B7B7B370F518CF922EFB1344AFFAFDA54F8CDA0987819B81CDA546DB12F5CB298B4520E626C4E25BF5B1910EBBC6A2F4BB3F535C8B990A2673326C2AE706
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "La recherche s.curis.e est d.sactiv.e. Soyez prudent.",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT: "Vous souhaitez une protection de recherche .volu.e qui vous mette . l'abri des utilisateurs malveillants.?",.. SEARCH_TOAST_OPTION: "Oui, activer la recherche s.curis.e apr.s le red.marrage du navigateur.",.. SEARCH_TOAST_DONE: "Termin.",.. SEARCH_TOAST_HEADING_COMPLIANT: "Soyez prudent, vous ne disposez pas de la recherche s.curis.e",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Voulez-vous ajouter la recherche s.curis.e et garder une longueur d'avance sur les personnes mal intentionn.es.?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Oui, ajouter la rech

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7046
                                                                                                                                                                                                                                      Entropy (8bit):5.485914206328592
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:C1/oREn0Rscvuy66DERG9MCt9qU8FCjN9JPh9qU8F/9FYeP5en2uRpPpQAqE:CxnifBE6t9z8FAN9H9z8FFeQm5DPyAb
                                                                                                                                                                                                                                      MD5:3C6BC626386F5512D76BEBEDF9F5EA37
                                                                                                                                                                                                                                      SHA1:97BF25599A08D41EA6D2AE00624AD80FD751F802
                                                                                                                                                                                                                                      SHA-256:060E22FB344AC6D43A27859E11ECADEA08627118DAF33640B76D241012C329EB
                                                                                                                                                                                                                                      SHA-512:727F54137CFA1B588DC027653AAC2F2AE57F9AFD817E97129EDA57B65B0CFFF88104B924E7B31902B879D53279ADE4E9F42D0F2E84AA4ACCB5BBB2D5F877BCB2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Isklju.eno je Sigurno pretra.ivanje - budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT: ".elite ostati nekoliko koraka ispred negativaca s dodatnom za.titom pri pretra.ivanju?",.. SEARCH_TOAST_OPTION: "Da, uklju.i Sigurno pretra.ivanje nakon .to ponovno pokrenem preglednik.",.. SEARCH_TOAST_DONE: "Gotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nemate sigurno pretra.ivanje - budite oprezni",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".elite li dodati sigurno pretra.ivanje i ostati ispred?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Da, dodaj sigurno pretra.ivanje mojem pregledniku i promijeniti svoju zadanu pretragu na {0}.", // {0} SE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7496
                                                                                                                                                                                                                                      Entropy (8bit):5.552843123661257
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CyQ0mXVpV8YYxZXThD71WnkWYtezBPwe49Fnmsv31B94+CgBi:CxFXV8YabLtaB4jXH4gBi
                                                                                                                                                                                                                                      MD5:D62A6EC876F6108DF03B0E09F6A58E9C
                                                                                                                                                                                                                                      SHA1:3420F11A18E128435FB29D31D1773BFF60EE8EA2
                                                                                                                                                                                                                                      SHA-256:A818BD059F76AC8F25753C23622070E0BBE8288C2410B770CD1A25FCBAD5D820
                                                                                                                                                                                                                                      SHA-512:02214F454364DE41D10E073DAB862D44126AB960D03A3EA68EE0DFAF746B9E23132E273C582A45BD98FB1C846F09C5E65CF0B91AF34B7F74E2ECD1D087D41C90
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A biztons.gos keres.s ki van kapcsolva. Legyen .vatos!",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT: "Szeretne a rosszfi.k el.tt j.rni az extra keres.si v.delemnek k.sz.nhet.en?",.. SEARCH_TOAST_OPTION: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tottam a b.ng.sz.t.",.. SEARCH_TOAST_DONE: "K.sz",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nincs biztons.gos keres.s funkci.ja . legyen .vatos",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Szeretn. hozz.adni a biztons.gos keres.st, hogy n.h.ny l.p.ssel mindig megel.zze a rosszfi.kat?",.. SEARCH_TOAST_

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6908
                                                                                                                                                                                                                                      Entropy (8bit):5.242691937762663
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CNcefx5VArSHAmTy+rr0l2BJ07tpelslpeWy++WVHJd:CL5OpmOU0lCJ07tpiWp4sn
                                                                                                                                                                                                                                      MD5:15D900D57EA07771CF9DC5AB85EC9519
                                                                                                                                                                                                                                      SHA1:F17B5391CE29E890284CF6186BAAFD1876542217
                                                                                                                                                                                                                                      SHA-256:7F9A0A342E2B4AE78EF379DAEF5F4B125E5853054DB8F0AFDE459BFB0AEBD027
                                                                                                                                                                                                                                      SHA-512:0ADF0F1F94063DBA39F7972E93317EF6A5A34D1482B7A1151E70475EA0D822F3B003FC590AFCEB99706E522C4D3BDA4C986BCEECD0F59A4B62FC6D4F20C43EDA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Attenzione: la funzionalit. di ricerca sicura non . attiva",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche.",.. SEARCH_TOAST_BODY_TEXT: "Vuoi essere sempre un passo avanti rispetto ai malintenzionati, grazie a una maggiore protezione delle ricerche?",.. SEARCH_TOAST_OPTION: "S., attiva la ricerca sicura al riavvio del browser.",.. SEARCH_TOAST_DONE: "Fine",.. SEARCH_TOAST_HEADING_COMPLIANT: "Attento, non stai usando la ricerca sicura",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "La ricerca sicura consente di escludere i siti rischiosi dai risultati delle ricerche.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vuoi aggiungere la ricerca sicura e tenere alla larga i malintenzionati?",.. SEARCH_TOAST_OPTION_COMPLIANT: "S., aggiungi la ricerca sicura al browser e imposta il motore di ricerca predefinito su {0}.", // {0} SEA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8147
                                                                                                                                                                                                                                      Entropy (8bit):5.851224763965864
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CPLfnSHyVfZ2H6EisoqNkij09yT4eKVX0fe66UqPJGNBcpIEdt4/L22XPJn4/799:CumbTi9Itk2s1EuSU8sJ7nob
                                                                                                                                                                                                                                      MD5:B049467751BC3F90F948C586A1043DF8
                                                                                                                                                                                                                                      SHA1:E77BEB8CF4EB4A9CBAAF65CB4139B86BEAD184FC
                                                                                                                                                                                                                                      SHA-256:387A90185C9E469E0C85827CCCADA6BA4979F7C52CC2F86718518161BC2B3270
                                                                                                                                                                                                                                      SHA-512:42A14C1114E7AC295F8F5BF817D39C0B98C064CBF397CAA859F374C664E3A192E97FCC69B7996781E90D0F834C134F51A04B23F2627AA26211934C56765F6BD0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: ".........",.. SEARCH_TOAST_HEADING: ".... .................",.. SEARCH_TOAST_SUB_HEADING: ".... ........................",.. SEARCH_TOAST_BODY_TEXT: ".........................",.. SEARCH_TOAST_OPTION: ".................. ...........",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: ".... ..........................",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".... ........................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".................. ...........",.. SEARCH_TOAST_OPTION_COMPLIANT: "........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7384
                                                                                                                                                                                                                                      Entropy (8bit):5.936442932502741
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CIfSwAbRpdRzltRSN79FIt4khpJAk/Nzf43:CIawKtRSNp1k+YD43
                                                                                                                                                                                                                                      MD5:F3B4AE74BC33CA54A617195554DEC210
                                                                                                                                                                                                                                      SHA1:B011346E116B1B2B4B5D7BC4037E76225551E272
                                                                                                                                                                                                                                      SHA-256:1D2FC50DAB104F29F5F5ABBB52F9B9E0DD419D1E1E671CC86561BA94E8D03AF1
                                                                                                                                                                                                                                      SHA-512:95BD454A2D805CDD9C7B36E3EE9E4A2DCC94D31783244B1D5DA838216F746F05CF16A40A1728EAA3FB1E73D35DFB85D4599E025714484B7316139CFD9B6CD6A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "......",.. SEARCH_TOAST_HEADING: ".. .. ..... - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT: ".. .. ... .. .... ... ........?",.. SEARCH_TOAST_OPTION: ".. . ..... .. ... . .. ... .......",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: ".. .. ... .. - ......",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".. ... .. .. . ... .... ......",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".. ... .... ... .. ........?",.. SEARCH_TOAST_OPTION_COMPLIANT: "., .. ... . ..... .... .. ... {0}(.). ......", // {0} SEARCH_TOAST_*.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6835
                                                                                                                                                                                                                                      Entropy (8bit):5.389248861619669
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CKrYAXY8c4VteYFB8K3ueYFYRbyLXKFK4MV:CNGY8VVt7FB8K3u7F6yLXKFK7V
                                                                                                                                                                                                                                      MD5:948C535D59BA469B8EC9A7D68A48669D
                                                                                                                                                                                                                                      SHA1:52F4E27C7D7C220524E3B9EA96CF06E7A7053221
                                                                                                                                                                                                                                      SHA-256:DB88F91B5E991C77EE5F2EA846E4B9680E7B482A470A3ED5B789999B0B6A465E
                                                                                                                                                                                                                                      SHA-512:F8EC307D6286D16F19620E3702AC60DAE1022EFCB7CD3CAE37437D1DAA55E553E1FA35AC3C02DF4FF8DEB07170BDCCDA37B68A1A1B2478A279E99634261F12D6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Sikkert s.k er sl.tt av . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna skadelige omr.der i s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT: "Vil du ha et forsprang p. skurkene med ekstra s.kebeskyttelse?",.. SEARCH_TOAST_OPTION: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt.",.. SEARCH_TOAST_DONE: "Fullf.rt",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har ikke Sikkert s.k . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Sikkert s.k holder deg unna skadelige omr.der i s.keresultatene.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vil du legge til Sikkert s.k for . ha et forsprang p. skurkene?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, legg til Sikkert s.k i nettleseren min og endre standard s.kemotor til {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHOO: "Yahoo",.. SEARCH_user_YANDEX: "Y

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6746
                                                                                                                                                                                                                                      Entropy (8bit):5.353225815241767
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CHSyoqPxfaPVFJ1bshox+a3uz27w8iLt9ls3cLt3CPiMWbW3pDLrFH9:C2J4jtjbSLBF9
                                                                                                                                                                                                                                      MD5:C8685838886DEFEEAB01DA50E180297C
                                                                                                                                                                                                                                      SHA1:6D817DE3EDBEC43DD73B2D5BF3BBB299F427288E
                                                                                                                                                                                                                                      SHA-256:334C7DE4E0208403B4CE486A61E1258717F52674F49B4EDBB00F294F381F9CFD
                                                                                                                                                                                                                                      SHA-512:8D1C0C0FFCD9E5F29709CD196A95E5643C5A4C7355BB83AD7D6F288C5C299F2888B090F19A20B556C91F2CA44F5A6A82A8ABB2F2F1ED7A90A0A23D908D2F7F02
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Beveiligd zoeken is uitgeschakeld. Wees voorzichtig.",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden.",.. SEARCH_TOAST_BODY_TEXT: "Wilt u de criminelen een stap voor blijven met extra zoekbeveiliging?",.. SEARCH_TOAST_OPTION: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. SEARCH_TOAST_DONE: "Gereed",.. SEARCH_TOAST_HEADING_COMPLIANT: "U hebt Beveiligd zoeken niet: wees voorzichtig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Wilt u Beveiligd zoeken toevoegen om criminelen een stap voor te blijven?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, voeg Beveiligd zoeken toe aan mijn browser en verander mijn standaardzoekmachine in {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7048
                                                                                                                                                                                                                                      Entropy (8bit):5.612408542710143
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Cp4EhuYbEvbH2jQWjlykLbLJLA1keuRgR1kv6z+tU9k8ir+IQB1y0g8CmYrvBjyt:Cp4EhuYbEvbH4QWjlykbpA1keuRk1kvK
                                                                                                                                                                                                                                      MD5:54F0DA129891ED11F213C5518C5A1F59
                                                                                                                                                                                                                                      SHA1:ADB1541290EB3E7ACA8378D39D34236E0207C154
                                                                                                                                                                                                                                      SHA-256:CED288ADA1435875D7FAE1F373BAC9D74BAFF5A9FDC73DAC19C3136E9562DA8A
                                                                                                                                                                                                                                      SHA-512:FF63F5824F31F4F601B546E1C48293D99E7E07C5D7CCFF09CB53E03296A88C5A6CBE7E29BBB0EB6328F77046E7FCC368A7CE0B48F6BB39DFC27C37F71A4E82F3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Uwaga! Funkcja bezpiecznego wyszukiwania jest wy..czona.",.. SEARCH_TOAST_SUB_HEADING: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT: "Czy chcesz uprzedzi. zagro.enia dzi.ki dodatkowej ochronie wyszukiwania?",.. SEARCH_TOAST_OPTION: "Tak, w..cz funkcj. bezpiecznego wyszukiwania po ponownym uruchomieniu przegl.darki.",.. SEARCH_TOAST_DONE: "Gotowe",.. SEARCH_TOAST_HEADING_COMPLIANT: "Uwaga, nie masz funkcji Bezpieczne wyszukiwanie",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcesz doda. funkcj. bezpieczne wyszukiwanie do przegl.darki i uprzedzi. zagro.enia?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Tak, dodaj funkcj. bezpieczne wyszukiwanie do przegl.dark

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):662
                                                                                                                                                                                                                                      Entropy (8bit):5.745417801821615
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7Ha6F06FXOAdhcUbz4wpHyHK6IPHCmK+AOlNFdEcRc4l:7HrLFOAdiIppSq6IPSOHRcc
                                                                                                                                                                                                                                      MD5:6D000C24CCF85934933567AF4A9E5CE7
                                                                                                                                                                                                                                      SHA1:6496E4CEDF280542B942BA8F447355303AD33ADB
                                                                                                                                                                                                                                      SHA-256:F8AA71B0870A5AA43EAD5351DCEA4779CDD2AFE9DD8A309DCE6F0C647FC26373
                                                                                                                                                                                                                                      SHA-512:05772638E5449C957740A6525A0C7CB218FE4D8508532D1BF62A1C696556AD58DF37BE16FCBF8A11F62A370F39C36D18AF11251B9406262D17B9AB93E74A7FCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Slu.ba Bezpe.n. hled.n. je vypnut. . bu.te opatrn.",.. SEARCH_TOAST_SUB_HEADING: "Slu.ba Bezpe.n. hled.n. v.s ve v.sledc.ch hled.n. upozorn. na rizikov. str.nky. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Chcete zapnout roz...enou ochranu p.i hled.n., abyste byli v.dy o krok nap.ed p.ed hrozbami?",.. SEARCH_TOAST_OPTION: "Ano, chci po restartov.n. prohl..e.e zapnout slu.bu Bezpe.n. hled.n.",.. SEARCH_TOAST_DONE: "Hotovo"..}..//B5F5057D79E491C4EE1F2BB029AD8A7CC1E3A8BC264EE3427FCA3B552DBAE331817303A2895C3A0C3CFDC9A9388722EA216D990AB59B836518541AACF5DFD4F6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):591
                                                                                                                                                                                                                                      Entropy (8bit):5.5619761093306925
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H0Qs8HQMHQs8f2aw5VL0bdhPLjWR8ex9C8ZeKLHQXAey:7Hfs49wsC2aw5t0bdhWR5x9Pyy
                                                                                                                                                                                                                                      MD5:268CA433F82EE424D3C48EBF0BBE9703
                                                                                                                                                                                                                                      SHA1:BEAD02BCDCFF39160D295A5FB379F74326A0523A
                                                                                                                                                                                                                                      SHA-256:EB9B8C3362956F67C2E8BCD0B7BD77DA16331991336EA9947B63111DAA8A4FBE
                                                                                                                                                                                                                                      SHA-512:A7A0AA7A50591CC45F393A8CF112AEEAEB218911227E0158BB2821CF321998A13CB1779D90D2CCEAF79D00525F5E42611DBD22EF97F2FE3AD5279CC5DC54D203
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sikker s.gning er sl.et fra . v.r forsigtig",.. SEARCH_TOAST_SUB_HEADING: "Sikker s.gning markerer de potentielt farlige websteder i s.geresultaterne. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vil du have ekstra beskyttelse ved at g.re dine s.gninger mere sikre?",.. SEARCH_TOAST_OPTION: "Ja, aktiv.r sikker s.gning, n.r jeg har genstartet browseren",.. SEARCH_TOAST_DONE: "F.rdig"..}..//0E82E4EAE50371488D4A7159340151D62D2D0FC126923C62E6D170B58CCFFE90CF370EF40316414C35ED2C100D560F7081FD8B51B51BA0A403D32C0F94F59561++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):626
                                                                                                                                                                                                                                      Entropy (8bit):5.462880121464915
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HV5hKfCvXCQtROXlU1dhIQvQA3yDYBGNJXJWWqEK4SVTah73:7HfhKf+X08dbCYgO9TaF3
                                                                                                                                                                                                                                      MD5:66F32FC7570B8EA305AD1B6D121B8B95
                                                                                                                                                                                                                                      SHA1:A2B5367EEB94A0AD97F9DC2D88A8F4E39A010EA8
                                                                                                                                                                                                                                      SHA-256:04A5B8A4EC89CB1630C4581463431DE2EEE4AE84D8C0218A046B948DB97E3D05
                                                                                                                                                                                                                                      SHA-512:2988DA3A77BAD5D420E6997F9C3D301693C7A91669D969B11236C09F8BE32131768C5D3FAA9B3481CCBE8B15E9EF60AE79A51584074BF573E87E0389CFD1CC5F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Achtung: Sichere Suche ist deaktiviert",.. SEARCH_TOAST_SUB_HEADING: "Mit der sicheren Suche werden Sie vor risikoreichen Websites in Ihren Suchergebnissen bewahrt. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Wollen Sie mit zus.tzlichem Suchschutz Bedrohungen immer einen Schritt voraus sein?",.. SEARCH_TOAST_OPTION: "Ja, ich m.chte die sichere Suche nach dem Neustart meines Browsers aktivieren.",.. SEARCH_TOAST_DONE: "Fertig"..}..//1A944A7735F307EA4619927455A6ACEF8841756E38415A30D791694888CCFB39ACEF273B7A7341AF4D0802B37C395E27638D647F69114E173012D34ECC62EC20++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):966
                                                                                                                                                                                                                                      Entropy (8bit):5.127791253706183
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HzMnpI0MXLr28dNWGmr3/TaMTyNfVyUcOAn:SS268drbS4n
                                                                                                                                                                                                                                      MD5:5CCF9B4842C422E0ACCE1B973D08462C
                                                                                                                                                                                                                                      SHA1:832881D27AD78B4375B7DCA753251767C6C9F677
                                                                                                                                                                                                                                      SHA-256:A55D30EF5B878C8F8D1935E80C756D65EAB61E01880950C14EABC151697DFAB1
                                                                                                                                                                                                                                      SHA-512:A8271841D44A78E369E0CD623D1169F4F8A8C56DCFF24E4590D51CA45F9D9AAF2B307ECA38A89F65D5CFD8EB7B441C1519083A1B0FE7AC7AADD50B539BD8321F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ". ....... ......... ..... ................, .. ..... ...........",.. SEARCH_TOAST_SUB_HEADING: ". ....... ......... ... ........... ... ........... .......... ... ............ ........... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "...... .. ......... ..... ... .... ....... ... ... ....... .. ........ ......... ..........;",.. SEARCH_TOAST_OPTION: "..., .. ............. . ....... ......... .... ... ............ ... ............ ..........",.. SEARCH_TOAST_DONE: "....."..}..//F15FCDAD716F5CCF0C43DC41CBC53F9B70F68E47EEE243EA892913F3DC537C77CD22E6B910F9403ABF223338E2593F26099317B9E18240D96FDDD2D0590C4CE4++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):546
                                                                                                                                                                                                                                      Entropy (8bit):5.438549975770166
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H4HIWFH3npSuVJTsdhIEfRXK9m/NaU/mruYOiFpdc3W5niLn:7H4NXpSuVJTsdjfRXKIVaIYOYc3Dn
                                                                                                                                                                                                                                      MD5:169DB669C2E87CCD5A0EA7B9F80D9871
                                                                                                                                                                                                                                      SHA1:E0287510D4A3E4B8FB0BEEA4EDBC47728A5ED9D2
                                                                                                                                                                                                                                      SHA-256:0DB47E585633965817E3DD6ECFA8C21510A66035DA0897AC0C4FAAB962B6AF60
                                                                                                                                                                                                                                      SHA-512:8F44F3122FCD225A10303108578717CCE2317260AE7669FE2A8CE856DE6EDD4883CEBD6ED510CA1047D3391272300BA450F1BE06A29120B765F8C543446C7F3E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Secure Search is off . be careful",.. SEARCH_TOAST_SUB_HEADING: "Secure Search steers you away from risky sites in your search results. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Want to stay ahead of threats with extra search protection?",.. SEARCH_TOAST_OPTION: "Yes, turn on Secure Search after I restart my browser",.. SEARCH_TOAST_DONE: "Done"..}..//3B0F806960C0EBCEB6875FFA6C5AB218F0BC0197B7A461E9AF6B50449350E6C48E8F59570E7C8FFD78CB8FEE14D1E7FA6FD5B4F9FC633CB100ABA08F5B950733++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):621
                                                                                                                                                                                                                                      Entropy (8bit):5.537233953269622
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H1b6YjvHDkYdhDOnKjHZ/QC5MHYRUuUdTvyXZtgkSaO:7HRHDkYdQneZ/7kYRUpyJSkSaO
                                                                                                                                                                                                                                      MD5:427551114EA5A011444628C70C7BB418
                                                                                                                                                                                                                                      SHA1:3A3EFDBCE6BF14F01CB75F85E489EB1EF1300190
                                                                                                                                                                                                                                      SHA-256:40B4465BCFCDEFCE61F1E4CE13D8F8D033C3B512863DB2534B200C83890CE607
                                                                                                                                                                                                                                      SHA-512:DBD3E8B11B1EFD3871A150A7A5036B1FF8A3FBD98DF93F70BB5707BC5016949EA8A52953B752CF86E85B671722C61E262AED28555F3C07791400F4B43D85AF7E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "B.squeda segura est. desactivada: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura filtra los sitios web peligrosos en los resultados de sus b.squedas. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".Quiere ir un paso por delante de las amenazas con una protecci.n extra en sus b.squedas?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de reiniciar mi navegador",.. SEARCH_TOAST_DONE: "Listo"..}..//22113BF8133CA2B542C35409BEB44349FF7195F5280B80A5DA2FDE99530CC1AC1FDA0EE6BE1200980557EDC41763B2A6D8A584D9C5D924BF105FB59F1E268B50++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):590
                                                                                                                                                                                                                                      Entropy (8bit):5.549329076958939
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7Heaf6Yrsi5KD/DdhDybH62P5MHrS2RharnJJNR:7HdLsiUDLd0rXPkm2RharnJJb
                                                                                                                                                                                                                                      MD5:5C0F8444768786231BCAE2BAB01DB143
                                                                                                                                                                                                                                      SHA1:52F4CF3BDD62D1B01FA75182C19F33E0956ADA7C
                                                                                                                                                                                                                                      SHA-256:B14DD7E06C4B84C637F79A20F254339763AA9C462B8CED7FE86A57EFA827343F
                                                                                                                                                                                                                                      SHA-512:CA6EA26F0DAE0CB66EE1EC2C330A7AC8AC75CD73E50D0DC9B6F4085F294A3F9FDA3CFD059EBBAC0753163E110F4A74CF582ED77824341E2FD476F3625DF8EAE7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "B.squeda segura desactivada: tenga cuidado",.. SEARCH_TOAST_SUB_HEADING: "B.squeda segura lo aleja de sitios peligrosos en los resultados de b.squeda. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".Quieres adelantarte a las amenazas con protecci.n de b.squeda extra?",.. SEARCH_TOAST_OPTION: "S., activar B.squeda segura despu.s de que reinicie mi navegador",.. SEARCH_TOAST_DONE: "Listo"..}..//FD039D2FF52D2066F725F3E939530D8C2233666687E07490F3C30EBB3AB47239E8B845875CE212B94A004E731C278B52AA5FEBF66022B264C3870064E0B98435++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):594
                                                                                                                                                                                                                                      Entropy (8bit):5.550128328447868
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HpBjkIHMjpJNnddhFyXLcE6P8ljSy3FJHzWv0R67:7HpBBHsNnddeXInP8lmSFcv1
                                                                                                                                                                                                                                      MD5:F7B6A3976436D07842B0CE96DE0D96BF
                                                                                                                                                                                                                                      SHA1:86F2D4C66B4B4838D300F449F1A9AD4E7E983A4F
                                                                                                                                                                                                                                      SHA-256:C754516DC578EF2149DF10451A36ED4E492CC0DCB761EEA83A15BF5F6DB54CDF
                                                                                                                                                                                                                                      SHA-512:5E7D1B934A8C790E8E6CD2A4F820A3D22E86A2892DAEC8DF51AC28455B99493BA272E4287EEBD98E760717989478540D74D60AC195DDEFC31A91C7B46689D40E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Varoitus: suojattu haku ei ole k.yt.ss.",.. SEARCH_TOAST_SUB_HEADING: "Suojattu haku suojaa sinua vaarallisilta verkkosivustoilta, kun suoritat hakuja. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Haluatko pysy. askeleen edell. ja hankkia lis.suojaa hakuihisi?",.. SEARCH_TOAST_OPTION: "Kyll.. Ota suojattu haku k.ytt..n, kun k.ynnist.n selaimen uudelleen.",.. SEARCH_TOAST_DONE: "Valmis"..}..//A797A51DF9C65656375FD23F91EE06DD44A003D12551E39080ED858A0008242F2715CFA6D6A8C2469BE3EA5386C7A9922CEB79135C7579BFA5B45D8580A0548E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):619
                                                                                                                                                                                                                                      Entropy (8bit):5.451330148560123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7He5LuGrtBdhLjwQ8SlK3woEEnmWYoIjiC6qfjkl:7He5LustBd5wwlK3/EaxQFjkl
                                                                                                                                                                                                                                      MD5:F94A9F460C65BA0CF9752D9C0D71CEFE
                                                                                                                                                                                                                                      SHA1:4FC47DD6B09927FBE73D8FBDC59C5114710A7E4F
                                                                                                                                                                                                                                      SHA-256:F2F5849F54D85A9E5B0D59E6F20B6623255C241E062746623FDA269A4FEE12D2
                                                                                                                                                                                                                                      SHA-512:D8718DEB938F7A3F1467C6B4CF4C5A162F11B78AB418BC172765CBC393909F89129F065C4B069B4E951196B964D42B40FBC329A61836D7826455F8E219A0CC9F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attention! Recherche s.curis.e est d.sactiv.e",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte de votre recherche les sites internet risqu.s. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vous aimeriez garder les menaces . distance avec une s.curit. de recherche accrue?",.. SEARCH_TOAST_OPTION: "Oui, activer la recherche s.curis.e quand je relancerai mon navigateur",.. SEARCH_TOAST_DONE: "Termin."..}..//294F23E4A2F981F3B4002EBC3CC16AF8963ABAE85252B0C67975547FF951375827F321F31D96447D863DA4B24E62EA7CB469C610E51503BD5BB63895A8FA101D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):654
                                                                                                                                                                                                                                      Entropy (8bit):5.493993879574286
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HQ7vJmt/5Tdh0tTdQzFOQ8S4NKXz4wlckGyg:7HQ7vJmtJdWtTOpKNKX1Va
                                                                                                                                                                                                                                      MD5:E258627E446D70314D74F4A22DFD79ED
                                                                                                                                                                                                                                      SHA1:33B0C9EE17A132A038863F387D82027AFE639F98
                                                                                                                                                                                                                                      SHA-256:2CE78101F44D51D9F3B592C3D6EB552611CC6041DBC8286035605B55F4E9900E
                                                                                                                                                                                                                                      SHA-512:9D15E91631F455C42923481AD253B1BB1DCD6CE299D9219952902BA3C16F4F49D43442BFFAD761EC9223B15BAC973256E765B2C0960246326CFCEB12ED7D8475
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "La recherche s.curis.e est d.sactiv.e. Soyez prudent.",.. SEARCH_TOAST_SUB_HEADING: "La recherche s.curis.e .carte les sites dangereux dans vos r.sultats de recherche. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vous souhaitez garder une longueur d'avance sur les menaces avec une protection de recherche .volu.e.?",.. SEARCH_TOAST_OPTION: "Oui, activer la Recherche s.curis.e apr.s le red.marage du navigateur",.. SEARCH_TOAST_DONE: "Termin."..}..//516BD4B5AC129E10250976C9A0F0102827F64E073FFBF75344EB0EBD6BF27CA8AE954F70D8FB99C1D2FD23809430D20D35A1DF0C7DBC8540F4A7638BDD69CFC6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):642
                                                                                                                                                                                                                                      Entropy (8bit):5.593914365942388
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HA+vZMuIg9s7sdhXNrY+Au1HQu8TPajrk4NQEJRhcLn:7Hb2g2sdrkiQuISrV9JRhyn
                                                                                                                                                                                                                                      MD5:79EA5179B1BF206C9C28C688EB02EDF4
                                                                                                                                                                                                                                      SHA1:7D329D1FFBD1E903DA92820F19F00E002334C17E
                                                                                                                                                                                                                                      SHA-256:5722BCA89FA337FD23C7FAC1CBD0CA9D02218429C9DC5E6D073202B1EDD738CB
                                                                                                                                                                                                                                      SHA-512:F2A6CF812BC77DD2BC93E99FC03AB175EE278C05FADA8C8D2FD786831481801E6FF6F7AC77DD19B229DA3C8BCC0F3702A296D3CE0A17656FEC5F159A11C6AEC9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Isklju.eno je Sigurno pretra.ivanje - budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Sigurno pretra.ivanje dr.at .e opasne stranice podalje od va.ih rezultata pretra.ivanja. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".elite ostati nekoliko koraka ispred prijetnji s dodatnom za.titom pri pretra.ivanju?",.. SEARCH_TOAST_OPTION: "Da, uklju.i Sigurno pretra.ivanje nakon .to ponovno pokrenem preglednik",.. SEARCH_TOAST_DONE: "Gotovo"..}..//D9D403219281843FC30A2DA16B9DFFBCE468AD168F7E1EC1DB8C06F745C962786956328F7A44832AD703466D0904BA3141BB2A241EE6713CCD9E8573AF52F552++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):703
                                                                                                                                                                                                                                      Entropy (8bit):5.68374178365314
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HeBdauIvxgWeBdiituB7XcdhM2Frd0XR0WMruMYNSIt5d9XUL12UNIxlRKY/0Vy:7HeBdauK0Bd5olXcdyiry1MSFNSEd6Ls
                                                                                                                                                                                                                                      MD5:5057414FE921CA76EF4EB5E62CD9EBC9
                                                                                                                                                                                                                                      SHA1:8E87958FCFC8A97008E24E7C2550707A12B294CA
                                                                                                                                                                                                                                      SHA-256:5DA826F49AA1C5B202F9E932744FB5642980300AADE8D5E315214B66396438F6
                                                                                                                                                                                                                                      SHA-512:FCC4F62DE543A240586FECC2C81337A111723D392CDDBDB6418F940D005E957CA69954FF70C2C0121B6C867C363B3E2F181F3E3BABC799B7E593A96530E83875
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A biztons.gos keres.s ki van kapcsolva. Legyen .vatos!",.. SEARCH_TOAST_SUB_HEADING: "A biztons.gos keres.s funkci.val elker.lheti a keres.si eredm.nyek k.z.tt tal.lhat. vesz.lyes webhelyeket. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Szeretne egy l.p.ssel a fenyeget.sek el.tt j.rni az extra keres.si v.delemnek k.sz.nhet.en?",.. SEARCH_TOAST_OPTION: "Igen, legyen bekapcsolva a biztons.gos keres.s funkci., miut.n .jraind.tottam a b.ng.sz.t",.. SEARCH_TOAST_DONE: "K.sz"..}..//29BCD2AFD84C1C4AF73613FFEC98A0EAA945960DF823E96D682063A657029F9063CADB3F1E0F8600F497EDC512E3F4B83AC642282679B9563E20859BE5720B26++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):591
                                                                                                                                                                                                                                      Entropy (8bit):5.434255161423558
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HtDdilrtAfzdhDK1+aYfHEDTXvrcN6LV:7Hx9fzdFWnY/EDbvrz
                                                                                                                                                                                                                                      MD5:241ACD32EBCA5FB2C32C222D44262930
                                                                                                                                                                                                                                      SHA1:6728BA15E9444727EA9C63E178D835BB310DFAB3
                                                                                                                                                                                                                                      SHA-256:BA9BE655118F7E05631E64012656EB5314EFB61B475DCEEF618A77BD74045040
                                                                                                                                                                                                                                      SHA-512:D3D90552B2D66CAF37B2C5AE45DC49E0C1ECCA2A6A80BBB6B85AF2BA7ED28E74EF83AB5C317870E6CE5D49AC20BA619C620C487C3F65DF959B3C155C630F7B4F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Attenzione: la funzionalit. di ricerca sicura non . attiva",.. SEARCH_TOAST_SUB_HEADING: "La ricerca sicura ti indica i siti rischiosi nei risultati della ricerca. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vuoi tenere alla larga le minacce con una maggiore protezione delle ricerche?",.. SEARCH_TOAST_OPTION: "S., attiva la ricerca sicura al riavvio del browser",.. SEARCH_TOAST_DONE: "Fine"..}..//DEE24319C0373221CDBD58133C70A9D341D604D3C2F51B75E309F544D274CE8992DDFBC446D0EB90A7FB7AF64CC9F115F6B0AF085B2823274E27A43E15412547++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):640
                                                                                                                                                                                                                                      Entropy (8bit):5.962211633536616
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HUWisRqhWYcXYDkNWdhx8HWER9QilSh5RWmxISFvJgMXS0kF0Pcszv:7HUTOqvngUdcHbLZIrDgqS0kF9sL
                                                                                                                                                                                                                                      MD5:88E4C5F2AC4B81F9A1BA4972235B64A6
                                                                                                                                                                                                                                      SHA1:A441514B824D34C0F6641313678735548FAC7796
                                                                                                                                                                                                                                      SHA-256:244203EEC590679F14263D8542205459EB98BF2BE9596DBE69EBF7BD6834758A
                                                                                                                                                                                                                                      SHA-512:781D64B045D054C06D36327BF69E53A60949E3A58C74835D6F6B264B4811D6B0BCCC39F09A4FFAE4B2708926793DF47F22765776429EF8E68EC445A83AE1E5B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".... .................",.. SEARCH_TOAST_SUB_HEADING: ".... ........................ {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".........................",.. SEARCH_TOAST_OPTION: ".................. ..........",.. SEARCH_TOAST_DONE: ".."..}..//37BF8D2C584F42A060A901163646A6210E77B5FCDF8CF714001FA711D508A9567A63B2BA34E1FC66915A122403791F078C9169EBBCCC2D072107FAF0AD8D31D4++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):610
                                                                                                                                                                                                                                      Entropy (8bit):5.965176695364184
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HRgq8EDFj2FcdhkbQ2sIm8kATYld1nI6FhcD7:7HvhEcd2BsIm8kgYl3y7
                                                                                                                                                                                                                                      MD5:D01CACFA69D8812BE6A84832E2349DDE
                                                                                                                                                                                                                                      SHA1:E51D2C811F58AA8351A64437C11DCC59E235F4EF
                                                                                                                                                                                                                                      SHA-256:DCF325CC9F893E9E5400AAB4339223053C21BCEE6B381E069F9BACD8FD29C579
                                                                                                                                                                                                                                      SHA-512:2D625B33E4E14B61CD650236F6059E0E15EEC7EBC07420C211BE72D1791E4D846F46150EC869F181380C4F7A214B9EFCDD3F6550D9F6708C00FE70078AACE96C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".. .. ... - ......",.. SEARCH_TOAST_SUB_HEADING: ".. ... .. .. . ... .... ...... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".. .. .. ... .... ... ........?",.. SEARCH_TOAST_OPTION: ".. . ..... .. ... . .. ... .......",.. SEARCH_TOAST_DONE: ".."..}..//91D0735DBE34B5D505CC113D94080AC909EBCA04EE956BE8658E9AE36CCB985F79F661A8790F35579EE88758844E5E33EB7BBB672347784F28F7ED081948B4B0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):571
                                                                                                                                                                                                                                      Entropy (8bit):5.5870372686736784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H0QhMHQjBUW4J9wdhPtkwxWsNWFcuVk65IWhmYBh:7HfhMwjIwdhywQsIueWWP
                                                                                                                                                                                                                                      MD5:67073A8EFECCD6213993B28320FFAAFD
                                                                                                                                                                                                                                      SHA1:403F431949DB988C38194D5941FEA07B8567D142
                                                                                                                                                                                                                                      SHA-256:DB04E2CC78803888C6AD0002B39907BA15D1C07D6092AEB938254578D2656E09
                                                                                                                                                                                                                                      SHA-512:7B5D8C480DB8D7608BEAAAA1518CB83E5AE12A4165D650EF7D13DC015BC42F0AD1539D269B7206418409C6B0C80948FF63EE2AD9304763C54FDAD24824CC535A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Sikkert s.k er sl.tt av . v.r forsiktig",.. SEARCH_TOAST_SUB_HEADING: "Sikkert s.k holder deg unna risikable omr.der i s.keresultatene. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vil du ha et forsprang p. trusler med ekstra s.kebeskyttelse?",.. SEARCH_TOAST_OPTION: "Ja, sl. p. Sikkert s.k n.r jeg starter nettleseren p. nytt",.. SEARCH_TOAST_DONE: "Fullf.rt"..}..//3E4EAF8FC11DFBA3641C0FA9CB584B9ABAF10149BBA42C8C8A60CA74627667949F8AB9B7E889E7DC707404643056D18FC392D5C2C03F8E212563EDF57301053F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):602
                                                                                                                                                                                                                                      Entropy (8bit):5.541846254739291
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H7AySxXeOzOqodhIMLfcPkQkfM7uYCdVHc+Zh:7HzSxOBqodrLfccQk3T97
                                                                                                                                                                                                                                      MD5:3C9820421B82620071FB3CDFE30505E5
                                                                                                                                                                                                                                      SHA1:765AF27568930D7F7F09DCA9076E3C54ACE75F4F
                                                                                                                                                                                                                                      SHA-256:7F775E1CA617C707D46B1858E1BE17E99A14B709E1FDD3733670DE119E46FAAF
                                                                                                                                                                                                                                      SHA-512:5BC0CEF5BBD619B30D077F9AE70FDF17C5E14497CC949DCAF8B5BAE3FD7F595BA33AD2B8DE6C44CEBF2F7283AB61E27A17E66470D1777F4CDB8B62D5A840E8A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Beveiligd zoeken is uitgeschakeld. Wees voorzichtig.",.. SEARCH_TOAST_SUB_HEADING: "Met Beveiligd zoeken kunt u de riskante sites in uw zoekresultaten vermijden. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Wilt u bedreigingen een stap voor blijven met extra zoekbeveiliging?",.. SEARCH_TOAST_OPTION: "Ja, schakel Beveiligd zoeken in nadat ik mijn browser opnieuw heb gestart.",.. SEARCH_TOAST_DONE: "Gereed"..}..//73B4CE963DCFE8813F8F8160D6C3C696B77FD353318A44C1FF361BA8F55ED191A421CDB7FD305235E5F7746457B591A99D790FB7785D1C5BE6FDB154494242FC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):650
                                                                                                                                                                                                                                      Entropy (8bit):5.699709818428589
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HRmi53Lw8i53LE6PU3LOdhc1FKb3LCoPY3LcBKHlX7Q/sDUo:7HRZFuFIfSdi+jeoPMiKl7PDUo
                                                                                                                                                                                                                                      MD5:F3B1323CEF751CC9AC1612F56CE5BAF4
                                                                                                                                                                                                                                      SHA1:815CFCA234FBF0C9198222823C7E2D67233C0C98
                                                                                                                                                                                                                                      SHA-256:44A091FEFECE68CE977A6517362023B9B766985A5C603A82EE1E59A09322F2B3
                                                                                                                                                                                                                                      SHA-512:0CCD4297A06A20D3BF61B5EC8AB6D1F6EF5D838409157698A7543579FAE8A246BCB425A9EC078115C68AB8833EB0C6B06439B9350B47F5494B7F7C43A884D38C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Uwaga! Funkcja bezpiecznego wyszukiwania jest wy..czona.",.. SEARCH_TOAST_SUB_HEADING: "Funkcja bezpiecznego wyszukiwania eliminuje niebezpieczne witryny sieci Web z wynik.w wyszukiwania. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Czy chcesz uprzedzi. zagro.enia dzi.ki dodatkowej ochronie wyszukiwania?",.. SEARCH_TOAST_OPTION: "Tak, w..cz funkcj. bezpiecznego wyszukiwania po ponownym uruchomieniu przegl.darki",.. SEARCH_TOAST_DONE: "Gotowe"..}..//FCE4872A0520D857A66EF284AD996C3335D4E3E3736FBE42FDE5A7CFEDF300791B8951DA0490AC44057F9D224591880BED38319CB87E72CD009B8F2886657650++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):572
                                                                                                                                                                                                                                      Entropy (8bit):5.505573473763304
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HcwalVTVGGWF/CdhEVMBoPcw7pVl9jeH8R1rwO/O7b7:7Hu6F/CdGVMBoPcwXlEHmO7
                                                                                                                                                                                                                                      MD5:544B8EB0964C8CDE2311E3D40E686498
                                                                                                                                                                                                                                      SHA1:AE2D5E0340EF2D20B46F01B3997561812187182B
                                                                                                                                                                                                                                      SHA-256:71BEA31C9CBB7AD986985ABB6B4D6EFAA744AD3C22A5F8B8288D070DF6FC3899
                                                                                                                                                                                                                                      SHA-512:64C908CBB452E0014E9959A206658E3AC8F86E07871295D03BFF6F1099244C245239AAA28A053A750033F15A87AAF7C465A17C79608D17911A32EF91EC2BBA39
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa segura est. desativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura evita os sites perigosos nos resultados da pesquisa. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Quer ficar longe das amea.as com prote..o extra?",.. SEARCH_TOAST_OPTION: "Sim, ative a Pesquisa segura depois que o navegador for reiniciado",.. SEARCH_TOAST_DONE: "Conclu.do"..}..//F0A5CFE1FDCCBF42FC6EAF6766B0245CA981E66585F6B5212F734AAEF6B44D30FD46CD0F120CB6A6BD1DC0F194361D86B52D6F46BD624309E893917BAA8E5F98++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):597
                                                                                                                                                                                                                                      Entropy (8bit):5.524112025161231
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HcQyVTuEcc3WhZ2dhvGUO9N7tOsK7HYcBY95SdgO:7HNlhZ2dRGUcNgsem9c
                                                                                                                                                                                                                                      MD5:70E66ED81B3A49579BB6524AF29DF388
                                                                                                                                                                                                                                      SHA1:31BD2D117E3BAE612ED22660560B2554A9BFD483
                                                                                                                                                                                                                                      SHA-256:2AB20DF77D88EDF8873F08B2AB8DC1C7862E7C6C973AEC95EFF387C37A5C87C9
                                                                                                                                                                                                                                      SHA-512:E390BCC0674B04AB6B29F69B2C57FC71CD14BA14C14B5007464F43C2985B522EC28AFC3E9DC0EADACB72168FC395A16B7BEA2A928D415A81C73D1E03FBE9527E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "A Pesquisa Segura est. desativada . tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A Pesquisa segura ajuda-o a evitar sites perigosos nos seus resultados de pesquisa. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Pretende evitar as amea.as com a prote..o de pesquisa adicional?",.. SEARCH_TOAST_OPTION: "Sim, ativar a Pesquisa segura ap.s reiniciar o meu browser.",.. SEARCH_TOAST_DONE: "Conclu.do"..}..//4B79284214D96F0A0B700CD7B4365D9ACD439408C7981E72A914DF18766CDBB83247D34F45F6A671F3B87FA087DE6D3D021306390FB09D05DF0D2282EAAD605D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):837
                                                                                                                                                                                                                                      Entropy (8bit):5.256135455579391
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7HYytHN6yt20qJNs2OSo7dL2IlIX2tCFe8ldkbHQO:8yNN6yJqjbOS6LiX2Ao3
                                                                                                                                                                                                                                      MD5:F640410EE13F752431B1664CB527267E
                                                                                                                                                                                                                                      SHA1:A0207FDC496DE7F381224EB8A4BD4727AED79D06
                                                                                                                                                                                                                                      SHA-256:97D7869662531059A0E2929C1B2E6E632768877EB1A8AC500E771A173C73F9B2
                                                                                                                                                                                                                                      SHA-512:E86509488471E243CA0E237CDAD6A095A20F06C77246AEC0C146AFE6F1052F12EB7A6AAD7C34E197CFFC31A4752F7518A94F24086DC12082431A99BE0097CA2C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: ".......... ..... ......... ...... .........!",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... ....... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "...... .......... .. ..... ... ...... .............. ...... ......?",.. SEARCH_TOAST_OPTION: ".., ........ .......... ..... ..... ........... .........",.. SEARCH_TOAST_DONE: "......"..}..//83B3C5BC2262D64F46571BED5C8A4A5340F667E4C84A1CB497BD070126E2371E7AC463FF58B39A2D0D4BEB6DC45DD7AFFECE3656F53D08F33C42E5311A6D03BA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):649
                                                                                                                                                                                                                                      Entropy (8bit):5.788608929090397
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qsXHYKsW+xQpRqWCEj8FBh4QpRqn3XmX4L6dFEhKcUdExJwshb7MolxFhRqqo/Th:7HLxCHLIOdhcUdOVzpG4D4udtKAC
                                                                                                                                                                                                                                      MD5:5599810773C468B748818425281F1035
                                                                                                                                                                                                                                      SHA1:5A44F5D56368A23166DDB9EFE68102FF117A8A9B
                                                                                                                                                                                                                                      SHA-256:FA2CF089A16C57C84B787B0040F85E6EE78BAEDC71D4CD6733852A2A4EE48B31
                                                                                                                                                                                                                                      SHA-512:6ECD2A72C0D14C56B8AD81DFAF6A182D4432FA23CC919EDF78B0BCCECE955746B3FA2526F036D1F424FD056636F1F0B0D89C2467E2C11F0760B9FA166B567CB3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Zabezpe.en. vyh.ad.vanie je vypnut. . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Chcete ma. n.skok pred .to.n.kmi v.aka zv..enej ochrane pri vyh.ad.van.?",.. SEARCH_TOAST_OPTION: ".no, zabezpe.en. vyh.ad.vanie zapn.. po re.tarte prehliada.a.",.. SEARCH_TOAST_DONE: "Hotovo"..}..//11AA66BAF3061528B0AFAEBF9B24D1C501B1CCEBDFD3ECA6AFB5038649C688CFD12314E570443924C7C07E87232F47EC0666954BBDA25B47E4901864D60FD752++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):605
                                                                                                                                                                                                                                      Entropy (8bit):5.608873514799169
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H3ORkfi2TAdhX3UbQytlQuhUHFK+WcK39fetJJVJDn:7H38kfwdqvQuhUHFjzKletJJVpn
                                                                                                                                                                                                                                      MD5:2CE5A3062767C77D2D348627C1D13AAA
                                                                                                                                                                                                                                      SHA1:386CDC1C0CE6B2BDF1B061C47AA8459421235206
                                                                                                                                                                                                                                      SHA-256:651CA7721D2EC7A60C4C5E06932D7E5F40A32FB1F323F5C4C1211BE1AA9719BB
                                                                                                                                                                                                                                      SHA-512:790D63A7483C82A8B6CC87CCDCA38175F0CC25C974DA6B66B1521C3A1BFD4EDF556CBD9FA52504870F9F31531987181D6F816F16587FFBF4D87E3D390ABBF7FE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "Bezbedna pretraga je isklju.ena . budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".elite da budete u prednosti u odnosu na pretnje uz dodatnu za.titu pretrage?",.. SEARCH_TOAST_OPTION: "Da, uklju.i bezbednu pretragu nakon .to ponovo pokrenem pregleda.",.. SEARCH_TOAST_DONE: "Gotovo"..}..//528CE8DF8FE585A78D872B63B14496966735EB3D27297DE5DF4E1814AF419CC8F27AC096B3E540FBD3BBEC68CAD09F94774574EA6C66B4A90B0EB351B9BBA24B++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):574
                                                                                                                                                                                                                                      Entropy (8bit):5.6373291170642
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7Hmg2AbjgZyDzL0HD4WkdhPN4McUQ4N94ijuwh7psgBe:7H7DbEgLLdVWMHN94iSwH4
                                                                                                                                                                                                                                      MD5:F6DE37A19AF51E7EBFEF0258331BA90B
                                                                                                                                                                                                                                      SHA1:C03A4FE2EF02901502C58F19788D88EDD79853DF
                                                                                                                                                                                                                                      SHA-256:883A3CE1FF1F8C2C83C7ED207BD5476B54B3294A7CF3BB120E337235CB694259
                                                                                                                                                                                                                                      SHA-512:302B8E3B64E4BAF6CEB828E1B340D26F9CE4C318898125173E577B5145985772E1270E969C4919A831517D70CD6752666F84F2B867FAD9DDB5D963CB1C5C333F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "S.ker s.kning .r avst.ngd . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Vill du vara steget f.re hoten med extra s.kskydd?",.. SEARCH_TOAST_OPTION: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. SEARCH_TOAST_DONE: "Klart"..}..//0EC68A40885D893BA8B9CAA16E6DEED9016A4CFF177C4A2F12608B38E39EA6A24815C016C8D0281F5A69B0D42395368E93AC8FA7988D72BCAE1B55102F87CC33++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):589
                                                                                                                                                                                                                                      Entropy (8bit):5.590810495279371
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7H0i4Hb00hCdh29T1pGQMlwrX96UO1Pbbyhn3XxAX:7Hl4phCdA6VlwL4KhnHy
                                                                                                                                                                                                                                      MD5:C96531A46F3EFBF2DD70AE3168BCEEE2
                                                                                                                                                                                                                                      SHA1:427B051309219DC3B8B6D130D47EE39EB81D8BC0
                                                                                                                                                                                                                                      SHA-256:8FF9DABC46E25B7E84F5C2B07BA3C7D025FBC1C91A0D11ACDA07E1042B38086C
                                                                                                                                                                                                                                      SHA-512:EC3D16C30B8145B82028DE64B7F62FDCC1BD21828605A073F3D1E5F692761C86AE4C343FE5AB65E68A7EC2DDB9DC09CDE2A40B0DF53875C6C8C130898475A521
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "G.venli Arama kapal., dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar. {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "Ek arama korumas. ile tehditlerin bir ad.m .n.nde olmak ister misiniz?",.. SEARCH_TOAST_OPTION: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. SEARCH_TOAST_DONE: "Bitti"..}..//710A45A69B53D5EA92BFC4095BDDAEFE55EF4FF07F12F9409429AA764B49677BB08C05A904F115CF4FC4FDCF7275A92ACBA2F9829AA7C7E79A29327E261A2D59++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):547
                                                                                                                                                                                                                                      Entropy (8bit):6.247258292633417
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:qsXHYKsW+xGROGh4GytHRf8TCqdFEhKlYFlDvXUjujBPxZf8E4A+OYyMeR461y/Z:7HshRETCqdh2fDviKYE4aCeek4Gbty
                                                                                                                                                                                                                                      MD5:DBF1E9E8C9B115DF002042F7DADC68D0
                                                                                                                                                                                                                                      SHA1:1E06EBEAD3C21C55AE994BFCC68FC7FDCE2D4937
                                                                                                                                                                                                                                      SHA-256:8DC40749FE83D57AAC6070CC1F2C32FAD4598611AE7AE3EC16E5259A9426A51F
                                                                                                                                                                                                                                      SHA-512:E0B67E07196CF4C74972F7ED9BEC7C39589BE2E53F7ED2B191649E59DB72DFD38DBC9FFE66F6A26A217054A6ABB05F56354531D28CFC180C69CA2CC2AF2AAD45
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "....... . .....",.. SEARCH_TOAST_SUB_HEADING: "...................... {0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: ".....................?",.. SEARCH_TOAST_OPTION: "...............",.. SEARCH_TOAST_DONE: ".."..}..//377491152D66FA2E8085C36E988BFF23000A92309A77E53B3237EAD3410949D2F85CBB4AF1B0D23870D4A6F4D49CED6DFDD9DD717FC738966A1BA0F99F212E51++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):555
                                                                                                                                                                                                                                      Entropy (8bit):6.202683084096371
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7HamgrADLhZINcBjdhVfDaCBasqeDIYegGJU37AOn:7Ha/cDtZINSdfrtarph9Jgfn
                                                                                                                                                                                                                                      MD5:CD0DAF9C2BED02F198156BC7EDAFEA9B
                                                                                                                                                                                                                                      SHA1:289CBB17043BE458B9B6F8AA056B2FC308C90C98
                                                                                                                                                                                                                                      SHA-256:61F5768F0BFCA0A1BC259435887A72FC38785FDDACADA3FBD8967368A67D66F6
                                                                                                                                                                                                                                      SHA-512:7EEBDA9B232FBDC1CE0A95DDD368C3B72CA34A1EF8F72F8423FB40982A7801023AF67F836EB375F4A10738A9C900F279A7C001B00C9C7BC82A070996AFEBA520
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_HEADING: "....... - ...",.. SEARCH_TOAST_SUB_HEADING: "........................{0}",.. SEARCH_TOAST_SUB_HEADING_STRONG: "......................",.. SEARCH_TOAST_OPTION: "..................",.. SEARCH_TOAST_DONE: ".."..}..//AFB2C9E696A01ABEAFDC8E47DC7E50A68F057FEE7FF81523E729D0E5E8DABFBA1067CD7F92BF9805BF8CF3B9B18162673071925C926854BE5DC3FF542F34F1AF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6977
                                                                                                                                                                                                                                      Entropy (8bit):5.355473539171613
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CGsKDNR4J7qXQBLHEtvJd89CuvJd29Fx7sXYld4+D8:CoDNR4x+tvJd89CuvJdMDwXcd4+o
                                                                                                                                                                                                                                      MD5:2C8D8E0A2BD3DBF4F925EA88AB200A04
                                                                                                                                                                                                                                      SHA1:81F2B33370B5FB7046C3938FE697DA7F83668892
                                                                                                                                                                                                                                      SHA-256:72738F2579C5609FA9CE1E65F56F25BAD1A7B357C711B7AC6A93838909E013D5
                                                                                                                                                                                                                                      SHA-512:E449A08EB0B5DB3A4FB63E62A84E53A35A4C39457D836A8A61B8CC9E5D6680E732B4F51D79D5B6934537280E0CFD798F4344EB827A393341453A0437476B9350
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A pesquisa segura est. desativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A pesquisa segura evita os sites perigosos nos resultados da pesquisa.",.. SEARCH_TOAST_BODY_TEXT: "Quer ficar longe de pessoas mal-intencionadas com prote..o de pesquisa extra?",.. SEARCH_TOAST_OPTION: "Sim, ative a pesquisa segura depois que o navegador for reiniciado.",.. SEARCH_TOAST_DONE: "Conclu.do",.. SEARCH_TOAST_HEADING_COMPLIANT: "A pesquisa segura n.o est. ativada - tenha cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A pesquisa segura evita os sites perigosos nos resultados da pesquisa.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Gostaria de adicionar a pesquisa segura e se antecipar aos criminosos?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Sim, adicionar a pesquisa segura ao meu navegador e alterar minha pesquisa padr.o para {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7070
                                                                                                                                                                                                                                      Entropy (8bit):5.3546832312019825
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Chka9ILBeycgfmtmud0l9zEYmud0lkVHed0g57a:ChknLBeycgmtm5PmqHypa
                                                                                                                                                                                                                                      MD5:3799F87E6578237EDCDF45194F4D48F0
                                                                                                                                                                                                                                      SHA1:B53F995469C2786B1C644A371892BC7C97E5DBCE
                                                                                                                                                                                                                                      SHA-256:E505629055F5E629815D74D0EA83E14AC929729EC8C0DAB2C471BD683228F311
                                                                                                                                                                                                                                      SHA-512:DC3C40552609333503322F7F6A1DC13AC6B83D796295A7EE25572EB61B2045F528FB3314EFF4AEB25CB10E1132196677DE1CB0C8DF8962677B9096251D7B4B5D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "A pesquisa segura est. desativada . tenha cuidado",.. SEARCH_TOAST_SUB_HEADING: "A pesquisa segura ajuda-o a evitar os sites perigosos nos seus resultados de pesquisa.",.. SEARCH_TOAST_BODY_TEXT: "Pretende evitar os utilizadores mal intencionados com a prote..o de pesquisa adicional?",.. SEARCH_TOAST_OPTION: "Sim, ativar a pesquisa segura ap.s reiniciar o meu browser.",.. SEARCH_TOAST_DONE: "Conclu.do",.. SEARCH_TOAST_HEADING_COMPLIANT: "N.o tem a pesquisa segura, tenha cuidado",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "A pesquisa segura ajuda-o a evitar os sites perigosos nos seus resultados de pesquisa.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Pretende adicionar a pesquisa segura e antecipar-se aos malfeitores?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Sim, adicionar a pesquisa segura ao meu browser e alterar a minha pesquisa predefinida para {0}.", // {0} SEARCH_TOAST_*.. SEARC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (309), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10279
                                                                                                                                                                                                                                      Entropy (8bit):5.115638334969623
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CDxFR6OsBNVZPV/y/Vm1R1ut52Gu5U0DLTDGgo1:CDxFR9I1yI1R1utQGuV5o1
                                                                                                                                                                                                                                      MD5:C3A1D7364DB103286EAA667D64043321
                                                                                                                                                                                                                                      SHA1:C71D794471FE9AE4ABCBB4677B02CF3618EAE827
                                                                                                                                                                                                                                      SHA-256:6EA11AB0A7A1A113C95B8945F73BCF08A83CC9C5E9CBDFED667A65A47EE09B7B
                                                                                                                                                                                                                                      SHA-512:E3BECABD49C9DD33F0E6B3FE15C4792389F1A2256AE29BEE3420A42B388281F2F97814FC1BE185DBE55455363763AF367BFE0C57840D00C12E4F4167EBDF50DD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: ".......... ..... ......... ...... .........!",.. SEARCH_TOAST_SUB_HEADING: ".......... ..... .. ........ ... ........ .............. ....., .............. . ........... .......",.. SEARCH_TOAST_BODY_TEXT: "...... .......... .. ............... ... ...... .............. ...... ......?",.. SEARCH_TOAST_OPTION: ".., ........ .......... ..... ..... ........... .........",.. SEARCH_TOAST_DONE: "......",.. SEARCH_TOAST_HEADING_COMPLIANT: "...... ........., .. ... .. ........... .......... .....",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".......... ..... .. ........ ... ..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7406
                                                                                                                                                                                                                                      Entropy (8bit):5.693566077605284
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CgGE6x3pVIczmqoU5t9gga9BC9ge4rShIAl:CgGE6vH6XU5t9gga9BC9grSOAl
                                                                                                                                                                                                                                      MD5:ECFEDBBFC175AD6928A61BC6128D21A0
                                                                                                                                                                                                                                      SHA1:D0FC6146F6362CB2089CDB53E67AC04AEEC13BF7
                                                                                                                                                                                                                                      SHA-256:066A025379A56CDAF9F81641FFCE21744F71C869F6BDBF81C29A1F30A31AC4E0
                                                                                                                                                                                                                                      SHA-512:800C3931FCDDDFDE3E1205B68EE3FA68978231C45085EDD7528294AABAA222709D3EFD55C79657D4A6684772C2D098226B8C9B76F54866952874AEDA85597544
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Zabezpe.en. vyh.ad.vanie je vypnut. . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT: "Chcete ma. n.skok pred .to.n.kmi v.aka dodato.nej ochrane pri vyh.ad.van.?",.. SEARCH_TOAST_OPTION: ".no, po re.tartovan. prehliada.a zapn.. slu.bu Zabezpe.en. vyh.ad.vanie.",.. SEARCH_TOAST_DONE: "Hotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nem.te zabezpe.en. vyh.ad.vanie . d.vajte si pozor",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Zabezpe.en. vyh.ad.vanie v.s chr.ni pred nebezpe.n.mi lokalitami vo v.sledkoch vyh.ad.vania.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Chcete prida. zabezpe.en. vyh.ad.vanie a.zachova. si ochranu pred mo.n.mi .to.n.kmi?",.. SEARCH_TOAST_OPTION_COMPLIANT: ".no, prida. zabezpe.en.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6881
                                                                                                                                                                                                                                      Entropy (8bit):5.502169090828175
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CDvPQbt+oOuDdY9XXHci4ERt9UFE+fa9f+i9UFED9FV77GewuWZv96dJ:Cj8at9UF89/9UF+TWZv96dJ
                                                                                                                                                                                                                                      MD5:37C1F0B440FC11ED5EA071C3FBA34DC0
                                                                                                                                                                                                                                      SHA1:980DA9DE7E869C2F551B74697D1434558A99F086
                                                                                                                                                                                                                                      SHA-256:22FE14EF03BE0E5DCCCDF1E67DF49F7372714F851CE2282D8D47EA524A35CD0C
                                                                                                                                                                                                                                      SHA-512:BE7AA46B16A4F80D26A56AA141656610B0352A8B422646DB36E4CB466A3D5C3F478E55D2587ABDE9F44945F6C44F5EEC79A4296AE249CE64988B05F778230011
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "Bezbedna pretraga je isklju.ena . budite pa.ljivi",.. SEARCH_TOAST_SUB_HEADING: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT: ".elite da budete u prednosti u odnosu na .lo.e momke. uz dodatnu za.titu za pretragu?",.. SEARCH_TOAST_OPTION: "Da, uklju.i bezbednu pretragu nakon .to ponovo pokrenem pregleda..",.. SEARCH_TOAST_DONE: "Gotovo",.. SEARCH_TOAST_HEADING_COMPLIANT: "Nemate bezbedna pretraga - budite oprezni",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "Bezbedna pretraga vas .titi od rizi.nih lokacija u rezultatima pretrage.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".elite li dodati bezbedna pretraga i ostanite napred?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Da, dodajte bezbedna pretraga u moj pregleda. i promenite podrazumevanu pretragu na {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_ENG

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6625
                                                                                                                                                                                                                                      Entropy (8bit):5.491069853271239
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CPWmMbkZdHSzoz9jp2rqntY25Sfs99FGlTuBLz704oH30wB5:CwbkOEtJ5SfsTzpEkwT
                                                                                                                                                                                                                                      MD5:AC5D8D4C096CC2C55EB43729EC5EAF40
                                                                                                                                                                                                                                      SHA1:46E13BA4EC2CE9F4DE54642ABB10ACB7E8EF52B6
                                                                                                                                                                                                                                      SHA-256:A470660DC66B8CBDD79A9692CCA284F6AFD645D84D4C24092ABBBD48C2DD4436
                                                                                                                                                                                                                                      SHA-512:AB41E103B1AFFF5707EE310993B5D73DD0D7066086EAD16CBCF80DBF4E858FE2E90661E00C8A4AD60CC4A3AB1BD9963E32B82E4CA71BEEEAC64ACB1601582412
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "S.ker s.kning .r avst.ngd . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT: "Vill du vara steget f.re skurkarna med extra s.kskydd?",.. SEARCH_TOAST_OPTION: "Ja, aktivera s.ker s.kning n.r jag har startat om webbl.saren.",.. SEARCH_TOAST_DONE: "Klart",.. SEARCH_TOAST_HEADING_COMPLIANT: "Du har inte s.ker s.kning . var f.rsiktig",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "S.ker s.kning h.ller dig borta fr.n riskabla webbplatser i s.kresultaten.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "Vill du l.gga till s.ker s.kning f.r att h.lla dig steget f.re skurkarna?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Ja, l.gg till s.ker s.kning till webbl.saren och .ndra standards.kningen till {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHO

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6975
                                                                                                                                                                                                                                      Entropy (8bit):5.54317325600138
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CcHgbQsEEkAWex0JFMRhtSgyLyowlSgB9FerI7ur22yp98O:Ci6hMJF6t1yLyt13wrnr9yp9T
                                                                                                                                                                                                                                      MD5:8A2287D767C2C6AE29ECE303C9EE8F35
                                                                                                                                                                                                                                      SHA1:CB91D9C13AD951DA57D8853F93D8F7D3A0E606C9
                                                                                                                                                                                                                                      SHA-256:6547D54422C7DE48BEDAA9383CE4A7A44A9EAE7345915D3E6632B499707F2397
                                                                                                                                                                                                                                      SHA-512:0DB372A4CA3B597611916AA0573CE94E5E0D60A37F9F313E46E2A2BEA62C5B434AD07242D0CBB84C3D33FF4ADB83D26879435AEDFB099BFFDDD1DF788AA7956D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "G.venli Arama kapal., dikkatli olun",.. SEARCH_TOAST_SUB_HEADING: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT: "Ek arama korumas. ile k.t. adamlar.n bir ad.m .n.nde olmak ister misiniz?",.. SEARCH_TOAST_OPTION: "Evet, taray.c.m. yeniden ba.latt.ktan sonra G.venli Arama'y. a..",.. SEARCH_TOAST_DONE: "Bitti",.. SEARCH_TOAST_HEADING_COMPLIANT: "G.venli Arama'ya sahip de.ilsiniz, dikkatli olun",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "G.venli Arama, sizi arama sonu.lar.n.zdaki riskli sitelerden uzak tutar.",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: "G.venli Arama'y. ekleyerek k.t. niyetli ki.ilerden uzak durmak ister misiniz?",.. SEARCH_TOAST_OPTION_COMPLIANT: "Evet, G.venli Arama'y. taray.c.ma ekle ve varsay.lan aramam. {0} olarak de.i.tir.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6330
                                                                                                                                                                                                                                      Entropy (8bit):6.345212495729186
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CUk5RhhRDj8mxeX+lE8D9VkbXtK6XKS9FgXap7B0Cc:Ch/LxeXqEsGtBX/Dp9Lc
                                                                                                                                                                                                                                      MD5:B1897A07FF9E2C4546026C49BD3C397A
                                                                                                                                                                                                                                      SHA1:92D473F7887B623093F8BD9D5A7D9B92A66A1D44
                                                                                                                                                                                                                                      SHA-256:60A735D27FBEE1CB73F9A9580E4BA24BB47B82DFD64970E716D2AA4FCB69CA52
                                                                                                                                                                                                                                      SHA-512:BFF1A7B19C7643EAFB2CFDFC85DDF35551218EB6720E04CFFDF6066BC567C5EA536E41478C9A703053C88D5AE952DB1069EAB9BEB852EFCDA5258657A59D8FC3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "....",.. SEARCH_TOAST_HEADING: "....... . .....",.. SEARCH_TOAST_SUB_HEADING: ".....................",.. SEARCH_TOAST_BODY_TEXT: ".......................?",.. SEARCH_TOAST_OPTION: "................",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: "......... . .....",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: "......................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".......................?",.. SEARCH_TOAST_OPTION_COMPLIANT: ".......................... {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHOO: "Yahoo",.. SEARCH_user_YANDEX: "Yandex",

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6347
                                                                                                                                                                                                                                      Entropy (8bit):6.339242004140421
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:CGhla0tPlgm6w6KdmnPZ1cSDGFtMDjNOWMDjB9FEKrYimnyn:Ci7dgtOfSStMPNOWMP3wimn4
                                                                                                                                                                                                                                      MD5:639BDE2ACBF136013F017FC0C31375B2
                                                                                                                                                                                                                                      SHA1:D28C5410333C3EAE25DE426041D3FC4B4149C2A6
                                                                                                                                                                                                                                      SHA-256:93C0C80CBEED7F6B6D52F8F564E99C8DE65A5BFD0535AD11274589699C21D347
                                                                                                                                                                                                                                      SHA-512:4E0C005C4CCAB83C542CAA04A09D308E494E527FEBDC2F9BC6EF03856F4DCB16B0FBF7A1D6B1146F2F5EE07615F522194FCC615B5DDB23B4E229563EFBC4CCC1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. SEARCH_TOAST_PRODUCT_NAME: "WebAdvisor",.. SEARCH_TOAST_HEADING: "....... . ...",.. SEARCH_TOAST_SUB_HEADING: ".......................",.. SEARCH_TOAST_BODY_TEXT: "........................",.. SEARCH_TOAST_OPTION: "...................",.. SEARCH_TOAST_DONE: "..",.. SEARCH_TOAST_HEADING_COMPLIANT: "....... . ...",.. SEARCH_TOAST_SUB_HEADING_COMPLIANT: ".......................",.. SEARCH_TOAST_BODY_TEXT_COMPLIANT: ".......................",.. SEARCH_TOAST_OPTION_COMPLIANT: "........................... {0}.", // {0} SEARCH_TOAST_*.. SEARCH_user_BING: "Bing",.. SEARCH_user_YAHOO: "Yahoo",.. SEARCH_user_YANDEX: "Yandex

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2562
                                                                                                                                                                                                                                      Entropy (8bit):5.683532691532839
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UjbcgNu0dSJUGlJ6qfveziXpAlJ2bRQmC3ptQfMmIm42wudadOlOfm92NokzNNiq:UjbcgNurGGlJRemXalKRQmgpt4MmImi5
                                                                                                                                                                                                                                      MD5:C811778F41BC1A6E5F3FC3626E330849
                                                                                                                                                                                                                                      SHA1:610DAFDD9CF8B438F980F34E290EAE38BEADCCF8
                                                                                                                                                                                                                                      SHA-256:96A5FBC4F33477A799CB6A2BBB2226A24D7CA7A5C6256678BD74A8A09AC26F2E
                                                                                                                                                                                                                                      SHA-512:BE1C1D93CA7A9DD664D3EF495670F78D0466897DAFC1798A29378A5A341723D7362C2EB01111DDD685D77BC8D7DA4777E8D2B52C77345EB6529F797BE0CE2B76
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "V odinstalaci nelze pokra.ovat, dokud nebudou zav.ena v.echna okna prohl..e.e.<br/>Kliknut.m na tla..tko OK automaticky zav.ete v.echna okna prohl..e.e. Kliknut.m na tla..tko Zru.it tuto akci zru..te.",.. ADMIN_WARNING: "Aplikaci {0} nebylo mo.n. odinstalovat, proto.e jste k po..ta.i p.ihl..eni jako u.ivatel s omezen.mi opr.vn.n.mi. P.ihlaste se jako spr.vce syst.mu Windows a zkuste to znovu.",.. KEEP_FREE_PROTECTION: "Ponechat funkci Ochrana p.i proch.zen. internetu",.. NO_THANKS_UNINSTALL: "Ne, d.kuji. Chci ji odinstalovat",.. CANCEL: "Zru.it",.. NO_THANKS: "Ne, d.kuji",.. SURE: "Samoz.ejm.",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Odinstalace aplikace {0} prob.hla .sp..n..",.. SURVEY_OFFER: "R.di bychom znali v.. n.zor. Pora.te n.m, jak m..eme tento produkt je.t. vylep.it.",.. SORRY_TO_GO: "Je n.m l.to, .e jste si aplikaci nenechali.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2321
                                                                                                                                                                                                                                      Entropy (8bit):5.409903751827867
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:U9XpCmXa0Roqce7Coh4C3zOur+BYHexiAWFY502OUhMYI5Lp6+ZaKJq4U3nrx:U9XpbXaUz3x+BYWivW0uinhEaq4U3nrx
                                                                                                                                                                                                                                      MD5:8E93E6EC7428855529579E083BE94B01
                                                                                                                                                                                                                                      SHA1:003C37EA5F7CF61D3A471ED4E34AFBB2E874DBA6
                                                                                                                                                                                                                                      SHA-256:8A86B32A531BCB4C135BF803768BBB00E7107C366F80C717280210B6A68D1273
                                                                                                                                                                                                                                      SHA-512:D0AAC48B582FA48E2D30AECA8BE332655697E79E6108902D223FCF18BB3A32D8DBC85EDE02707B8E899F9CE7D7AE137B4B82089D3BE7660C617ADD4B6E5F1ACA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Lukke alle browservinduer for at forts.tte med at afinstallere softwaren.<br/>Tryk p. OK for at lukke alle browservinduer automatisk eller p. Annuller for at afbryde.",.. ADMIN_WARNING: "Du kan ikke afinstallere {0}, da du er logget p. computeren som begr.nset bruger. Log p. som Windows-administrator, og pr.v igen.",.. KEEP_FREE_PROTECTION: "Behold webbeskyttelsen",.. NO_THANKS_UNINSTALL: "Nej tak, afinstaller den bare",.. CANCEL: "Annuller",.. NO_THANKS: "Nej tak",.. SURE: "Selvf.lgelig",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Afinstallationen af {0} er f.rdig.",.. SURVEY_OFFER: "Vi vil gerne h.re din mening. Hvordan kan vi efter din mening g.re dette produkt endnu bedre?",.. SORRY_TO_GO: "Vi er kede af, at du forlader os.",.. UNINSTALLING: "Softwaren afinstalleres ...",.. START_HEADER: "Vent! Vil vil savne dig, hvis du afinstallerer",.. START_SUB_HEADER: "Og du vil ogs. savne all

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2527
                                                                                                                                                                                                                                      Entropy (8bit):5.386167440115135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UYDdXJ6UXJbcC87UQT9zw/eCJlgf0IyYuYL16OhrHAoKKmJvDkojS4WL:UydXTXOs6fIYXLhgokkoTS
                                                                                                                                                                                                                                      MD5:6266AE0BB8A2CB047E272875AA91F7F4
                                                                                                                                                                                                                                      SHA1:44D8F50433351D43760CD9417F7FD5CDEDCBFCC2
                                                                                                                                                                                                                                      SHA-256:9EB26BBDCA33BED77919B7E2F95BF775F8AC00B11240D2E65BA14A91D766B31A
                                                                                                                                                                                                                                      SHA-512:3D7FB365424AC812E861C572728C4632DA450A2126D7BBA48390718722ACF10095B729B941903D22410F8A9892EF7E5C22B4C212A2D09F8BF03022F545E3A2A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Die Deinstallation kann erst fortgesetzt werden, nachdem alle Browser-Fenster geschlossen wurden.<br/>Klicken Sie auf 'OK', um alle Browser-Fenster automatisch zu schlie.en, oder klicken Sie zum Beenden auf 'Abbrechen'.",.. ADMIN_WARNING: "Sie k.nnen {0} nicht deinstallieren, da Sie bei Ihrem Computer als Benutzer mit eingeschr.nkten Rechten angemeldet sind. Melden Sie sich als Windows-Administrator an, und versuchen Sie es erneut.",.. KEEP_FREE_PROTECTION: "Web-Schutz behalten",.. NO_THANKS_UNINSTALL: "Nein danke, bitte deinstallieren",.. CANCEL: "Abbrechen",.. NO_THANKS: "Nein danke",.. SURE: "Sicher",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Die Deinstallation von {0} wurde erfolgreich beendet.",.. SURVEY_OFFER: "Wir freuen uns, von Ihnen zu h.ren. K.nnen Sie uns mitteilen, wie wir dieses Produkt noch verbessern k.nnen?",.. SORRY_TO_GO: "Schade, dass Sie unser Produkt nicht mehr verwenden m.cht

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4045
                                                                                                                                                                                                                                      Entropy (8bit):5.01615803440301
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:U4iYsFeBkg78VLgPHKM6V6WaLq/tit7lO7hm:U4iiam8hgPj6V6W0q/titcg
                                                                                                                                                                                                                                      MD5:242DE46FCB1884AB7CA3F6AE086414CF
                                                                                                                                                                                                                                      SHA1:1D3636596F1C1829F9892366730B84CAEA031E39
                                                                                                                                                                                                                                      SHA-256:EF9477C1A5A078912F3EB0A1B631E455067A43B2EB3C5A28415785051B4D3898
                                                                                                                                                                                                                                      SHA-512:97DEF60FB648A971915A1D3C7C18BD02490E47D7ADCBF3F846E6E0253AB975846BEB26F6AB23018062478EE5C6C4D13DDA84BF25E16110483493D2992E69BA10
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ". ......... ............ ... ...... .. .......... .. ... ........ ... .. ........ ... ............ ...........<br/>....... OK ... .. ........ ........ ... .. ........ ... ............ .......... . ....... ....... ... .........",.. ADMIN_WARNING: "... ........ .. ........... ... ........... ... {0} ..... ..... ........ .... .......... ... .. ....... .. ............ ........... .......... .. ............ ... Windows ... ......... .....",.. KEEP_FREE_PROTECTION: "......... ... .......... Web",.. NO_THANKS_UNINSTALL: "... ........., ..... ..........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2170
                                                                                                                                                                                                                                      Entropy (8bit):5.396287644162781
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UawX1F1LVSHccWK2aFe3ymc9oqTLvmLtwbvORLxe+l:UxXfhQpe3ymco0uLtRLxe+l
                                                                                                                                                                                                                                      MD5:60CBE7972CA5FDE2269AB8A1D3320605
                                                                                                                                                                                                                                      SHA1:D9783A27B61B54C4F05460BCCBE08C1D77122B58
                                                                                                                                                                                                                                      SHA-256:0A32B60573BD5692E306D7ED834F6FB88B6D9307E94C6A51812F2B3E1173BFB7
                                                                                                                                                                                                                                      SHA-512:7A10EB5062CA9A8F2CE9C07916F3F89F14EAC099E21F779603DD974270062AE4C4E221925153603C20D48361D2995F76A0F9594A405F131694B75F37832663DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Uninstallation cannot continue unless all browser windows are closed.<br/>Press Ok to automatically close all browser windows, or Cancel to abort.",.. ADMIN_WARNING: "You can't uninstall {0} because you're logged in to your computer as a Limited User. Please log in as a Windows Administrator, and try again.",.. KEEP_FREE_PROTECTION: "Keep web protection",.. NO_THANKS_UNINSTALL: "No thanks, just uninstall it",.. CANCEL: "Cancel",.. NO_THANKS: "No thanks",.. SURE: "Sure",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "You've successfully uninstalled {0}.",.. SURVEY_OFFER: "We want to hear from you. Can you share your thoughts on how to make this product even better?",.. SORRY_TO_GO: "We're sorry to see you go.",.. UNINSTALLING: "Uninstalling your software now...",.. START_HEADER: "Wait! If you uninstall, we'll miss you",.. START_SUB_HEADER: "And you'll miss all the good we do, like:",.. WE_SCANNED: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2342
                                                                                                                                                                                                                                      Entropy (8bit):5.369323454919437
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Uop2w+XfxK626IEkLmHVR9zgD/1jBv2a82Vj6Aux9M8KBk/PU:UzwqfxnjVgjvv24KxSOPU
                                                                                                                                                                                                                                      MD5:D2DDD271E3AC6C6691D8E15245E7E31E
                                                                                                                                                                                                                                      SHA1:6F201CAF79350EA119B8FBC68BF5D7B9DACBDEFD
                                                                                                                                                                                                                                      SHA-256:AD4BDFFCD7B03B8C8FF588D9CEC85A15545BB443D3E8786CABEECDCC63AE76B7
                                                                                                                                                                                                                                      SHA-512:1BB54430D3641FF008E9EF3735BDE29C5D3D7799CFC3F7172FFB67D4B64864BB2B9D15C6BCE2B9235F15938D2BF0092CC2096F062AB5C3820B2F970E5FDB4AE3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La desinstalaci.n no puede continuar a menos que cierre todas las ventanas del navegador.<br/>Pulse Aceptar para cerrar autom.ticamente todas las ventanas del navegador o Cancelar para anular el proceso.",.. ADMIN_WARNING: "No puede desinstalar {0} porque ha iniciado sesi.n en su equipo como usuario limitado. Inicie sesi.n como administrador de Windows y vuelva a intentarlo.",.. KEEP_FREE_PROTECTION: "Mantener protecci.n web",.. NO_THANKS_UNINSTALL: "No, desinstalar",.. CANCEL: "Cancelar",.. NO_THANKS: "No, gracias",.. SURE: "Claro",.. OK: "Aceptar",.. SUCCESSFULLY_UNINSTALLED: "Ha desinstalado {0} correctamente.",.. SURVEY_OFFER: "Queremos saber su opini.n. .Puede compartir sus ideas sobre c.mo mejorar este producto?",.. SORRY_TO_GO: "Sentimos que deje de utilizar el producto.",.. UNINSTALLING: "Desinstalando el software...",.. START_HEADER: "Espere. Si desinstala, le echaremos de menos",.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2389
                                                                                                                                                                                                                                      Entropy (8bit):5.3888716392690155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Uo72wwXfxjn6v6IEkLX/wrN9gZ0o/0BjBfjTz2VhSZ6c9VTC0Czlu6P:U/wUfxnIwancfjTpVTC0of
                                                                                                                                                                                                                                      MD5:80E56CEE790ABDBBE180B84B049D042D
                                                                                                                                                                                                                                      SHA1:1DFA2C7EDD6536F5003D38B6935792ECA60D7ECD
                                                                                                                                                                                                                                      SHA-256:3D0A676CADB63C44D475AF349CE26197590DC5FBC6FC491DEF56C41B9FB9F404
                                                                                                                                                                                                                                      SHA-512:94B9746ADB0B6FB5DCBDDC492BEE9FFA38EEC8E4E7850BA89E881523450573079EC423CB7DBEDA6490B7842EF66278D7450D4B4D24E72D0C3A3D2A54849405FF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La desinstalaci.n no puede continuar a menos que cierre todas las ventanas del navegador.<br/>Presione Aceptar para cerrar autom.ticamente todas las ventanas del navegador o Cancelar para interrumpir el proceso.",.. ADMIN_WARNING: "No puede desinstalar {0} porque ha iniciado sesi.n en su equipo como usuario limitado. Inicie sesi.n como administrador de Windows y vuelva a intentarlo.",.. KEEP_FREE_PROTECTION: "Conservar protecci.n web",.. NO_THANKS_UNINSTALL: "No, gracias, desinstalarlo",.. CANCEL: "Cancelar",.. NO_THANKS: "No, gracias",.. SURE: "Claro",.. OK: "Aceptar",.. SUCCESSFULLY_UNINSTALLED: "Ha desinstalado {0} correctamente.",.. SURVEY_OFFER: "Queremos saber su opini.n. .Puede compartir sus ideas sobre c.mo mejorar este producto?",.. SORRY_TO_GO: "Sentimos que deje de usar el producto.",.. UNINSTALLING: "Desinstalando el software.",.. START_HEADER: ".Espere! Si desinstala, lo ext

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2389
                                                                                                                                                                                                                                      Entropy (8bit):5.354515194771798
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UrCot/9DbtMfbzwx1kF08hjltMEwTZVyY+vRVZY2f3gvaitItzNG:UrHmMx2BJt8TDmRVzIIBE
                                                                                                                                                                                                                                      MD5:885163DA147E89B22963F15EC3A6E210
                                                                                                                                                                                                                                      SHA1:2697EB9B398423AC78A22ADB2D57A5B4872AD75E
                                                                                                                                                                                                                                      SHA-256:5867DB3FB372EDAE099100BBDA683429B39AF81E96836335B9CA4A526DA3793F
                                                                                                                                                                                                                                      SHA-512:66340E2E62BA3C2CD7E42EF0C7114E3D9553AE3546BD7ABCD5E5051676BF7FE32A86829BABE1BE7D93EC9E0BA03DBE60137A4C728D85F85A3C43E2C7B42215DB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Asennuksen poistamista ei voi jatkaa, jos kaikkia selainikkunoita ei suljeta.<br/>Sulje kaikki selainikkunat automaattisesti valitsemalla OK tai keskeyt. valitsemalla Peruuta.",.. ADMIN_WARNING: "Et pysty poistamaan sovelluksen {0} asennusta, sill. olet kirjautunut tietokoneeseen k.ytt.j.n., jolla on rajoitetut oikeudet. Kirjaudu Windowsin j.rjestelm.nvalvojana ja yrit. uudelleen.",.. KEEP_FREE_PROTECTION: "Jatka verkkosuojauksen k.ytt...",.. NO_THANKS_UNINSTALL: "Ei, kiitos. Poista asennus.",.. CANCEL: "Peruuta",.. NO_THANKS: "Ei kiitos",.. SURE: "OK",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} on poistettu.",.. SURVEY_OFFER: "Kuulisimme mielell.mme sinulta palautetta. Haluatko kertoa meille, miten voisimme tehd. tuotteesta viel. paremman?",.. SORRY_TO_GO: "Ik.v.., ett. et halua jatkaa tuotteen k.ytt...",.. UNINSTALLING: "Poistetaan ohjelmiston asennusta.",.. START_HEADER

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2674
                                                                                                                                                                                                                                      Entropy (8bit):5.367838438204783
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UZbbplCgKbHGou9Uz0NHKVfNV7jUtmjV0fkJmTMOo8MXIHe5QXZhrgKHqeTyGIYO:URbpEhDvVF5jUqckJXBIHe5scqqeTY
                                                                                                                                                                                                                                      MD5:1873034F54B055160694C81F98515CD2
                                                                                                                                                                                                                                      SHA1:CEC8DA300B8CD281C1A1AECD8E3C569554EDAD76
                                                                                                                                                                                                                                      SHA-256:E0F9125FEA9C6A064BE73AFDD7B007F41995EE8B546680AD77352759FA63F324
                                                                                                                                                                                                                                      SHA-512:5BB988CCEFDD479BF105FD52312F5C2054751A8FBE8FB3960429EBF102ACBF5C8127CF26805681CDCD8F700EE41E181832BB2C72E809434228E4C21796DD2FF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "La d.sinstallation ne peut pas se poursuivre sans avoir ferm. toutes les fen.tres du navigateur.<br/>Cliquez sur OK pour fermer automatiquement toutes les fen.tres du navigateur, ou sur Annuler pour abandonner.",.. ADMIN_WARNING: "Vous ne pouvez pas d.sinstaller {0}, car vous .tes connect. en tant qu'utilisateur disposant d'un acc.s restreint. Veuillez vous connecter en tant qu'administrateur Windows, puis essayez de nouveau.",.. KEEP_FREE_PROTECTION: "Garder la protection Web",.. NO_THANKS_UNINSTALL: "Non merci, d.sinstallez-la",.. CANCEL: "Annuler",.. NO_THANKS: "Non merci",.. SURE: "Bien s.r!",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Vous avez correctement d.sinstall. {0}.",.. SURVEY_OFFER: "Nous souhaitons conna.tre votre opinion. Seriez-vous dispos. . nous dire comment nous pourrions am.liorer ce produit?",.. SORRY_TO_GO: "Nous sommes d.sol.s que vous nous quittiez.",.. UNINSTA

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2626
                                                                                                                                                                                                                                      Entropy (8bit):5.397389659181272
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UT3FlNKBwOdm79zoIuKntX3OPwnIeruBTCtnSo8sprasnmNvigS2:UTVfsEtX+iIeq8XUsmNvia
                                                                                                                                                                                                                                      MD5:41F6B2B2D89553D41D2261C522746B3F
                                                                                                                                                                                                                                      SHA1:DCF587D0E1362DFBF7075BE614A9206ADA614024
                                                                                                                                                                                                                                      SHA-256:F0F51CACFF3F7BE9DA222FC0AC8C34FA02692743EDC005AADFF22A7C3E83EA90
                                                                                                                                                                                                                                      SHA-512:DC493E73623136C17C5C8D30FAD6DE9D9172B82727BE16E95DEEB2C5E59411B1CB61285495449DD4397A9CFC938B8C9F5B66202176B840291F3BDC07ACC8E06F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Impossible de poursuivre la d.sinstallation tant que toutes les fen.tres du navigateur ne sont pas ferm.es.<br/>Cliquez sur OK pour fermer automatiquement toutes les fen.tres du navigateur ou sur Annuler pour interrompre l'op.ration.",.. ADMIN_WARNING: "Vous ne pouvez pas d.sinstaller {0}, car vous .tes connect. en tant qu'utilisateur limit. sur votre ordinateur. Connectez-vous en tant qu'administrateur Windows et recommencez.",.. KEEP_FREE_PROTECTION: "Conserver la protection web",.. NO_THANKS_UNINSTALL: "Non merci, proc.der . la d.sinstallation",.. CANCEL: "Annuler",.. NO_THANKS: "Non, merci",.. SURE: "Bien s.r",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Vous avez d.sinstall. {0}.",.. SURVEY_OFFER: "Nous serions ravis de conna.tre votre opinion. Si vous avez des id.es pour am.liorer ce produit, n'h.sitez pas . nous en faire part.",.. SORRY_TO_GO: "Nous sommes d.sol.s de vous voir p

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2390
                                                                                                                                                                                                                                      Entropy (8bit):5.440162012656156
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:U4qRJGbmxWQuD28CEnxSP+vuR4S0OaysKXXFrQeOBCd:UxiRNC83kPEu30uRW6
                                                                                                                                                                                                                                      MD5:955E421B4269274ABC1BB7F4D816E3C1
                                                                                                                                                                                                                                      SHA1:EF4EF86840BF20D917170E3D746107626D37ACE5
                                                                                                                                                                                                                                      SHA-256:F1D6D8C3C6DBBB41E27AF8240807D35DE2E512198A7D189B83C67DCCC0A23F4E
                                                                                                                                                                                                                                      SHA-512:7C73529BE65071265F8BE1CA0F12AE16E88D36330AFD0C277AD656F5016209EEAE98FC222EF0C0DDA2803620D2D761D0CAAB1B6EEFF9C1A2AE2FF10809B1F638
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Deinstalaciju nije mogu.e nastaviti ako svi prozori preglednika nisu zatvoreni.<br/>Kliknite na U redu da biste automatski zatvorili sve prozore preglednika ili Odustani da biste prekinuli proces.",.. ADMIN_WARNING: "Ne mo.ete deinstalirati {0} jer ste na ra.unalo prijavljeni kao korisnik s ograni.enim ovlastima. Prijavite se kao administrator sustava Windows i poku.ajte ponovno.",.. KEEP_FREE_PROTECTION: "Zadr.i za.titu na webu",.. NO_THANKS_UNINSTALL: "Ne, hvala, samo je deinstaliraj",.. CANCEL: "Odustani",.. NO_THANKS: "Ne, hvala",.. SURE: "Naravno",.. OK: "U redu",.. SUCCESSFULLY_UNINSTALLED: "Uspje.no ste deinstalirali {0}.",.. SURVEY_OFFER: ".elimo .uti va.e mi.ljenje. .elite li podijeliti s nama svoje ideje za pobolj.anje ovog proizvoda?",.. SORRY_TO_GO: ".ao nam je .to vi.e ne.ete biti na. korisnik.",.. UNINSTALLING: "Deinstaliramo va. softver sada...",.. START_HEADER: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2561
                                                                                                                                                                                                                                      Entropy (8bit):5.593386141394456
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ud/4sBMK+ZvbkFzo5lQiw9Azz8eFRHJev0Dq4aVv2R:Ud/PBMKN6lu9aVFR4e2l2R
                                                                                                                                                                                                                                      MD5:B3146E3BDCF6D7A51571D5D262F0D8BB
                                                                                                                                                                                                                                      SHA1:66DB8C003F0A24A4C985F40BCFF91677173CF5E2
                                                                                                                                                                                                                                      SHA-256:BC4351268E254360AF66434192407DBBD28C363DC615957DDD421FDF6FABD0D1
                                                                                                                                                                                                                                      SHA-512:EA2021EA24A43371B59925E7E5DFC529CE468304B8BF47B27A43B1C944C424D5AA16869716C09A0EEFECFDBA1B273D2C1A86557972C4FB97DB883F1EB1049F81
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Az elt.vol.t.s csak az .sszes b.ng.sz.ablak bez.r.sa ut.n folytathat..<br/>Az OK gombot megnyomva automatikusan bez.rhatja az ablakokat, a M.gse gombbal pedig megszak.thatja a m.veletet.",.. ADMIN_WARNING: "A(z) {0} szoftver elt.vol.t.sa nem lehets.ges, mivel a sz.m.t.g.pre korl.tozott hozz.f.r.s. felhaszn.l.k.nt jelentkezett be. L.pjen be Windows-rendszergazdak.nt, majd pr.b.lja .jra.",.. KEEP_FREE_PROTECTION: "Webes v.delem meg.rz.se",.. NO_THANKS_UNINSTALL: "Nem, egyszer.en t.vol.tsa el",.. CANCEL: "M.gse",.. NO_THANKS: "K.sz.n.m, nem",.. SURE: "Rendben",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Megt.rt.nt a(z) {0} elt.vol.t.sa.",.. SURVEY_OFFER: "Sokra .rt.keln.nk a v.lem.ny.t. Megosztan. vel.nk, hogy v.lem.nye szerint hogyan tehetn.nk m.g jobb. ezt a term.ket?",.. SORRY_TO_GO: "Sajn.ljuk, hogy nem tart ig.nyt a szolg.ltat.sra.",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2426
                                                                                                                                                                                                                                      Entropy (8bit):5.319750062094408
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UUKu3r7X85X6/5Ouzl676xLqVDSdEfCXqYQ0d0ddfbOf0w:UDE/M5puk68VDcEK7vSdSL
                                                                                                                                                                                                                                      MD5:4BA2D71555911225A75E87C0AF11FB67
                                                                                                                                                                                                                                      SHA1:1E8C7B76AD6DCAC44AB7E7130C6D0DB36DC46D98
                                                                                                                                                                                                                                      SHA-256:8DF6CC43AD98A1457901C23BD377F1B552A6ED18B298E9D9B4E855034B7451C5
                                                                                                                                                                                                                                      SHA-512:D30C1E6A261220C8912D4D4D8F7B282D8283C8ED3C66452B505453F68FC12D0D1DE5CF3B8D634AED61DDD62D7C834DD9D3125DB08BA06495C9DF593BCB0B4B02
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Per procedere con la disinstallazione . necessario chiudere tutte le finestre del browser.<br/>Premi OK per chiudere automaticamente tutte le finestre del browser oppure Annulla per interrompere l'installazione.",.. ADMIN_WARNING: "Impossibile disinstallare {0} in quanto l'accesso al computer . stato effettuato come utente con restrizioni. Accedi come amministratore di Windows e riprova.",.. KEEP_FREE_PROTECTION: "Mantieni la protezione Web",.. NO_THANKS_UNINSTALL: "No grazie, disinstallala",.. CANCEL: "Annulla",.. NO_THANKS: "No, grazie",.. SURE: "Certo",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Disinstallazione di {0} riuscita.",.. SURVEY_OFFER: "Vogliamo sapere la tua opinione. Vuoi condividere la tua opinione per migliorare ancora di pi. questo prodotto?",.. SORRY_TO_GO: "Ci dispiace che tu abbia deciso di lasciarci.",.. UNINSTALLING: "Stiamo disinstallando il software...",.. START_HEADER: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2813
                                                                                                                                                                                                                                      Entropy (8bit):5.732554446731745
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UmgtjeIgCS7v06vDxzezcu5dbwaIVvOaaI9nCiGSGfKi4Z0YX+NrVW:UmgtjP6r3dzevdUnkbf4ANrVW
                                                                                                                                                                                                                                      MD5:7FA317B89904C25D094C036125707E2F
                                                                                                                                                                                                                                      SHA1:4FB6148770CBA2BD804FA8CE63D866170D53554C
                                                                                                                                                                                                                                      SHA-256:4C05356F2D2E836FB3644050B51B9CE411C4F3EABB1E1B3AE1A32998582343A6
                                                                                                                                                                                                                                      SHA-512:5D9CD98642FC52BF80CF55E0813ADCBBE7BC87B94221F95BE53CBAEE234F945BABF7659C96F49F825ABC7579B5F3B8E4810F9655E77B02399D5941485E078F59
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".......................................<br/>[OK] .............. ...............................[.....] .........",.. ADMIN_WARNING: "{0} .........................................Windows ............................",.. KEEP_FREE_PROTECTION: "..........",.. NO_THANKS_UNINSTALL: "....",.. CANCEL: ".....",.. NO_THANKS: "...",.. SURE: "..",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} ..................",.. SURVEY_OFFER: "...........................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2648
                                                                                                                                                                                                                                      Entropy (8bit):5.965627374338071
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UJfHnXcKfYWPiQrinx8fhU5aN0jFnSBra8ABYWajyqYOAl5us3aTuq:Upv2n0C5aejF4raNYdXAis+R
                                                                                                                                                                                                                                      MD5:BB68555B5C8C49E32D7D93FA12972A08
                                                                                                                                                                                                                                      SHA1:C2EED8F992AED7AA708174C9D3261707F1896751
                                                                                                                                                                                                                                      SHA-256:7F35FA92008EBD1E7FC6C9B1DD482B51F257760613CF50ABC55F6E0520E03F20
                                                                                                                                                                                                                                      SHA-512:E4780FB303ECE00D41D3E26621B941894664E1FB1D24FC67B60CF212D3D5DBE1105D93EDF3E1D9B09BDD62B96F35BE03C3F4C103455E3F70000546B645E11D66
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".. .... .. .. ... ... ... . .....<br/>... .. .... .. .... .. ... ... .. ... .......",.. ADMIN_WARNING: "... .... .... ..... .... {0}. ... . ..... Windows .... .... . .. .......",.. KEEP_FREE_PROTECTION: ". .. ..",.. NO_THANKS_UNINSTALL: "..., .....",.. CANCEL: "..",.. NO_THANKS: "...",.. SURE: ".",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "{0}. ..... ........",.. SURVEY_OFFER: "... .... .. ..... . ... .. ... .. ... .........?",.. SORRY_TO_GO: "... ..... .... . .. .... ......",.. UNINSTALLING: "...... .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2338
                                                                                                                                                                                                                                      Entropy (8bit):5.385545939734635
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:U2AUYbOdeMb72i5iur+vrJBFJZG5biH7kFJqSCLUhS0TGpCaiSV52Gh:ULkX2G+vNBFSbiHIFCAc6Sn
                                                                                                                                                                                                                                      MD5:919664FE19EED8484D03A19BEB76969D
                                                                                                                                                                                                                                      SHA1:AAE36791864DB4C940C4B9BA3776CE6AAF92E7E5
                                                                                                                                                                                                                                      SHA-256:CDB63088E885E9CF1C0D0BD83E293A27A2DEB3569CEB2FB41EEFA0EB4C23B6A8
                                                                                                                                                                                                                                      SHA-512:43EC99DD55E0D71D479FD9118EA0FA8D440F115DB78F459FC87F0E347678338D4D160DC1A0DB89C481BAF1C9515DA058B97A50C7CF17BD2040A227AD72BAE494
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Avinstallasjonen kan ikke fortsette f.r du har lukket alle nettleservinduer.<br/>Trykk p. OK for . lukke alle vinduene automatisk eller p. Avbryt for . avbryte.",.. ADMIN_WARNING: "Du kan ikke avinstallere {0} fordi du er logget p. datamaskinen som en Begrenset bruker. Logg p. som Windows-administrator og pr.v p. nytt.",.. KEEP_FREE_PROTECTION: "Behold webbeskyttelse",.. NO_THANKS_UNINSTALL: "Nei takk, bare avinstaller det",.. CANCEL: "Avbryt",.. NO_THANKS: "Nei takk",.. SURE: "Ja visst",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Du har avinstallert {0}.",.. SURVEY_OFFER: "Vi vil gjerne h.re fra deg. Kan du dele dine ideer om hvordan vi kan gj.re dette produktet enda bedre?",.. SORRY_TO_GO: "Det er synd at du ikke vil fortsette . bruke oss.",.. UNINSTALLING: "Vi avinstallerer programvaren n...",.. START_HEADER: "Vent! Vi vil savne deg hvis du velger . avinstallere",.. START_SUB_H

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2363
                                                                                                                                                                                                                                      Entropy (8bit):5.344335361384779
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:URHXIzXIV2xo3lID6XgocC7h7kBzyNkIK+2L0LgSPGxetBt/XktFOFVQoG:UhXOXgYGi6XgAgtIKtLeOw3Fmd
                                                                                                                                                                                                                                      MD5:9EE3E04C2DAD341E0C0F3580CA92DF07
                                                                                                                                                                                                                                      SHA1:655585282AF84165A715ABEC114266C0E483D56C
                                                                                                                                                                                                                                      SHA-256:099A81794F76D8B85D3131A38E1A0FD40AC8C3D818BEB251EB51A8E7A61890E9
                                                                                                                                                                                                                                      SHA-512:785050C760F86C7030B8154E8986133735E57907FFC5B5A5D48AB42CE199E48479476062D4053362D7AEFDCCD56CD32E5E435C76CE144E6B347864C1D7EA8AD2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Verwijdering kan pas worden voortgezet wanneer alle browservensters zijn gesloten.<br/>Klik op OK om alle browservensters automatisch te sluiten of op Annuleren om af te breken.",.. ADMIN_WARNING: "U kunt {0} niet verwijderen, omdat u bij de computer bent aangemeld als Gebruiker met beperkte rechten. Meld u aan als Windows-beheerder en probeer het opnieuw.",.. KEEP_FREE_PROTECTION: "Webbeveiliging houden",.. NO_THANKS_UNINSTALL: "Nee, installatie verwijderen",.. CANCEL: "Annuleren",.. NO_THANKS: "Nee, bedankt",.. SURE: "Goed",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "U hebt {0} verwijderd.",.. SURVEY_OFFER: "We horen graag van u. Kunt u ons laten weten hoe dit product nog verder kan worden verbeterd?",.. SORRY_TO_GO: "Wat jammer dat u ons gaat verlaten.",.. UNINSTALLING: "Uw software wordt nu verwijderd...",.. START_HEADER: "Wacht! We zullen u missen als u de software verwijdert",.. START_SUB_HE

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2456
                                                                                                                                                                                                                                      Entropy (8bit):5.637610951969184
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ux6l/L182ZR1tM7T4K95K19ehLvfZhKXdWjpLT4j0:U4lBXZjKWCfEeMI
                                                                                                                                                                                                                                      MD5:F98CDCAE371F4F5B1E23C57E18454B6F
                                                                                                                                                                                                                                      SHA1:CB023A6FA9CFB594EE5D106976786FDA91C79746
                                                                                                                                                                                                                                      SHA-256:9E64468A6840C649FA3BE851F9FDCC83786B0D6DAA2D8FAF795EF63D8BDDC86A
                                                                                                                                                                                                                                      SHA-512:C58035A6B720D8C0A3CFC382AB442801A67C35801B7E86425F5394BAF7ED9D801F4085BD9B7FFD6CB15CBA5B4C8E6BFBDB8FE928F15C35B68387A9D7B571746A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Nie mo.na odinstalowa., dop.ki wszystkie okna przegl.darki nie zostan. zamkni.te.<br/>Kliknij przycisk OK, aby automatycznie zamkn.. wszystkie okna, lub przycisk Anuluj, aby przerwa. proces.",.. ADMIN_WARNING: "Nie mo.na zainstalowa. programu {0} z powodu zalogowania na komputer jako u.ytkownik z ograniczonymi uprawnieniami. Zaloguj si. jako administrator systemu Windows i spr.buj ponownie.",.. KEEP_FREE_PROTECTION: "Zachowaj ochron. w sieci Web",.. NO_THANKS_UNINSTALL: "Nie, dzi.kuj.. Odinstaluj.",.. CANCEL: "Anuluj",.. NO_THANKS: "Nie, dzi.kuj.",.. SURE: "Pewnie",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Program {0} zosta. pomy.lnie odinstalowany.",.. SURVEY_OFFER: "Chcemy pozna. Twoj. opini.. Jak mogliby.my ulepszy. nasz produkt?",.. SORRY_TO_GO: "Przykro nam, .e musimy si. rozsta..",.. UNINSTALLING: "Odinstalowujemy Twoje oprogramowanie...",.. START_HEADER: "Czekaj!

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2373
                                                                                                                                                                                                                                      Entropy (8bit):5.403578939378001
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UHC6Unw+8DeoRMzBDzXGZ077FG/BjS7kjd6AGBhofQNpiNQvQ:UfUdkM1zk8Bw47kjZchofQNAZ
                                                                                                                                                                                                                                      MD5:363BCF3B44C8B2DBA1B7B83DE2797A42
                                                                                                                                                                                                                                      SHA1:83FAD60EC4D2EDDC460F8E3D4FB21390A5B0F1F2
                                                                                                                                                                                                                                      SHA-256:B5803B675E700F1939798095689929525355F7DF28823B684316E85B817DEAD1
                                                                                                                                                                                                                                      SHA-512:A3CCB181A49D6C3CAF2C7FF0B673FEB03C187619A93C647ABF31C9BF7EC24176ECC59EFC859BF2436162B57D2FE38B27B44DEE8241A0DB4D54EF82EB98973678
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "A desinstala..o poder. continuar somente se todas as janelas do navegador forem fechadas.<br/>Clique em OK para fechar todas as janelas do navegador automaticamente ou clique em Cancelar para interromper a opera..o.",.. ADMIN_WARNING: "N.o . poss.vel desinstalar o {0} porque voc. est. conectado ao computador como um Usu.rio Limitado. Entre como Administrador do Windows e tente novamente.",.. KEEP_FREE_PROTECTION: "Manter a prote..o na Web",.. NO_THANKS_UNINSTALL: "N.o, obrigado. Desinstale o programa",.. CANCEL: "Cancelar",.. NO_THANKS: "N.o, obrigado",.. SURE: "Claro",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} foi desinstalado com .xito.",.. SURVEY_OFFER: "Queremos saber a sua opini.o. Deseja compartilhar suas ideias para tornar esse produto ainda melhor?",.. SORRY_TO_GO: "Lamentamos pela sua sa.da.",.. UNINSTALLING: "O seu software est. sendo desinstalado...",.. START_HEADER

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2369
                                                                                                                                                                                                                                      Entropy (8bit):5.415409049601268
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UDlURTq+8ZxNHRSMMy7EVW14P9SZPkDPIjQ7AV2iEc5KQ9oD:UxUOitVQsDf7FQu
                                                                                                                                                                                                                                      MD5:4A842A2E661C2CD0013A96748F97C75C
                                                                                                                                                                                                                                      SHA1:CE1DEDAFEBBEBB910F4A7469F591DC952C1A56C2
                                                                                                                                                                                                                                      SHA-256:E8CA149A51753618D3265D2AC52F4912960DDBB1417518669B9841529C9275A1
                                                                                                                                                                                                                                      SHA-512:5BCA9BF006F7FAFB934660FBBB835629BCB7A0718C4FAA8FFAF831255FA533E893B3D75ACE43A3CC651ABBD52119EBB380356BAF75C2D69783E343F4C29FBEC5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "N.o . poss.vel continuar com a desinstala..o sem fechar todas as janelas do browser.<br/>Prima Ok para fechar automaticamente todas as janelas do browser ou Cancelar para cancelar a opera..o.",.. ADMIN_WARNING: "N.o . poss.vel desinstalar o {0} porque tem sess.o iniciada no seu computador como Utilizador Limitado. Inicie sess.o como Administrador do Windows e tente novamente.",.. KEEP_FREE_PROTECTION: "Manter a prote..o Web gratuita",.. NO_THANKS_UNINSTALL: "N.o, obrigado, desinstalar",.. CANCEL: "Cancelar",.. NO_THANKS: "N.o, obrigado",.. SURE: "Claro",.. OK: "Ok",.. SUCCESSFULLY_UNINSTALLED: "Desinstalou o {0} com .xito.",.. SURVEY_OFFER: "Queremos ouvir a sua opini.o. Pode enviar os seus coment.rios para tornar este produto ainda melhor?",.. SORRY_TO_GO: "Temos pena que nos deixe.",.. UNINSTALLING: "Estamos a desinstalar o software...",.. START_HEADER: "Aguarde! Se desinstalar

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3465
                                                                                                                                                                                                                                      Entropy (8bit):5.100684456322263
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UxdXe3T+ZqUelORd3BZjNfGqhHmLgw0ZIsgUKacbkgmhVXAT1Wh9jh:Uxt3xPfGqhHmkwKIyK+hxv
                                                                                                                                                                                                                                      MD5:C67F10F23136A95945461C483A341B45
                                                                                                                                                                                                                                      SHA1:849E51AB8AE1916816F973B2E90BD3BAE55E9875
                                                                                                                                                                                                                                      SHA-256:51921EC69C90ABA8C2844868C1410B21F539D6010CF14535A26F5146E49A4C16
                                                                                                                                                                                                                                      SHA-512:F666A9695395830C790035A3EE3FB50F5EED63D1B18150E77EA6BD30CFB8A13254C3C4418BA33BC8638A0E4176E0656AF311D379B784CA8534D981C81D3217FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "..... .......... ........, .......... ....... ... .... .........<br/>....... ...... .., ..... ............. ....... ... .... ........, .... ...... ......, ..... .......... .. .......... .........",.. ADMIN_WARNING: ".......... ....... {0}, ... ... .. ..... . ....... ... ............ . ............. ........ ....... . ....... ... ............. Windows . ......... ........",.. KEEP_FREE_PROTECTION: "......... ...-......",.. NO_THANKS_UNINSTALL: "..., ........ ....... ...-......",.. CANCEL: "......",.. NO_THANKS: "..., .......",.. SURE: "......",.. OK: "..",.. SUCCESSF

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2602
                                                                                                                                                                                                                                      Entropy (8bit):5.66894085733485
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ujo34jWoRebkIk8Am7/fz8x9kJghJhuaO+PUi53yqUA29nsYvrOskJJp:UjP1Ik8AajJMaavUi5RVgsSisWp
                                                                                                                                                                                                                                      MD5:2CDC2F8531318F7A262237E74B21BF9E
                                                                                                                                                                                                                                      SHA1:4C0D047AD2725F3C73DD51FEBA02C5ECBB5189BC
                                                                                                                                                                                                                                      SHA-256:FCF045B381B7188DED6606DCDCED5F07AF5879315766C701DFD76E078F0D746E
                                                                                                                                                                                                                                      SHA-512:E40609EB7A6A78FBC7A71E9425DAE2FD1B16E0C983F8AFD8A12E43BA997D9F5BA80FF7B043F9EAC83E9EF8CF95E65AEC28D69F95419E6530E6A9A77FBCFD9089
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "V odin.talovan. bude mo.n. pokra.ova. a. po zavret. v.etk.ch okien prehliada.a.<br/>Ak chcete automaticky zavrie. v.etky okn. prehliada.a, kliknite na tla.idlo OK. Ak chcete odin.talovanie zru.i., kliknite na tla.idlo Zru.i..",.. ADMIN_WARNING: "Aplik.ciu {0} nem..ete odin.talova., preto.e ste sa do po..ta.a prihl.sili ako pou..vate. s obmedzen.m. Prihl.ste sa ako spr.vca syst.mu Windows a sk.ste to znova.",.. KEEP_FREE_PROTECTION: "Ponecha. ochranu pred webom",.. NO_THANKS_UNINSTALL: "Nie, .akujem, odin.talova. ju",.. CANCEL: "Zru.i.",.. NO_THANKS: "Nie, .akujem",.. SURE: "Iste",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "Aplik.ciu {0} ste .spe.ne odin.talovali.",.. SURVEY_OFFER: "Radi by sme poznali v.. n.zor. M..ete sa s nami podeli. o svoje n.vrhy na zlep.enie tohto produktu?",.. SORRY_TO_GO: "Je n.m ..to, .e sa l..ime.",.. UNINSTALLIN

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2387
                                                                                                                                                                                                                                      Entropy (8bit):5.4927371922355706
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Ub2RwcC6S2hGDlCEVFS/+uhRpTSQOa/YmAXXRTmBbRmru:UiKRE8ha/HhiQ70l8RMu
                                                                                                                                                                                                                                      MD5:140D3935BA24766C9C25A751AD34C916
                                                                                                                                                                                                                                      SHA1:3865DC1EEA43E01E071BE68B7023FF3037F2D8AF
                                                                                                                                                                                                                                      SHA-256:8325808CB1A95154E39BEA2FE1B4ED82085959E3BA6C6B40A051528B3A9317CD
                                                                                                                                                                                                                                      SHA-512:C1E64CDA6B586CC3D41F9BB958C6C2E266115B5F9D272A8EA792195BEC3FFFF5BBB87CF556E3F42CD650EF2BCF40903D66C24066E2DEF2CDCD879621C47C84FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Nije mogu.e nastaviti deinstalaciju dok se ne zatvore svi prozori pregleda.a.<br/>Kliknite na dugme .U redu. da biste automatski zatvorili sve prozore pregleda.a ili kliknite na dugme .Otka.i. da biste odustali.",.. ADMIN_WARNING: "Ne mo.ete da deinstalirate {0} zato .to ste prijavljeni na ra.unar kao ograni.eni korisnik. Prijavite se kao Windows administrator i poku.ajte ponovo.",.. KEEP_FREE_PROTECTION: "Zadr.ite Veb za.titu",.. NO_THANKS_UNINSTALL: "Ne, hvala, deinstaliraj je",.. CANCEL: "Otka.i",.. NO_THANKS: "Ne, hvala",.. SURE: "Naravno",.. OK: "U redu",.. SUCCESSFULLY_UNINSTALLED: "Uspe.no ste deinstalirali {0}.",.. SURVEY_OFFER: ".elimo da .ujemo va.e mi.ljenje. Mo.ete li da podelite sa nama svoje ideje za pobolj.anje ovog proizvoda?",.. SORRY_TO_GO: ".ao nam je .to odlazite.",.. UNINSTALLING: "Sada deinstaliramo va. softver...",.. START_HEADER: "Sa.ekajte! Ak

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2300
                                                                                                                                                                                                                                      Entropy (8bit):5.467419015434516
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:U2OwbAtfP5E+Ht3zni7IL8wPt2i6W7GvCZCjXAPPeMHi2iwsuwmwOR87Yy:ULwq7t38IfFN7JCaPeMCH4187Yy
                                                                                                                                                                                                                                      MD5:0FC830DCA735838A75AD6F506EB6785C
                                                                                                                                                                                                                                      SHA1:36398DAAAEB27A016A056DC93BB647F0B4D92931
                                                                                                                                                                                                                                      SHA-256:A79DF8C6942DB06F50893C5607093E107187EB8AA0B365F61C433699C3A732F3
                                                                                                                                                                                                                                      SHA-512:6B5E80559D7114D948BBFD289EC5A9276316C8D15152D5F2BC44DA7A7FEEE948278291589B729D77EBB680642AF12B1A3F9AD8C1F4D48DB58E9E74F57565EBE9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "Avinstallationen kan inte forts.tta f.rr.n samtliga webbl.sarf.nster .r st.ngda.<br/>Tryck p. OK f.r att st.nga alla webbl.sarf.nster automatiskt, eller p. Avbryt f.r att avbryta.",.. ADMIN_WARNING: "Du kan inte avinstallera {0} eftersom du .r inloggad p. datorn som begr.nsad anv.ndare. Logga in som Windows-administrat.r och f.rs.k igen.",.. KEEP_FREE_PROTECTION: "Beh.ll ditt webbskydd",.. NO_THANKS_UNINSTALL: "Nej tack, avinstallera det",.. CANCEL: "Avbryt",.. NO_THANKS: "Nej tack",.. SURE: "Ja tack",.. OK: "OK",.. SUCCESSFULLY_UNINSTALLED: "{0} har avinstallerats.",.. SURVEY_OFFER: "Kontakta oss g.rna. Vill du dela dina id.er om hur vi kan g.ra produkten .nnu b.ttre?",.. SORRY_TO_GO: "Vi beklagar att du l.mnar oss.",.. UNINSTALLING: "Avinstallerar programvaran nu ...",.. START_HEADER: "V.nta! Om du avinstallerar kommer vi sakna dig",.. START_SUB_HEADER: "Och v.rre

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2590
                                                                                                                                                                                                                                      Entropy (8bit):5.539635705804502
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UrK+A3WqDVZRmSXdypNsXHp8QbTBtW+R+jNvSvp2DAw0kxnfcOKef3gtlTbx:UW3WQyQXHpHHBw+R+x680GfF3gtr
                                                                                                                                                                                                                                      MD5:EAFD805E00D7B38F97A3291F7E651DA3
                                                                                                                                                                                                                                      SHA1:83CA877108EE77B21A95FF367C0F22FBC5C6D874
                                                                                                                                                                                                                                      SHA-256:06D495BA3C71A2CD1E3E0AF499F18CF594008FFE6A92AB173825564B57A883DD
                                                                                                                                                                                                                                      SHA-512:B2F6BFAEB6FF8A513875E217A9ACE4E113CE7E7E4ABBD1CFDF40D91EA1DFE36E6E2ED0EC95098F4D1A4F36EE09B34ACE2942ABC8CE1AADDE4307551FD60D89FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "T.m taray.c. pencereleri kapat.lmadan kald.rma i.lemine devam edilemez.<br/>T.m taray.c. pencerelerini otomatik olarak kapatmak i.in Tamam'a, i.lemi iptal etmek i.in ise .ptal'e bas.n.",.. ADMIN_WARNING: "Bilgisayar.n.zda S.n.rl. Kullan.c. olarak oturum a.t...n.z i.in {0} uygulamas.n. kald.ramazs.n.z. L.tfen Windows Y.neticisi olarak oturum a..n ve yeniden deneyin.",.. KEEP_FREE_PROTECTION: "Web korumas.n. tut",.. NO_THANKS_UNINSTALL: "Hay.r, te.ekk.rler, kald.rmak istiyorum",.. CANCEL: ".ptal",.. NO_THANKS: "Hay.r, te.ekk.rler",.. SURE: "Tabii ki",.. OK: "Tamam",.. SUCCESSFULLY_UNINSTALLED: "{0} uygulamas.n. ba.ar.yla kald.rd.n.z.",.. SURVEY_OFFER: "D...ncelerinizi ..renmek isteriz. Bu .r.n. daha iyi hale getirmek i.in neler yap.labilece.ine ili.kin d...ncelerinizi bizimle payla.abilir misiniz?",.. SORRY_TO_GO: "Gitti.iniz i.in .zg.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2207
                                                                                                                                                                                                                                      Entropy (8bit):6.364734207000466
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UtM+PzEwQSBjFt9CNLX15qklwzATPXtrVe8Xu:UPftMtFzwzUtrbe
                                                                                                                                                                                                                                      MD5:A576BB401523BD00F774C99E9F25F828
                                                                                                                                                                                                                                      SHA1:6396FA91B46C5DAEFCDA067DCAEA74AD9E130390
                                                                                                                                                                                                                                      SHA-256:DB6DB474BE7E23AAE7C1C824A839941A6BA47AB40CC56137B4D6CD58DCF5F9DF
                                                                                                                                                                                                                                      SHA-512:58FB316AF581619CED5E6CD0C7A01E3444253E665276A404E3B5DDA87670A8A8D8C1822DA979E567876D87044E52D7BE70AEA7D56BDC379905711E82C64E4A1C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: "........................<br/>...............................",.. ADMIN_WARNING: "..... {0}.................. .. Windows .............",.. KEEP_FREE_PROTECTION: "......",.. NO_THANKS_UNINSTALL: "........",.. CANCEL: "..",.. NO_THANKS: "....",.. SURE: "..",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "...... {0}.",.. SURVEY_OFFER: "........... .....................?",.. SORRY_TO_GO: "............",.. UNINSTALLING: ".........",.. START_HEADER: "...! ................",.. START_SUB_HEADER: "............

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2271
                                                                                                                                                                                                                                      Entropy (8bit):6.350421611473208
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:UtQEPQWGitIGg3V4BxFrtYqbu1bRqAO5qgggF3pA5Ber9xIn:UCEjAqxHsG5eEpAri9yn
                                                                                                                                                                                                                                      MD5:925CB35BE12826FE9550327BC44FE65B
                                                                                                                                                                                                                                      SHA1:6261328E6BE0479CC2E760717C4D0BB9999388DE
                                                                                                                                                                                                                                      SHA-256:6FEE7B65F8A63E9249EDE98A704B8007AFF82DE2DF09FE2549C9CE4F0D4E8632
                                                                                                                                                                                                                                      SHA-512:2A213E6E768CC0ACE261CB94528B4EE1B310B651D7299C98F98EE230EFCF7D5312D4DE4DEEDCAAAA9A35C04D353DF1B3009986DD7B070289EFE99887C9F2929A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUninstall_ = {.. BROWSER_RUNNING_WARNING: ".........................<br/>. [..] ............... [..] ...",.. ADMIN_WARNING: "....... {0}..... [......] ....... .. Windows ..................",.. KEEP_FREE_PROTECTION: ".. Web ..",.. NO_THANKS_UNINSTALL: ".............",.. CANCEL: "..",.. NO_THANKS: "....",.. SURE: "..",.. OK: "..",.. SUCCESSFULLY_UNINSTALLED: "....... {0}.",.. SURVEY_OFFER: ".......... .......................",.. SORRY_TO_GO: ".................",.. UNINSTALLING: ".............",.. START_HEADER: "................",.. START_S

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417472932238081
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP1HK:Yo6KUtjVLk4t94iU3KNoT8u8a9
                                                                                                                                                                                                                                      MD5:B3F64F2E32672EC064D98F1CD3DBB8CE
                                                                                                                                                                                                                                      SHA1:74763F4057A741D0754B1B6144DB14C02B360A42
                                                                                                                                                                                                                                      SHA-256:C886A1CCB76E7A5E1AE3961BC549130C2A69A96F4546EE8C00DA04DED1ECAA98
                                                                                                                                                                                                                                      SHA-512:C7540C5CBFE985F902CADD911A30BB7E92B63A270A55196E25D034B0AD4D1DC942263B7E0914D47F1CA5FABBE23FBE1E069C662DFDFABE5A2E3D00BB3FE3EA8B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.402141567586013
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPjV:Yo6KUtjVLk4t94iU3KNoT8u8aM
                                                                                                                                                                                                                                      MD5:B0BC094F6931E285917DF066E70AFDA6
                                                                                                                                                                                                                                      SHA1:0899A055E2F4A08C75DD877BE98F4CE8DDF25FD3
                                                                                                                                                                                                                                      SHA-256:C94D4CA2C5493388BAF3358FCBC253F404AE2CE2A8977CD0195B5182C3F1F2DA
                                                                                                                                                                                                                                      SHA-512:7F209E975667F7E14826D4F3F74D1BFE480162D3F44EE262552F2EE45DE07F7920A6769D53C1D6446C862379661A9C05873D04347182814F10FC94F2A01F8517
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.423174202190107
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPGY:Yo6KUtjVLk4t94iU3KNoT8u8aXY
                                                                                                                                                                                                                                      MD5:3531410A3389E58D6ADC1BA79B7E8AC3
                                                                                                                                                                                                                                      SHA1:FDDF32A4F9E6E712A072FFDB8D9F1B4D3074E10B
                                                                                                                                                                                                                                      SHA-256:049F311277AE1D043EE8721FBDD8D956E78A7017AD726E799CB31F56D8E4A8DF
                                                                                                                                                                                                                                      SHA-512:81E30F56606F05977BAB6A4130C525A01B67644610C0473C55BC6A36665B0A3534AABAE7CDDE0D4EC65282D529C43BAA871ED4846495CCE131BD0901ED5E3A77
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.404312191106673
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPATq:Yo6KUtjVLk4t94iU3KNoT8u8aBTq
                                                                                                                                                                                                                                      MD5:0961BF88D2A73C98821E1F529692B590
                                                                                                                                                                                                                                      SHA1:E4FD28F4D015D68615711F7DED15EFCE08B51E55
                                                                                                                                                                                                                                      SHA-256:D270160BE218212A9A8041546986BFB74B2CAD81951BD31A449B6DF363D1693D
                                                                                                                                                                                                                                      SHA-512:36D2D3EDA88D8BEE088138681204D8B6C0563247A4EC6B2ACF4DDE43905CFE0C21F8D85F5A00EC6FA4F252BCA529D8D344FDF423D1E765F62798D00235A73E8D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417937793053212
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPzZ4F:Yo6KUtjVLk4t94iU3KNoT8u8aPF
                                                                                                                                                                                                                                      MD5:3EE00699A1A86401E17A7997D25614B5
                                                                                                                                                                                                                                      SHA1:3712A3A3766C2FA21B3C769715AB655C736D6CBC
                                                                                                                                                                                                                                      SHA-256:676F3BBB8CC0B4D9C965F38BD0F810FCCB949ABD374FA4FFFC731547FDDCF8FF
                                                                                                                                                                                                                                      SHA-512:7BA1EFA1C3BFA0E556EC104CC9ADAF95F77F97FA978ABA67450D304547E0681C74466405572BAF8460C362C22B51C14A1EA6C41F56B332D92E385D66BCE4A889
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.4109786638673985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPInx:Yo6KUtjVLk4t94iU3KNoT8u8annx
                                                                                                                                                                                                                                      MD5:43B962273A47520F08388C1E1861AA33
                                                                                                                                                                                                                                      SHA1:B493B54203F4DB64589036C438B8620AAD834881
                                                                                                                                                                                                                                      SHA-256:8E66DD20FC293F593CE9D31F78CA4180784AFAE3678EDDAC41855DAE8C22B666
                                                                                                                                                                                                                                      SHA-512:D39401C3751C9F4D0C3514979D58E739552744BE7D5504D59B3FD84BC0469D162F2745E46DB5D752647E30AD7C3ABA158DFE9C5B8141CC4A34680FCB9F3882A8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.414158920752557
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPHZ:Yo6KUtjVLk4t94iU3KNoT8u8a0Z
                                                                                                                                                                                                                                      MD5:64B098675FD0343E57825C52736D7656
                                                                                                                                                                                                                                      SHA1:0F0D5CB5195015F8A20E7C8BA275C015067FCC3E
                                                                                                                                                                                                                                      SHA-256:AFD02FCDD8DD630D986D6E66366CD1BBAD2900D3766A82E8CF3A91CCA51D9E3E
                                                                                                                                                                                                                                      SHA-512:0A8F7EF009F69CA3F4E7F00B6CF501DB79AA253CDFA59C46B0CFC0A6203FB838090A5CB069605BCEEAA95361A958867980068B26CF1B2927C77E29569903A816
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.413964376428777
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP6WU:Yo6KUtjVLk4t94iU3KNoT8u8adWU
                                                                                                                                                                                                                                      MD5:4877D7CBF1AAA264ADDAE198FE1C13ED
                                                                                                                                                                                                                                      SHA1:D0B3985F7DE5E4D228D25E124817300DA729AA49
                                                                                                                                                                                                                                      SHA-256:8A9502D4F8784B4C722DD777F0E63C26ECC374FA61197A4D62D056BF406EE4F6
                                                                                                                                                                                                                                      SHA-512:C3645F875B700EF8FC8379B73B25D331B1490E0E5B04B14CC60E5FDC7B911E794F0EF136F6A11AB7CD6B7E16406D2A10A89F7E00BF4648929D2B80537C13FF4B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.411391674933713
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPSM9:Yo6KUtjVLk4t94iU3KNoT8u8aa
                                                                                                                                                                                                                                      MD5:30A9F1DE22C0E1EEBDFA186B9264514B
                                                                                                                                                                                                                                      SHA1:8B670B8256EF57B1CC3FB1C7FC3756A66230ECBD
                                                                                                                                                                                                                                      SHA-256:1A2C3D5D671D37D45374F9430A4A472E0FBB6C7C8AD35AC51F9F83EC39A3151E
                                                                                                                                                                                                                                      SHA-512:3AB1AF56141EF689F2D36D195D9C65CF41131104A86732B8FEC326921248F1F854D299D8F342D96D61E8C326A57DAE146CEBF48177E13299956C4533D2D2993A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.4176947331475
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPu:Yo6KUtjVLk4t94iU3KNoT8u8ab
                                                                                                                                                                                                                                      MD5:181773FF02940FC7128F925099FCFCB4
                                                                                                                                                                                                                                      SHA1:46FE7A1441BDB893DE21A4FF50A7AFC2EDADD9B4
                                                                                                                                                                                                                                      SHA-256:207CA3EF6FECB734A44CC1540EB4258143BBA81D3AAA1DAEFD3BF64DB6D67531
                                                                                                                                                                                                                                      SHA-512:566AA89C9546F3E0C2684375295E1712493A3488074705FF77FFD3B34CDA3EC815B7DE663B3838F31542505D3BC633986D2D7B12E858C35FD527B31B470B6972
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.4206279033517974
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPlDsIs:Yo6KUtjVLk4t94iU3KNoT8u8aas
                                                                                                                                                                                                                                      MD5:4F4C74AC405E0543BFD7A5FDF7A797F9
                                                                                                                                                                                                                                      SHA1:9C40ABE063F6594682169C2E40CE93B384FE68C7
                                                                                                                                                                                                                                      SHA-256:9C5C972A3D2508B891ACE18FD1FE21C7E4926093785499FCE49057E8DD7B3177
                                                                                                                                                                                                                                      SHA-512:1876587933C1016AD101CE4336463C4470A53D1026EE88DB620089025114B037904F1A1BFB7E3EB21ED5762D8DFF8628FED05BEE092F924DACDE67C1EDE086EF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.412469806284531
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPJ:Yo6KUtjVLk4t94iU3KNoT8u8aY
                                                                                                                                                                                                                                      MD5:C7012F84097AA88FDA9C1568D5DDA900
                                                                                                                                                                                                                                      SHA1:C6DA983DAEA5F7284CA8B6CB7D5CD1DD87805D6F
                                                                                                                                                                                                                                      SHA-256:4C051A3C05072CF2C80F01FDDA5E3A140D046B18E3665CB1F56C9633F619F2A4
                                                                                                                                                                                                                                      SHA-512:448053C703B7D214E6B51A0456FF0333E40B75C95CE35987446C2B203A14A33157002A4C92F5ED7909054C0A2770D790A6612F5217E0EAA713E7ADF38607F958
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.404348694202721
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPj6:Yo6KUtjVLk4t94iU3KNoT8u8ar
                                                                                                                                                                                                                                      MD5:0DBF42B494C9FD60E1EBAD06C7CCDC73
                                                                                                                                                                                                                                      SHA1:4205BA0C15D3247C7974D031CE1E845DA21CA0E9
                                                                                                                                                                                                                                      SHA-256:38DD68A0A00453151BC9AFF1F2881831909448C888FA868703AE79551ABC99AF
                                                                                                                                                                                                                                      SHA-512:BB87D58ED4F38452710ED6ED8A16EA2DDEC01D44893F221B74CE85465C5FCD4D3892B468B66B487E6576FC28F4427FBB214BB20927EC7F6ED6BC122AA203DB61
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417283333717598
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPSm2z:Yo6KUtjVLk4t94iU3KNoT8u8a3Tz
                                                                                                                                                                                                                                      MD5:B15CE9ABB7714E4BA8A4F453615C051A
                                                                                                                                                                                                                                      SHA1:DA04D4FC1135FCD383A09AFB5AC10E0FD24973C6
                                                                                                                                                                                                                                      SHA-256:C05CE8B7BFAA4B23BE9DA977D9A38B6AA1ADD9B8F7B52B942AE771CA4662B98A
                                                                                                                                                                                                                                      SHA-512:262F32A1439D3105A7C5918CBA24953DC8B9386F1740647D0B7EA80D73A9095EE9BC06CFE93D64C075C0C4649DE73D2E3F3C9F10287763252B2EC13125713E9A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2008
                                                                                                                                                                                                                                      Entropy (8bit):5.902499509490723
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7vzEJoY7j197RD0AQUSRrNyEimWAwHM3+i3PZOHsciY/oY7BL+XjjgoGgq:/ZYt9iAQhRwEimWQ+i3YBLztsI5H
                                                                                                                                                                                                                                      MD5:37CE5B85A98F0E0E138B7A8DBB213F77
                                                                                                                                                                                                                                      SHA1:68629B217BD9400542E84EDCE81B150812CF0E9B
                                                                                                                                                                                                                                      SHA-256:587891210B33127BB67D92BD3E8215BD0818C0594B8B9E528654C464ED2F487E
                                                                                                                                                                                                                                      SHA-512:18E6CC208F9A1F530867190FCBD4C126B3CA97529F04E190AD7DBFA5E426A404BAF17A837F58B04CB9E53D1E43580E74A032B27CF599694B915129E8124CB396
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: ".. ... ... ... .... ... .. .... ....",.. UT_WSS_TOAST_TITLE_COHORT_2: "McAfee. .. .... .. ",.. UT_WSS_TOAST_TITLE_2: "... .... ... {0}.(.) .. .. ..",.. UT_WSS_TOAST_TITLE_2_STRONG: "... ..",.. UT_WSS_TOAST_DESC_1_VAR_1: "McAfee. .. ..... .... VPN, .. .. .., Premium ...... ... .. . ... ......",.. UT_WSS_TOAST_DESC_1_VAR_2: ".. . ... ... ... .. ... . .. .... ......",.. UT_WSS_TOAST_DESC_2_VAR_2: ".. McAfee. .. ...... ......",.. UT_WSS_TOAST_DESC_COHORT_2: ".. .... ... ......, .. .. .., VPN, .. .. ... ... .... ......",.. UT_WSS_BUTTON_ACCEPT: ".. ....",.. UT_WSS_BU

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417717943832594
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPZ:Yo6KUtjVLk4t94iU3KNoT8u8aQ
                                                                                                                                                                                                                                      MD5:991FB6C6F5A9E7F9DDDF59DF03CC7212
                                                                                                                                                                                                                                      SHA1:EB004576F33CB1C91D15194A8408FD75CB361479
                                                                                                                                                                                                                                      SHA-256:CF98931F079404410B6C8AA57709B64888E83CC53F597D806F6E884E89A7C66E
                                                                                                                                                                                                                                      SHA-512:EC45875AA4F99FE260FB3ADDC9F2C14C924AEF38B0B36B8E34FD6889C23CA9E248E53296DEDD6E34ACE9C5C90CFF623F678D3B22E3A0A7B6BE0D3B2EA5D427C7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417978012850339
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP7x:Yo6KUtjVLk4t94iU3KNoT8u8ag
                                                                                                                                                                                                                                      MD5:BBB1090C4D796660ADC97F4E4682B1A6
                                                                                                                                                                                                                                      SHA1:A47DCB7B2FE4044B481229804F13B5E6976D57A4
                                                                                                                                                                                                                                      SHA-256:D8A09C7F70A9280AC2493267298526FB196EFA386E1BF4D79889AFC6CB737C40
                                                                                                                                                                                                                                      SHA-512:8C4E5A0CFCB38AA5099B9F7F91940C00BEA1272357C8CF390518834CCE6342A2FA2A3505509ABD002E822E2978920E21EE1B2254A854AA8715930BD971F338CC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417151663628038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPdt:Yo6KUtjVLk4t94iU3KNoT8u8aC
                                                                                                                                                                                                                                      MD5:52ECE28662E0D21549522B9A107A7D5B
                                                                                                                                                                                                                                      SHA1:EF5CBA1244C67AC8F48C70B9D34D6670C21CD34D
                                                                                                                                                                                                                                      SHA-256:E04254B9F5852306E0539BFE0A969262BC65D622FE815AF306A598C54EFC932B
                                                                                                                                                                                                                                      SHA-512:9CBF794CA94FFC89EB01A0171E822DF3738F4389A60B2761D3BA8193345D4955DFDEEC6997E66BE3A194B585AA03D21AFE927364800D5BCFBEBA959FF0617DCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.426210007371951
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPkOK:Yo6KUtjVLk4t94iU3KNoT8u8aMK
                                                                                                                                                                                                                                      MD5:760CB2FACEEBA384FC6681BA7BF19784
                                                                                                                                                                                                                                      SHA1:492E5E711BD3D4184DDF5A711282A471F144603D
                                                                                                                                                                                                                                      SHA-256:8311B8509F7594E00041D1F54B3E2A7B099B3AFC563AF862E190F854BC8E941D
                                                                                                                                                                                                                                      SHA-512:9C7DCD138BD9E8E518FC1F2EE0D7E5C4F4725B06A4BA2D4B79F776AEC86D3C07CFE1F1D24C4E9D4BE8F0C96585B7657696998A8CC0592412B213A8F4E6E9BB1E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.412004287630576
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPG:Yo6KUtjVLk4t94iU3KNoT8u8aT
                                                                                                                                                                                                                                      MD5:32CD295CA8E60B6B2AF3C7C62A786913
                                                                                                                                                                                                                                      SHA1:86E81954FDF790091B9534B797AE7CC2D719E16D
                                                                                                                                                                                                                                      SHA-256:1E2F66CCC5CB80267477CE16590A34A9B09D17CF78E63047EA504680ED151DDF
                                                                                                                                                                                                                                      SHA-512:55B6B8ADC6FB7850DB1F8F70243463039B71167C2F153012DC7E42791AD0F6E6CB57E91F74011DB14525EC2225218D354F910973A10E6CEFFC6289411D8EF8BD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417697697622299
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPmzf3:Yo6KUtjVLk4t94iU3KNoT8u8apz3
                                                                                                                                                                                                                                      MD5:CF3770DC2C921A00DF66F03916B87255
                                                                                                                                                                                                                                      SHA1:A619D0E1875D8760FA9D3118B6D4F1E7C42EAA17
                                                                                                                                                                                                                                      SHA-256:D54ACE54A23E0BCC543A8CF2571F5F24447F624719377830E2879057D9B0668B
                                                                                                                                                                                                                                      SHA-512:590D4A289A70FB912C36B910F64786561D35D8D0B331F02606906D0AAAC2589D9F1C597B5B5F48D2CA2596DB4706D1B9BD765F87CED572B4BC5AF595C2DFFDE0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.421428939555405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aP3yU:Yo6KUtjVLk4t94iU3KNoT8u8am
                                                                                                                                                                                                                                      MD5:F18DFA815C0BD8C0405B15B3AAC1B0F4
                                                                                                                                                                                                                                      SHA1:9097E9DC26A9A1BDF8B16F27D242705028B70CFE
                                                                                                                                                                                                                                      SHA-256:DC5C042F310D2A8485DAD80CD1F8462FC87FFF52CDAA13F169A5C2D502B9A13D
                                                                                                                                                                                                                                      SHA-512:DB00A23737A0C192264DC6597F9713093627F466573B481D07BC6ABC3C0E7DD3A7EAD9A418E04F7979ADA6C2AD36871575EE885692597A58D802E10FD1785F37
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.417209049411578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPE6W:Yo6KUtjVLk4t94iU3KNoT8u8aIW
                                                                                                                                                                                                                                      MD5:873FCC3FB59DE509C4EC7C2385C5D76E
                                                                                                                                                                                                                                      SHA1:FA468187748BCB657E561FF8366A1B976EC947BD
                                                                                                                                                                                                                                      SHA-256:593D7A75F586F3E7F699505247309AABF4AD477D7F9351B3A26FDFF700CF8119
                                                                                                                                                                                                                                      SHA-512:E15E8B593BA1F21E1F80552FE6BD0EF20842682B85EFEB4AB2208FF191983ED34CC8FD2871A1FFC31325067D2F9D9B761B36431CCFB2A94A1D06F7E728A0F8A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.420992852663342
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPPL:Yo6KUtjVLk4t94iU3KNoT8u8a6L
                                                                                                                                                                                                                                      MD5:F0B2D08F119BC19FD22438BE6C9B22DE
                                                                                                                                                                                                                                      SHA1:E0C27C0F9599432AE52F0CB090616A4D2DC796A1
                                                                                                                                                                                                                                      SHA-256:61A312C26E59DF0F97F51AAEC47EC61625451997D0E62055710736259AC68A70
                                                                                                                                                                                                                                      SHA-512:6D63B1CC23C3F2780678629706E67B5A0868F9FB889455CDC35195808BB3A7163A79DFC1B786B2D7442FC8BAA4C02FEB7028AEB1445AC289F1E3994232B67B65
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.411794900223913
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPOU:Yo6KUtjVLk4t94iU3KNoT8u8a8
                                                                                                                                                                                                                                      MD5:7CC2FA0C7BA72F2837A823773B016A40
                                                                                                                                                                                                                                      SHA1:ECBEADD0BA77E072DAFA2664FB56CDD1A8C895EF
                                                                                                                                                                                                                                      SHA-256:85FA08E2A5666242663000EEEE1BB266424060176935751F4AD941FEA25C296D
                                                                                                                                                                                                                                      SHA-512:32E69B2D17371DA4C30BB77BF8BD86BA0090310393BF7A9A88F93F2D0BF73EA8B15A5A369397C23767E806AE4BC3281E48835786D4047EBBA1413F35E5EED5EC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.41001311637777
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPKN:Yo6KUtjVLk4t94iU3KNoT8u8av
                                                                                                                                                                                                                                      MD5:D55B1DF8066C898536B4A5FF64D6F96B
                                                                                                                                                                                                                                      SHA1:B27C22E7E35E6C6867F3EC307BD39BFBC1467D8A
                                                                                                                                                                                                                                      SHA-256:43FD99E98B766FFCE88A7A6D698BB0421DB03E2C74FF241C6C00B876A1CB2262
                                                                                                                                                                                                                                      SHA-512:4309CFAFFC92C2DD61AA0E5D68470463D4C338B8C39B5EE51B674229BE585618323AB7513A0CF88DC29760980F53D75EE74CD38EF14FDCFE456372B59CF24E16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3601
                                                                                                                                                                                                                                      Entropy (8bit):5.416851089301766
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:YvEkE6KESqDxGRoHJjq2lEk1k4thVZ/gN8UC8Kw8om88uwlE2+aPe7zO:Yo6KUtjVLk4t94iU3KNoT8u8aD7i
                                                                                                                                                                                                                                      MD5:0C994779D881A0707943CBF2161D8F54
                                                                                                                                                                                                                                      SHA1:6C9A77E8E3F0E73880A2BFB2B3EDF83A92A56A18
                                                                                                                                                                                                                                      SHA-256:5379B228CE738B05BF972FE6BEAAF883FF7A101D17A9C556E0BB56DC1822E7E7
                                                                                                                                                                                                                                      SHA-512:368F15F108FBF31F853AA1948862B953BA8977445A9285BB6955F80663102715D33C91DAD1FA243385720A0EC7D05D8C053DF2F6932321B5FF5E927BC11CA417
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrUpsellToast_ = {.. UT_WSS_TOAST_TITLE: "Life online is now a necessity and hackers are taking advantage",.. UT_WSS_TOAST_TITLE_COHORT_2: "Get McAfee. Total Protection ",.. UT_WSS_TOAST_TITLE_2: "{0} against hackers in these uncertain times",.. UT_WSS_TOAST_TITLE_2_STRONG: "Take a stand",.. UT_WSS_TOAST_DESC_1_VAR_1: "Ensure your family and devices are protected with VPN, Identity Theft Protection, premium antivirus, and more with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_1_VAR_2: "The online safety of your family and their connected devices matters now more than ever.",.. UT_WSS_TOAST_DESC_2_VAR_2: "Protect them now with McAfee. Total Protection.",.. UT_WSS_TOAST_DESC_COHORT_2: "Protect your digital life with award-winning antivirus, Identity Theft Protection, VPN, parental controls, and more.",.. UT_WSS_BUTTON_ACCEPT: "Get it now",.. UT_WSS_BUTTON_REMIND_LATER: "Remind me later",.. UT_WSS_BUTTON_DECLINE: "No, thanks",.. //AV Quick scan.. AV_RED_HEADER: "We

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1260
                                                                                                                                                                                                                                      Entropy (8bit):5.754597180508003
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPy7dadSybOjRlnkggpHlnEAKETUy6fQXKb6fMocWjq1TEXWzPD:PyRaSgCLyZgfQaCMocWje4Wzr
                                                                                                                                                                                                                                      MD5:960E633BD8CA6959E90C3128A27709C2
                                                                                                                                                                                                                                      SHA1:81C7EDE6A295EFDD4EDDF88078E55C1769C66758
                                                                                                                                                                                                                                      SHA-256:9A6A1AB11EE8BE1079E61E81E69197D4C391C6BB52D13CAE88C6BA9BC7AB54C2
                                                                                                                                                                                                                                      SHA-512:50CB993D73914E21F5EE0DDBAE326353BFB9D4CE69BA1713F69813E2510E4F0261E0FDDE6126B527BBE3F7C2A45EBE867052827F056F6F52B1B15F3B454AA57F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Z.skejte aplikaci {0}",.. BANNER_RIGHT_TEXT: "Zrychlete proch.zen. internetu",.. TITLE_FIRST: "Zdr.uje v.s nep..jemn. automatick. p.ehr.v.n. vide. p.i pr.ci?",.. CONTENT_FIRST: "Proch.zejte internet rychleji pomoc. aplikace {0}. Zastav.me automaticky p.ehr.van. videa, kter. zpomaluj. prohl..en. webov.ch str.nek.",.. TITLE_SECOND: "Posledn. uji.t.n. . chcete zastavit automatick. p.ehr.v.n. vide.?",.. CONTENT_SECOND: "Aplikace {0} zastav. automaticky p.ehr.van. videa, kter. zpomaluj. prohl..en. webov.ch str.nek. Pokud o aplikaci Web Boost nem.te z.jem, nebudeme se znovu pt.t.",.. NO_THANKS: "Ne, d.kuji",.. YES_GET_IT: "Z.skat aplikaci Web Boost",.. LICENSE: "Licen.n. smlouva",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1184
                                                                                                                                                                                                                                      Entropy (8bit):5.482492244024684
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPVdSoggneOKTDy3DHZXQTDITDy3DHM1qrjgHMf8WpK8+k2fAqO:P/SojnMDkD5+DWDkD/CMf8W72fO
                                                                                                                                                                                                                                      MD5:69D94FED4FBA99F1CF9B049DEAEF6FE8
                                                                                                                                                                                                                                      SHA1:A347A4AEA5C50FC0E9FA9A4376855784EAEF8ABE
                                                                                                                                                                                                                                      SHA-256:D48E169DBBD70091336DAA5D1CFF04B647C25A98134479D6859F3AD9D4852D93
                                                                                                                                                                                                                                      SHA-512:46EE964A513F11AE77514DF99AF4F09C8FA4663A913CFBD545409531BA4586DFD9E82EAC252B1EF01B17C92B30C1665E138FD6809C09AF05E4AA2425910EF63D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Hent {0}",.. BANNER_RIGHT_TEXT: "G.r browseren hurtigere",.. TITLE_FIRST: "Bliver du sinket af irriterende videoer, der afspilles automatisk?",.. CONTENT_FIRST: "Med {0} kan du surfe hurtigere p. nettet. Vi stopper automatisk afspilning af videoer, som s.nker hastigheden, n.r du surfer p. nettet.",.. TITLE_SECOND: "Vi sp.rger lige for sidste gang: Vil du stoppe automatisk afspilning af videoer?",.. CONTENT_SECOND: "{0} forhindrer automatisk afspilning af videoer, som s.nker hastigheden, n.r du surfer p. nettet. Hvis du ikke er interesseret i Web Boost, sp.rger vi dig ikke igen.",.. NO_THANKS: "Nej tak",.. YES_GET_IT: "Hent Web Boost",.. LICENSE: "Licensaftale",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "N.r du kl

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1153
                                                                                                                                                                                                                                      Entropy (8bit):5.495095222232191
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPRPcuFic3c4kEZkxQ0jwkIWDBpfCdEIfkSWFHExBjd:PRkU3c4xZEjw1WLmhfBWFMBh
                                                                                                                                                                                                                                      MD5:F5A6AC000575B4CC1C0EA077BF55A765
                                                                                                                                                                                                                                      SHA1:0F5EA424EAA93000D639A1483B5C785381583770
                                                                                                                                                                                                                                      SHA-256:32C28E6192C02A4C49AD0F6BEAE82C6E7FE6DFDEB54F67D63BFAA25D4F7906F4
                                                                                                                                                                                                                                      SHA-512:AFDAF024ECF680BBF8BD69EDB3678356A24BED66BB0844272708DDAFC4609165B60066A86733145267FC0C375B242C402167BEE9684392850F18A2A0A96CE73C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "{0} herunterladen",.. BANNER_RIGHT_TEXT: "Surfen beschleunigen",.. TITLE_FIRST: "Wird Ihr Browser durch st.rende automatisch wiedergegebene Videos verlangsamt?",.. CONTENT_FIRST: "Surfen Sie schneller mit {0}. Wir stoppen die automatische Wiedergabe von Videos, die Ihren Webbrowser verlangsamen.",.. TITLE_SECOND: "Letzte Nachfrage: M.chten Sie die automatische Wiedergabe von Videos stoppen?",.. CONTENT_SECOND: "{0} stoppt die automatische Wiedergabe von Videos, die Ihren Webbrowser verlangsamen. Falls Sie nicht an Web Boost interessiert sind, fragen wir nicht mehr nach.",.. NO_THANKS: "Nein danke",.. YES_GET_IT: "Web Boost herunterladen",.. LICENSE: "Lizenzvertrag",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Durch Klicken auf {0} stimmen Sie Folgendem z

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1666
                                                                                                                                                                                                                                      Entropy (8bit):5.282064616720289
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPcdh0GeuxX+8PFGIPg+c8NS0I5mmiKfQOQryfRXCWkHW3M3Ny:Pah0G1+8NHc8mv46fIWkHW3INy
                                                                                                                                                                                                                                      MD5:6A5214598913E5E0C86836F9AA82E8B1
                                                                                                                                                                                                                                      SHA1:3EE9DBBDA552BC3836AB8372B0E3366E65A7D6E8
                                                                                                                                                                                                                                      SHA-256:559F33DEBB13E06BC300BE59482BEBD4CCCA3E363EB85C4BD2ADE7F28B897159
                                                                                                                                                                                                                                      SHA-512:A049CC40C94378137FB661976587EF4D91B950A1FFC7DED0C81DB32E8DBB2E2B2B0C650863CEE56E534E68F798963E9D4E168AF13C3D449C938F8E9FEC55B891
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "......... .. {0}",.. BANNER_RIGHT_TEXT: ".......... ..........",.. TITLE_FIRST: "........... . .......... ........ ........... ...... ... .............. ...;",.. CONTENT_FIRST: "............ ........... .. .. {0}. .. ........... ... ........ ........... ...... ... ........... ... ......... ....",.. TITLE_SECOND: ".......... .......: ...... .. ......... ... ........ ........... ......;",.. CONTENT_SECOND: ".. {0} ......... ... ........ ........... ...... ... ........... ... ......... .... .. ... ... .......... .. .............

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1000
                                                                                                                                                                                                                                      Entropy (8bit):5.549813933826131
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPSdHKCjkAyNRtOzeWaAb5LOze8WRSonGfQX0CWP9AVCX07ViCmO:P0/nyNRtlWhb5Ll8W2fQJWPuVCXGqO
                                                                                                                                                                                                                                      MD5:B02205916BA3CBFA8A0399E8AE79F1B8
                                                                                                                                                                                                                                      SHA1:23025C1B065DE12EA5EDAD10FC4D440E5AED7F2D
                                                                                                                                                                                                                                      SHA-256:3DD50D5CF4EFAA206C7DF541B7EE0F4FE6AF2A53ABC595F1510578C636F3EDA0
                                                                                                                                                                                                                                      SHA-512:5ECD132AF3AEAE95BB5E701630982FBC2A89249B28A72A0059B636577587CCEC46B873F6E2D279C0560218A9609CFF9925C4220394544D67BF5B7E668A3107AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Get {0}",.. BANNER_RIGHT_TEXT: "Speed up browsing",.. TITLE_FIRST: "Annoying auto-playing videos slowing you down?",.. CONTENT_FIRST: "Browse faster with {0}. We'll stop videos from auto-playing and slowing down your browsing.",.. TITLE_SECOND: "Checking one last time--want to stop auto-playing videos?",.. CONTENT_SECOND: "{0} stops videos from auto-playing and slowing down your browsing. If you're not interested in Web Boost, we won't ask again.",.. NO_THANKS: "No, thanks",.. YES_GET_IT: "Get Web Boost",.. LICENSE: "License Agreement",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "By clicking {0}, you agree to our {1} and {2}."..}..//F8D65135D741973ECA184775138DED4EF56665C3D8C55402C1A8AC65F08EC011D9BA5B55C73D3CD4C6048FADAD86B8A171670E7DCACBB74BDC8083E1BA37BE9F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1169
                                                                                                                                                                                                                                      Entropy (8bit):5.520495098382236
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPDV7dKPMce+abJtZ5hZUsMNei5hZGSHGNf9gnW+l5w3fNtJ1swx:PJRCMceXbJrnAeingfGWWwvvJPx
                                                                                                                                                                                                                                      MD5:46D026749CDEC683FBC0BFAD83E6BAB8
                                                                                                                                                                                                                                      SHA1:E03D811A5C3A9CA005437A66D094E7EAD71CD145
                                                                                                                                                                                                                                      SHA-256:A57C5946B78FFDD8A890D728536C0EF3C6D5350B9E45BFBDBF687D6BEA49938C
                                                                                                                                                                                                                                      SHA-512:782380E4FCAEED0811B190C51E48EF5B753CDC60A2507AF189D31A4489B5B869DC6092AAB25935A70D03AB869A08681893C215494946E380860D5B6F6615F37D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obtener {0}",.. BANNER_RIGHT_TEXT: "Acelerar navegaci.n",.. TITLE_FIRST: ".Los molestos v.deos de reproducci.n autom.tica entorpecen su trabajo?",.. CONTENT_FIRST: "Navegue m.s r.pido con {0}. Impediremos que los v.deos se reproduzcan autom.ticamente y ralenticen su navegaci.n por Internet.",.. TITLE_SECOND: "Se lo preguntamos por .ltima vez: .Desea detener la reproducci.n autom.tica de v.deos?",.. CONTENT_SECOND: "{0} impide que los v.deos se reproduzcan autom.ticamente y ralenticen su navegaci.n por Internet. Si no est. interesado en Web Boost, no volveremos a preguntar.",.. NO_THANKS: "No, gracias",.. YES_GET_IT: "Obtener Web Boost",.. LICENSE: "Acuerdo de licencia",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Al hacer clic en {0}, ac

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1126
                                                                                                                                                                                                                                      Entropy (8bit):5.5210627970265405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPydhtceEumJUqeJmyUe8EFXjeseZqSHGNf9gnW+l5wODpV/ra:PUhtceEumJUqePUeVtjes5fGWWw2Q
                                                                                                                                                                                                                                      MD5:3EBFD4C8B5FDDC31BD8E0D2D67F0BC28
                                                                                                                                                                                                                                      SHA1:1EE10171D1D1D4EE88FC2B959FDD48E05B4818FE
                                                                                                                                                                                                                                      SHA-256:A68B794CEEF0E6B2D67C32E5A15BD8F759F1A5C14F608F0DA82AA8CA474B1D8E
                                                                                                                                                                                                                                      SHA-512:BE12319B9C9B5CB1385A3BE737938E5B2E2D93447D7F7FAD17719BB9D05ED4990E28C403A3011B60175E5A347C2E2FA18E210121A3D5DEE46DD9FF0CF5AF8BF7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obtenga {0}",.. BANNER_RIGHT_TEXT: "Acelere la navegaci.n",.. TITLE_FIRST: ".Los molestos videos de reproducci.n autom.tica lo ralentizan?",.. CONTENT_FIRST: "Navegue m.s r.pido con {0}. Detenga la reproducci.n autom.tica de videos que hacen m.s lenta su navegaci.n por la web.",.. TITLE_SECOND: "Su .ltima oportunidad: .desea detener la reproducci.n autom.tica de videos?",.. CONTENT_SECOND: "{0}detiene la reproducci.n autom.tica de videos que ralentizan su navegaci.n por la web. Si no est. interesado en Web Boost, no volveremos a preguntar.",.. NO_THANKS: "No, gracias",.. YES_GET_IT: "Obtener Web Boost",.. LICENSE: "Acuerdo de licencia",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Al hacer clic en {0}, acepta nuestro {1} y {2}."..}..//9BF8

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1104
                                                                                                                                                                                                                                      Entropy (8bit):5.5255194375100105
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPNdI11Y5jxKjrdTcv+qjYbKjrdT7vVa6EafIWd+HXdhuXPXun:Pnc65jxKjJAfEbKjJPgafIWotIWn
                                                                                                                                                                                                                                      MD5:93B8EBE1D3311E8F9374C5CC5390F5C2
                                                                                                                                                                                                                                      SHA1:92F70415619BCBCE972B758B8C9822D5AF24EC66
                                                                                                                                                                                                                                      SHA-256:C45CDE999AB26916B9D8B681D11C8FA3D93E9B987C7D158749C8AAFC1FA71C40
                                                                                                                                                                                                                                      SHA-512:FA86952773E6D2900E20D7BA37DAB02CA3FBEF4663210A59B78F70F09717D9AF03F883206D2B7BE9487CD334ACE85A6C7C3B838567EA7C506DDFDF856698FAA1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Hanki {0}",.. BANNER_RIGHT_TEXT: "Nopeuta selailua",.. TITLE_FIRST: "Hidastavatko .rsytt.v.t automaattisesti k.ynnistyv.t videot menoasi?",.. CONTENT_FIRST: "{0} nopeuttaa selailua. Est. videoita k.ynnistym.st. automaattisesti ja hidastamasta selailuasi.",.. TITLE_SECOND: "Tarkistetaan viel. kerran . haluatko est.. automaattisesti k.ynnistyv.t videot?",.. CONTENT_SECOND: "{0} est.. videoita k.ynnistym.st. automaattisesti ja hidastamasta selailuasi. Jollet ole kiinnostunut Web Boostista, emme kysy asiasta uudelleen.",.. NO_THANKS: "Ei kiitos",.. YES_GET_IT: "Hanki Web Boost",.. LICENSE: "K.ytt.oikeussopimus",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Kun napsautat {0}, hyv.ksyt seuraavat: {1} ja {2}."..}..//59E51AE4036AFD5FA7D7C48774

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1197
                                                                                                                                                                                                                                      Entropy (8bit):5.484144531108415
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPFd4FWZ8+GS85J9gUPIk6J9gU1qqKGfvW//LYfbCV0h:Pv4gZ8+GSYJmFJmsfvWXV+
                                                                                                                                                                                                                                      MD5:00786A0D1BD66303E6D70FD5F085F898
                                                                                                                                                                                                                                      SHA1:7530E99C3F787B1A796D0212C79F66FF50162133
                                                                                                                                                                                                                                      SHA-256:2D997EE3C5F6EEBCEB6E2B76EECC21C60598CDB866E5B82271A0B0D69A9D6368
                                                                                                                                                                                                                                      SHA-512:3C11C0E4A0905BA8C4CA5E6F65B5CE17410BF1CB2262C3E27EA789ED4DB7E78AA1415EBB5F6D6BE67ABD848EFCEAD7700970DDC52AB388346CFCDFC66326CD74
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obtenir {0}",.. BANNER_RIGHT_TEXT: "Acc.l.rer la navigation",.. TITLE_FIRST: "Votre navigation est-elle ralentie par la lecture automatique de vid.os?",.. CONTENT_FIRST: "Navigation plus rapide avec {0}. Nous bloquerons la lecture automatique des vid.os pour .viter un ralentissement de la navigation.",.. TITLE_SECOND: "Nous vous le demandons un derni.re fois.: souhaitez-vous bloquer la lecture automatique des vid.os?",.. CONTENT_SECOND: "{0} bloque la lecture automatique des vid.os pour .viter un ralentissement de la navigation. Nous ne vous sugg.rerons plus Web Boost si vous n'est pas int.ress..",.. NO_THANKS: "Non merci",.. YES_GET_IT: "Obtenir Web.Boost",.. LICENSE: "Contrat de licence",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Avis de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "En

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1198
                                                                                                                                                                                                                                      Entropy (8bit):5.521381109988615
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPFd4n2vFhChN8zp42hBWxH+3wjq4CfjdW/kUkj9O:Pv4n2vbCN8V5ohCfhWbko
                                                                                                                                                                                                                                      MD5:697CCC279371EF46BBDDD851F8DA0AB6
                                                                                                                                                                                                                                      SHA1:CE725EFF7AB8B1A01C2ABAB06B2C3F629AA4E78F
                                                                                                                                                                                                                                      SHA-256:A3560162DA1663FD2CDBE8B115167F50074A9CC8EDAF2DFD4D69541B1D45162C
                                                                                                                                                                                                                                      SHA-512:04F76203BE19CF30EAF6DD9B2EC0A8D640F981100A28528CBBD54791C7F16F36B586F4135244E48862601B29AFBC063EEB471741D786159A4E80A9BE6B0FEA99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obtenir {0}",.. BANNER_RIGHT_TEXT: "Acc.l.rer la navigation",.. TITLE_FIRST: "La lecture automatique des vid.os ralentit votre navigation.?",.. CONTENT_FIRST: "Naviguez plus rapidement gr.ce . {0}. Nous emp.cherons la lecture automatique des vid.os afin qu'elles ne ralentissent pas votre navigation.",.. TITLE_SECOND: "Derni.re v.rification.: vous souhaitez bloquer la lecture automatique des vid.os.?",.. CONTENT_SECOND: "{0} emp.che la lecture automatique des vid.os afin qu'elles ne ralentissent pas votre navigation. Si vous n'.tes pas int.ress. par Web Boost, nous ne vous demanderons plus.",.. NO_THANKS: "Non, merci",.. YES_GET_IT: "Obtenir Web Boost",.. LICENSE: "Accord de licence",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1126
                                                                                                                                                                                                                                      Entropy (8bit):5.588837837657953
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPuddK6oPnF2h0fPnFvydoZSfgBoW7ZFEDdQWo8d:PAoJmyh6fgBoW7ZiOWo8d
                                                                                                                                                                                                                                      MD5:C30ABF7D968F01443B54E235A0A3DDA5
                                                                                                                                                                                                                                      SHA1:7C171AE3D596DFE0569FA45712FB55757D437873
                                                                                                                                                                                                                                      SHA-256:F17DD7277C11EFB8B5B1C1443AFCBCE57D3492AFF5B1E5A7E2936C1B6163D69C
                                                                                                                                                                                                                                      SHA-512:6FBCE2E1D89E97073BFA20BD338FCE4C6348E7C4770D47803A4806E87AE710119B03C137BD4E2F917DAFCFE0DE0FE83B269C6EAF03E972B549417598C282C335
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Nabavite {0}",.. BANNER_RIGHT_TEXT: "Ubrzaj pregledavanje interneta",.. TITLE_FIRST: "Uznemiruju.e auto-igranje videozapisa koji vas usporavaju?",.. CONTENT_FIRST: "Br.e pretra.ujte pomo.u {0}. Sprije.ite automatsko reproduciranje videozapisa i usporavanje va.eg pregledavanja interneta.",.. TITLE_SECOND: "Najnovija provjera - .elite zaustaviti reprodukciju videozapisa?",.. CONTENT_SECOND: "{0} sprije.ite automatsko reproduciranje videozapisa i usporavanje va.eg pregledavanja interneta. Ako vas ne zanima Web Boost, ne.emo vi.e pitati.",.. NO_THANKS: "Ne, hvala",.. YES_GET_IT: "Nabavite Web Boost",.. LICENSE: "Licencni ugovor",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Klikom na gumb {0} u nastavku prihva.ate sporazum {1} i {2}."..}..//FE5D

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1214
                                                                                                                                                                                                                                      Entropy (8bit):5.680300579158547
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPUXeUzUbI0mSCkFThSCfHPMDy7n7fn6ocWPwXvlx2:P6Ub06f6ocW4/a
                                                                                                                                                                                                                                      MD5:6E3551506A8E76309A982EBF8D1A7C7B
                                                                                                                                                                                                                                      SHA1:4691BD608713A916BFBDDD89FF5E08728CEF49C0
                                                                                                                                                                                                                                      SHA-256:118B17344B9ACA6BFD359396923425FFD500C2DDC65DCDB1659340B3DDCF0C72
                                                                                                                                                                                                                                      SHA-512:FF93D9377540942E1283C289831225416716FA76BCF17E3713FE04217FCAC46B3819752138CE5B7A1B6C68AE87020387C0F1C6F87F7E283A04DDED5C575404C1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "A {0} let.lt.se",.. BANNER_RIGHT_TEXT: "B.ng.sz.s felgyors.t.sa",.. TITLE_FIRST: "Bosszant., automatikusan elindul. vide.k lass.tj.k munk.j.t?",.. CONTENT_FIRST: "B.ng.sszen gyorsabban a {0} seg.ts.g.vel. Megakad.lyozzuk a vide.k automatikus lej.tsz.s.t, ami lelass.tja a b.ng.sz.st.",.. TITLE_SECOND: "M.g egyszer megk.rdezz.k: meg szeretn. akad.lyozni a vide.k automatikus lej.tsz.s.t?",.. CONTENT_SECOND: "A {0} megakad.lyozza a vide.k automatikus lej.tsz.s.t, ami lelass.tja a b.ng.sz.st. Ha nem .rdekli .nt a Web Boost, akkor nem k.rdezz.k meg .jra.",.. NO_THANKS: "K.sz.n.m, nem",.. YES_GET_IT: "A Web Boost let.lt.se",.. LICENSE: "Licencmeg.llapod.s",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1108
                                                                                                                                                                                                                                      Entropy (8bit):5.447172596588032
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPMd7T0JakK38gx/SS11ZuBWMfjkWFt8GVsVgNF3Uf:PKX0Jah37yWMfjkWFyGO0Uf
                                                                                                                                                                                                                                      MD5:71390A77D61F33E4E94E16ADC644EFC0
                                                                                                                                                                                                                                      SHA1:D7C326A214FE535923020B49366E038AE8DC262E
                                                                                                                                                                                                                                      SHA-256:4303B16511C0AB477D96A10E066C4233725A9690B11A5A712D409A068A8537BD
                                                                                                                                                                                                                                      SHA-512:1FE80D4993BFE8065C467C698513BB1990205F8B2004D14B3DF88599471B47F3225DDAF300BEA60772745F7EAB342DB5CDDD2BBBB0705ED3BBAEE792C14956D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Ottieni {0}",.. BANNER_RIGHT_TEXT: "Accelera la navigazione",.. TITLE_FIRST: "I fastidiosi video che si riproducono automaticamente ti rallentano?",.. CONTENT_FIRST: "Naviga pi. velocemente con {0}. Bloccheremo la riproduzione automatica dei video che ti rallentano la navigazione sul Web.",.. TITLE_SECOND: "Ultima verifica: vuoi bloccare la riproduzione automatica dei video?",.. CONTENT_SECOND: "{0} blocca la riproduzione automatica dei video che rallentano la navigazione sul Web. Se Web Boost non ti interessa, non te lo chiederemo pi..",.. NO_THANKS: "No, grazie",.. YES_GET_IT: "Ottieni Web Boost",.. LICENSE: "Contratto di licenza",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Facendo clic su {0}, accetti il {1} e la {2}."..}..//98A415DDEDCAD191B75617

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1276
                                                                                                                                                                                                                                      Entropy (8bit):5.9964927407212985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cl/yRv8dFdqOdsgWOep2Ht+LRvcsvifh2AWtuzU7/:VyRv4dqqspnDRvbifwAWt97/
                                                                                                                                                                                                                                      MD5:2B3D0821877EFFE54C2E66B4E5691B33
                                                                                                                                                                                                                                      SHA1:19BC212543A616F9F84E07A0ED48C92A98E2999C
                                                                                                                                                                                                                                      SHA-256:AB74BD193EF6F3833C9B3609803D810C715D9FEC313B94CBFD6EE60FD0976963
                                                                                                                                                                                                                                      SHA-512:8ADCD647C7C4DD3A7DB7564A21361C98C87AAA97EB7D9123FE72991F9C93DDD4753627B42F941778E69CEDC64E1F5B870635D26852BA1F1FE3A98979BC26EE05
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: ".....&reg; .......",.. BANNER_LEFT_TEXT: "{0} .....",.. BANNER_RIGHT_TEXT: ".........",.. TITLE_FIRST: ".......................",.. CONTENT_FIRST: "{0} ......... ...............................",.. TITLE_SECOND: "...........................",.. CONTENT_SECOND: "{0} ................................. ................................",.. NO_THANKS: "...",.. YES_GET_IT: "............",.. LICENSE: "......",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "........",.. PRIVACY_URL: "http

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1251
                                                                                                                                                                                                                                      Entropy (8bit):6.064037110640354
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cxJLqkS5WCtU2htU6iiZTjfbWIYlg8tzN:rlKi0fbWIYOON
                                                                                                                                                                                                                                      MD5:5B33D57C105C4C4C8F92BD543DEAE18C
                                                                                                                                                                                                                                      SHA1:CAB2BE8A82E58B2033FD66C38A17F087B2D6E0D2
                                                                                                                                                                                                                                      SHA-256:74D3478A0E73C8DAD9D2712A43F9DFEE70252FB4BD8553C550D13B24CD8F328F
                                                                                                                                                                                                                                      SHA-512:BA2FC567117D77EB1BEA3D6E5F79D12CA9FADCD59164AE6F8B609B26F5FA578332DA2DAE50C22FFCF20088FB524CB0A4CFDC8D8E9710BFEFA721E435091A3A3B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; . .. ..",.. BANNER_LEFT_TEXT: "{0} ..",.. BANNER_RIGHT_TEXT: ".. .. ..",.. TITLE_FIRST: "... ... .. .... .. .. ... .....?",.. CONTENT_FIRST: "{0}.(.) ... .. ... ........ .... .. .... .. .. ... .... .....",.. TITLE_SECOND: "..... ........ ... .. ... .......?",.. CONTENT_SECOND: "{0}.(.) .... .... .. .... .. .. ... .... ..... . .. ... ... ..... .. .. ......",.. NO_THANKS: "...",.. YES_GET_IT: ". .. .. ..",.. LICENSE: ".... ..",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1112
                                                                                                                                                                                                                                      Entropy (8bit):5.4862174867956455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPymdI+c1iPRRj+7+yR+2nr4rtR++Moj+wnMfQwsHWpTW:Pyoqg5QJ/etrMojMfQPW9W
                                                                                                                                                                                                                                      MD5:BB3D19049612F94A65FA7738254DAF1E
                                                                                                                                                                                                                                      SHA1:16FE419FE88D4645886A86671305B175EED2E1EA
                                                                                                                                                                                                                                      SHA-256:1733A675C3AECF0839EC3B5C8B1C54D94A9316B363561C5A7D4730C086F681EA
                                                                                                                                                                                                                                      SHA-512:A929A5AA04466A7B0D7BBAF2EFB03496AA353AE3A4AA4739CEAD1FAC7FFBC96B225017B05F1D1FF070A018F234460D31A52C5F772AD6BE38AB4C1D0481D67314
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "F. tak i {0}",.. BANNER_RIGHT_TEXT: "F. opp farten p. nettsurfingen",.. TITLE_FIRST: "Sinkes du av irriterende automatisk avspilling av videoer?",.. CONTENT_FIRST: "F. raskere nettsurfingen med {0}. Vi stopper videoer som spilles av automatisk, slik at de ikke sinker nettsurfingen din.",.. TITLE_SECOND: "Siste sjanse . vil du stoppe automatisk avspilling av videoer?",.. CONTENT_SECOND: "{0} stopper automatisk avspilling av videoer, slik at de ikke sinker nettsurfingen din. Hvis du ikke er interessert i Web Boost, vil vi ikke sp.rre deg igjen.",.. NO_THANKS: "Nei takk",.. YES_GET_IT: "F. tak i Web Boost",.. LICENSE: "Lisensavtale",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "N.r du klikker p. {0}, godtar du v.r {1} og {2}."..}..//D29A65A8924882BE30

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1206
                                                                                                                                                                                                                                      Entropy (8bit):5.445023530697215
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPMdeWjkB8UjFpXIMtRBviSqLwz4tRBviV3rEFihdEMtB2pQXbEnWtB221G+GbE:PKeWniFpYMtz1qDtzsr7djPuQQWPxGYH
                                                                                                                                                                                                                                      MD5:4AAA6EE8A72C4FC846C8C7F298C62945
                                                                                                                                                                                                                                      SHA1:3F6C9E7A183A81B7765995DE131E299B57B8E87A
                                                                                                                                                                                                                                      SHA-256:6AA4057AC45D728827E0569A9F08D77E1C40D43711548B143AB8BD09996B9C77
                                                                                                                                                                                                                                      SHA-512:78EBF8D3E0EA010B240DD44EAA0CE465E552BDFD2985336601C9D18C476EB655074DF1409FEE5FDE53D77AE20A049F3E707D019ACBF36B7D02A05D1001E22157
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Download {0}",.. BANNER_RIGHT_TEXT: "Internetactiviteiten versnellen",.. TITLE_FIRST: "Trage prestaties door irritante video's die automatisch worden afgespeeld?",.. CONTENT_FIRST: "Sneller internetten met {0}. Wij voorkomen dat video's automatisch worden afgespeeld en uw internetactiviteiten vertragen.",.. TITLE_SECOND: "Weet u zeker dat u automatisch afspelen van video's wilt stoppen?",.. CONTENT_SECOND: "{0} voorkomt dat video's automatisch worden afgespeeld en uw internetactiviteiten vertragen. Als u geen interesse hebt in Web Boost, vragen we het niet meer.",.. NO_THANKS: "Nee, geen interesse",.. YES_GET_IT: "Web Boost downloaden",.. LICENSE: "Licentieovereenkomst",.. LICENSE_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. PRIVACY: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. AGREEM

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1217
                                                                                                                                                                                                                                      Entropy (8bit):5.6736079204969325
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPGdrelNj+8d2gQwYsklKGoTE3abMfXMGGnWjM/z9pidXE:PIrevjvd2gRcljfmWj+idXE
                                                                                                                                                                                                                                      MD5:2BEC88F13935F568F2033B29FCA6E811
                                                                                                                                                                                                                                      SHA1:7B5786D555BAC4629EA7BAFF3B9F723FFBE38C24
                                                                                                                                                                                                                                      SHA-256:B4CA4F69FAEB8A40D3D9F5757D266BF74C3A0DCF8442AEFF9347AB77044AAD88
                                                                                                                                                                                                                                      SHA-512:FAF866D4051BDE6D7592D4DCBB8D96FCEB56F5FD4FE5F548E4BF3E371AFF820B7C66813D69D64D13725DCBB73871A0843E94CC48291746B17D8ABF7CB377AA00
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Pobierz produkt {0}",.. BANNER_RIGHT_TEXT: "Przyspiesz przegl.danie Internetu",.. TITLE_FIRST: "Irytuj.ce automatycznie odtwarzane filmy spowalniaj. Ci prac.?",.. CONTENT_FIRST: "Szybciej przegl.daj Internet dzi.ki programowi {0}. Powstrzymamy automatyczne odtwarzanie film.w, kt.re spowalnia przegl.danie sieci.",.. TITLE_SECOND: "Sprawdzamy po raz ostatni . chcesz powstrzyma. filmy przed automatycznym odtwarzaniem?",.. CONTENT_SECOND: "Program {0} powstrzymuje automatyczne odtwarzanie film.w, kt.re spowalnia przegl.danie sieci. Je.li nie interesuje Ci. program Web Boost, nie spytamy ponownie.",.. NO_THANKS: "Nie, dzi.kuj..",.. YES_GET_IT: "Pobierz program Web Boost",.. LICENSE: "Umowa licencyjna",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1162
                                                                                                                                                                                                                                      Entropy (8bit):5.518728235021273
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cP4djLetDhf8CL369L3yM03Byf9HWfOBIYtAqmibhn:PmjLifLq9LCMhfBWGBIYMshn
                                                                                                                                                                                                                                      MD5:5BDEFD8FF08F9D51315248BD96C7B40B
                                                                                                                                                                                                                                      SHA1:BDA2BF55056A7E02240C84D26B3579F57F67557E
                                                                                                                                                                                                                                      SHA-256:1CEC75469711CC4211272556770FECEC81659497B7CB4CEAC5911CC6DBBFF7B3
                                                                                                                                                                                                                                      SHA-512:F95BC01E688ED598B9E8ADEC3F5E09BAD00E3F8297E45EC90091EF87D1AF9E653119AE3CFB96DD5E3BD1C2D9AB18BC85713F55C5DE765B803287A3E22D65DEFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obtenha o {0}",.. BANNER_RIGHT_TEXT: "Acelere a sua navega..o",.. TITLE_FIRST: "O v.deos irritantes de reprodu..o autom.tica est.o atrapalhando voc.?",.. CONTENT_FIRST: "Navegue mais rapidamente com {0}. Interromperemos v.deos de reprodu..o autom.tica que desaceleram sua navega..o.",.. TITLE_SECOND: "Conferindo uma .ltima vez. Deseja interromper a reprodu..o autom.tica de v.deos?",.. CONTENT_SECOND: "{0} interrompe v.deos de reprodu..o autom.tica que desaceleram sua navega..o. Se n.o estiver interessado no Web Boost, n.o perguntaremos novamente.",.. NO_THANKS: "N.o, obrigado",.. YES_GET_IT: "Obtenha o Web Boost",.. LICENSE: "Contrato de Licen.a",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Ao clicar em {0}, voc. concorda com

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1147
                                                                                                                                                                                                                                      Entropy (8bit):5.4990982589118955
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:6dJkfeI3duQBCXV9j8/TfYGCAVXAxuQ3oKtcnEheASulWZhHjDkE6pRY8gHwGbqk:6cP3dWF+fYGGxf5SQ03x6Sf9HW3XRot
                                                                                                                                                                                                                                      MD5:3602E681589DD5DCEF557A99CC44E08B
                                                                                                                                                                                                                                      SHA1:0BB1B6DB4134E6E6A9E7676903715C4F0C7DEB4A
                                                                                                                                                                                                                                      SHA-256:4F0E91755CF4BAE8F8F20A8F85FE18C6A6978AFD460D57DBCEA5FCC56BA320CA
                                                                                                                                                                                                                                      SHA-512:0C50093636F502701BB10C77027285F99E5CFEE7099E819F226ABC199167091BE6A5CE32BFDB47F5EC57032DD54B735197CBCCB268EE64F9DF0711443B7B3922
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Obter o {0}",.. BANNER_RIGHT_TEXT: "Otimizar navega..o",.. TITLE_FIRST: "A reprodu..o autom.tica de v.deos . inc.moda e atrasa o seu trabalho?",.. CONTENT_FIRST: "Navegue mais rapidamente com o {0}. Impediremos a reprodu..o autom.tica de v.deos que reduz o desempenho da navega..o.",.. TITLE_SECOND: "Vamos confirmar mais uma vez, pretende impedir a reprodu..o autom.tica de v.deos?",.. CONTENT_SECOND: "O {0} impede a reprodu..o autom.tica de v.deos que reduz o desempenho da navega..o. Se n.o est. interessado no Web Boost, n.o perguntaremos novamente.",.. NO_THANKS: "N.o, obrigado",.. YES_GET_IT: "Obter o Web Boost",.. LICENSE: "Contrato de licen.a",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Ao clicar em {0}, aceita o nosso {1}

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1673
                                                                                                                                                                                                                                      Entropy (8bit):5.252911903862384
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPMd9+PJr6H30J3vlfL4qR30NZHxsVyY3DM30NZH6Xho4qs35sngONfQrWWe8QP:PKgN6a39f9+sVX0Rws35BONfQrWW6CAj
                                                                                                                                                                                                                                      MD5:3116F284C93C3BA05D9A907C79F9633E
                                                                                                                                                                                                                                      SHA1:D11D8592399947F636B2BCB9E5E9E0D88B10B12B
                                                                                                                                                                                                                                      SHA-256:F9547B095649539BF3ADA4252B0F6F3B04AA790C127B07FFE940E41568525D57
                                                                                                                                                                                                                                      SHA-512:2E683D434537537555DC1EC404780B20678A6A868B9EB0305341B9D29C28D9F0A1F5DF799F973C967CC252E99E92713B66BB80683775195698C745E982174F3B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "........ {0}",.. BANNER_RIGHT_TEXT: "........ ........ ........ ...-......",.. TITLE_FIRST: ".......... .............. ............ ..... ...... ........?",.. CONTENT_FIRST: ".............. ...-........ ....... . ....... {0}. .. ........... .............. ............ ............, ..... ........ ........ ...-.......",.. TITLE_SECOND: "........ ....... .......... ............... ............ .....?",.. CONTENT_SECOND: "{0} ......... .............. ............ ............, ..... ........ ........ ...-....... .... ... .. .

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1171
                                                                                                                                                                                                                                      Entropy (8bit):5.763442890458303
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPGd2mcJsq8vMi8zJ0+46fQXwWjelfEo:PINesPtKFfQAWjw8o
                                                                                                                                                                                                                                      MD5:B7A37F1BF80F61011A2775C6FFB37669
                                                                                                                                                                                                                                      SHA1:BA0A56B09D9AF8CB900CFAF36EB7F532983DD690
                                                                                                                                                                                                                                      SHA-256:EABFCFA5D1E834B5924F9C77D95E1F548A46C8254F2E35BA6BCFFBED5AC1CAD1
                                                                                                                                                                                                                                      SHA-512:737863C7F0C0143BC9FFDB8ABE11B36432E7E74E53F1E764C70C1C308F9308A916FFDBA2426BE4CEA6E88F0B8431C2512C1A972B680C758EF0C9B734AEC6B044
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Z.ska. produkt {0}",.. BANNER_RIGHT_TEXT: "Ur.chli. prehliadanie",.. TITLE_FIRST: "Spoma.uje v.s otravn. automatick. prehr.vanie vide.?",.. CONTENT_FIRST: "Surfujte r.chlej.ie s {0}. Zastav.me automatick. prehr.vanie vide., ktor. v.s zbyto.ne spoma.uje.",.. TITLE_SECOND: "Naposledy sa p.tame: Chcete sa zbavi. otravn.ho automatick.ho prehr.vania vide.?",.. CONTENT_SECOND: "{0} zastav. otravn. automatick. prehr.vanie vide., ktor. v.s brzd.. Ak nem.te z.ujem o Web Boost, nebudeme sa op.ta. znova.",.. NO_THANKS: "Nie, .akujem",.. YES_GET_IT: "Z.ska. Web Boost",.. LICENSE: "Licen.n. zmluva",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Prehl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Kliknut.m na tla.idlo {0} ni..ie vyjadrujete s.hlas s

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1112
                                                                                                                                                                                                                                      Entropy (8bit):5.5776373584103105
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPud3hBmY2dFwHPhtDmY2dFWoZ1fjjWxnFI:PA3hBmY243mY2HfPWxnFI
                                                                                                                                                                                                                                      MD5:86B1D7B32D84FA4565C28FC1CF52B08B
                                                                                                                                                                                                                                      SHA1:EA006DD7FB5A359F5F7EF2CCAF78FDB7EA900B00
                                                                                                                                                                                                                                      SHA-256:CF24F9B99E3B3D73E5A5A2422C709841F8B0299F2C88EC5428BD2866AFFB4BD4
                                                                                                                                                                                                                                      SHA-512:04A4795C8FDE3214AF7E4397FB3E98E2FF945D8FBB03A0DAB2D5441C3B4BFBC6BBE6EB48DDEEF894F7787DB085A6EBD91440168F5CAA351E955578C3ABF5FDBF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "Nabavite {0}",.. BANNER_RIGHT_TEXT: "Ubrzaj pregledavanje interneta",.. TITLE_FIRST: "Uznemiravajuc.e auto-video snimke koje vas usporavaju?",.. CONTENT_FIRST: "Brzo pretra.ite {0}. Spre.ite automatsku reprodukciju videa i usporavanje va.eg pregledavanja interneta.",.. TITLE_SECOND: "Proveravate li poslednji put - .elite da zaustavite automatsko reprodukovanje video zapisa?",.. CONTENT_SECOND: "{0} spre.ite automatsku reprodukciju videa i usporavanje va.eg pregledavanja interneta. Ako vas ne zanima Web Boost, nec.emo ponovo da vas pitamo.",.. NO_THANKS: "Ne, hvala",.. YES_GET_IT: "Nabavite Web Boost",.. LICENSE: "Ugovor o licenciranju",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Klikom na {0}, prihvatate {1} i {2}."..}..//68E5B7A5FE6CE23202

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1116
                                                                                                                                                                                                                                      Entropy (8bit):5.601123291842388
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPYodlhp2AtRW5Tm0XECCyK45Tam0XEEHh6qrTojI/HfMXGWNIMJ9fGaW:PYWXYAbWRmsEkTamsEEBbHYIffRWqMnQ
                                                                                                                                                                                                                                      MD5:FC7B6C2917D070BC1F4B01A2D2920927
                                                                                                                                                                                                                                      SHA1:C10A8A5546A785F4FDEA0E89D6E84357EBAED56C
                                                                                                                                                                                                                                      SHA-256:A1281BBAA3ED4B4D341208278C57E0210CD9AF0CAA942304D63E0519E8FB3054
                                                                                                                                                                                                                                      SHA-512:82DF5916D550C8FB93AA260F90B731B8A5365905A664AB53C2A61FFC5654A7B7ABAECF108A91C1F17D7DE4638E606FABC99A4D550A0D4CDFAD70BA10569F0E58
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "H.mta {0}",.. BANNER_RIGHT_TEXT: ".ka hastigheten p. surfandet",.. TITLE_FIRST: ".r datorn l.ngsam p. grund av st.rande automatiska videoklipp?",.. CONTENT_FIRST: "Bl.ddra snabbare med {0}. Vi stoppar videoklipp fr.n att spelas automatiskt och sakta ner ditt webbsurfande.",.. TITLE_SECOND: "Vi fr.gar f.r sista g.ngen . vill du stoppa automatisk uppspelning av videoklipp?",.. CONTENT_SECOND: "{0} f.rhindrar videoklipp fr.n att spelas automatiskt och sakta ner ditt webbsurfande. Vi fr.gar inte igen om du inte .r intresserad av Web Boost.",.. NO_THANKS: "Nej tack",.. YES_GET_IT: "H.mta Web Boost",.. LICENSE: "Licensavtal",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "Genom att klicka p. {0} godk.nner du v.rt {1} och {2}."..}..//D45519A94E74D9

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1173
                                                                                                                                                                                                                                      Entropy (8bit):5.660515276527873
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cP/XRGHmeqM6+bBNLefXtexcJYOEvKxUew53ksNefXtexcJ6dp7hVE9tClfs2QI:P/XRGHmelbBFevBuv7ew53NevBS1nwOd
                                                                                                                                                                                                                                      MD5:C9934020570EAEB85F6C15A27D7A2EC9
                                                                                                                                                                                                                                      SHA1:EEC4A4CF0538B5F95E57C0DFB8484C96A2DB0B39
                                                                                                                                                                                                                                      SHA-256:57003DA60BE93C88C2A86844B2CF7F0E3E0BF0162E0F4D4CA3A3A49EC5284297
                                                                                                                                                                                                                                      SHA-512:CF888DE52D80132DB8CDA0D82B0013832695A340FD621C2B600A5E6F9D2A1A4C6171FFF816538622E3FF9E14BD1739838ED7BA609DEFE268F6C300F95AE9A85C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: "{0} Uygulamas.n. Edinin",.. BANNER_RIGHT_TEXT: "Web'de gezinmeyi h.zland.r.n",.. TITLE_FIRST: "Otomatik olarak oynayan can s.k.c. videolar sizi yava.lat.yor mu?",.. CONTENT_FIRST: "{0} ile daha h.zl. g.z at.n. Otomatik olarak oynayan ve web'de gezinmenizi yava.latan videolar. durdururuz.",.. TITLE_SECOND: "Son kez soruyoruz, videolar.n otomatik olarak oynat.lmas.n. .nlemek ister misiniz?",.. CONTENT_SECOND: "{0} otomatik olarak oynayan ve web'de gezinmenizi yava.latan videolar. durdurur. Web Boost'la ilgilenmiyorsan.z tekrar sormayaca..z.",.. NO_THANKS: "Hay.r, te.ekk.rler",.. YES_GET_IT: "Web Boost'u Edinin",.. LICENSE: "Lisans S.zle.mesi",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "{0} d..mesine t.klayarak {1} ve {2} ko.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1062
                                                                                                                                                                                                                                      Entropy (8bit):6.4119167829165145
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cyPdC/0RFVLakZxaoK4K1nfmHWMm3YeWah+AJh+Wh:yVC/0VLvLVSf4WMPrnKhx
                                                                                                                                                                                                                                      MD5:3CD06E88E15FF98D8391BD86F1FDA2EA
                                                                                                                                                                                                                                      SHA1:E455E6C282719B118F2623613167B50CA49BABFD
                                                                                                                                                                                                                                      SHA-256:2260024B17B0557DD2326B84844CDAAF2DE6A5D8D06948F7A76C57F82D88E108
                                                                                                                                                                                                                                      SHA-512:E0505EAD0398917A72EB35A5CFE6BDB1976AA3CAB6F708D919E9A77F013689498D01BC93BDE07689E05D747827FF459ADAEA689BAD680D90A455F6BD5AB0772A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "...&reg; Web ..",.. BANNER_LEFT_TEXT: ".. {0}",.. BANNER_RIGHT_TEXT: "......",.. TITLE_FIRST: "....................?",.. CONTENT_FIRST: ".. {0} ........ ........................",.. TITLE_SECOND: "....... - ...........?",.. CONTENT_SECOND: "{0} ...................... .... Web ...............",.. NO_THANKS: "....",.. YES_GET_IT: ".. Web ..",.. LICENSE: "....",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "...{0}.........{1}...{2}.."..}..//49C08407A461F0F4341EC1249DD70C00EE937DDF530A963B6AA37CB5CCEF3C000EA2

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1018
                                                                                                                                                                                                                                      Entropy (8bit):6.385013856686841
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6cPGdRXudZh7df/9cIDlcFesbfOKU6D8Gfg1WJ9ru15:PIBudv5H9cIDMy9opfg1WJ1m5
                                                                                                                                                                                                                                      MD5:66F58354005953E975924C7476823DAF
                                                                                                                                                                                                                                      SHA1:448C8F62F3FFD1AEACFF06F4DD7BF50547742C1F
                                                                                                                                                                                                                                      SHA-256:390FC07E48BC101B34CB6A8D4D2DEAEA2F802309C5DB4811BB3EDDC2E16A5A24
                                                                                                                                                                                                                                      SHA-512:3568E711CF9DEEA27FAE112A4EA969BB911A78E5BB08411017B2129FE2D456A50158832E0EC02D891BA32790D587B66AF9924D1BC99243454BF2041AAA7270C7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.var _lrWebBoost_ = {.. MCAFEE_WEB_BOOST: "McAfee&reg; Web Boost",.. BANNER_LEFT_TEXT: ".. {0}",.. BANNER_RIGHT_TEXT: "....",.. TITLE_FIRST: "...............",.. CONTENT_FIRST: "..{0}....... .....................",.. TITLE_SECOND: ".....................",.. CONTENT_SECOND: "{0} .................. ... Web Boost ..............",.. NO_THANKS: "......",.. YES_GET_IT: ".. Web Boost",.. LICENSE: "....",.. LICENSE_URL: "https://www.mcafee.com/legal",.. PRIVACY: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. AGREEMENT_MSG: "...{0} ......... {1} . {2}."..}..//64A54E09939C5A9134A3AB3BB857DA7CD7A7CB5C5AB8CC3B06C4B387BE265CF343DAF17A7D5EAA226C2556488C566E470553061B48EAA4C1

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-cs-CZ.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.25444060957449
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+Jb0j:+sv+K5+CtTFCqsUz0AUoey+uj
                                                                                                                                                                                                                                      MD5:9FF0840E4C5374F9510CA299B4C9E391
                                                                                                                                                                                                                                      SHA1:EC643008CF6EC8BBAD2E39646A689B8E80215523
                                                                                                                                                                                                                                      SHA-256:AC58382527D31FFCBCBEF915EF8DD02ED91F4D8E756850FDCA37EDE67D50F77B
                                                                                                                                                                                                                                      SHA-512:120D3BCEA3A9EDEB19E1BF85AC2776A716FB98474304F36F746F67E30E5A7FF8C5215CE6E464082EB94315D253B9FFC313930DCADCA69B47CF574FAF63014AB3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-da-DK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2532454752635465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+wxPe:+sv+K5+CtTFCqsUz0AUoey+42
                                                                                                                                                                                                                                      MD5:1574B59CF396C9A2AD5FDEDC28DA633F
                                                                                                                                                                                                                                      SHA1:8F38EFF1CDD271D055C26881E9AE8A61B3A45EBD
                                                                                                                                                                                                                                      SHA-256:AC6638D65E6B7982719EA2445EC6597467CD4F2F952159FD01511C1EC038DC2E
                                                                                                                                                                                                                                      SHA-512:4C13CEC66530B955BCA421FBDE6E99739841C7E90F05AC9F84691C8EB89215B68018A93F6D29B8B85107DDCC0940AC6C4525EEA0449C940A476F8CAE6EFCCC6D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-de-DE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.26563931741394
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+KS:+sv+K5+CtTFCqsUz0AUoey+/
                                                                                                                                                                                                                                      MD5:C1E94F302E6591BC7CF8FC0B24C8CBFE
                                                                                                                                                                                                                                      SHA1:A4786A41B62B9B0311355973EB08F9AE3EBCA43D
                                                                                                                                                                                                                                      SHA-256:9AC462F71A6D9166546814A94997E7388ABEF2583DD90D2A43B354D6AF53B730
                                                                                                                                                                                                                                      SHA-512:F69009182B780707CC0DB825620999F577FD9E7DDDBB4D45ADC5718A8B6843F6B1E622664E3C7F1AA6505C275E038D66932148F62302A0B25F667C4DCFF99AB1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-el-GR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2499220937560205
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+CtTn:+sv+K5+CtTFCqsUz0AUoey+Cl
                                                                                                                                                                                                                                      MD5:497E44075EC3C6964DB59457A8B1B223
                                                                                                                                                                                                                                      SHA1:C2655435B421B6669297B05782CAE19D90782BB4
                                                                                                                                                                                                                                      SHA-256:FA7F9024E1C48670969F3B23005E9091B8C480A640DFC4649629769D9B69A106
                                                                                                                                                                                                                                      SHA-512:80FF65F0B503A6C34180961317A06EA26A65200A27F4FADE107676F3DD9921CD17119D843B94E235B6E941B9B9BB298664552C151E12CB5782882C3FBD892B2C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-en-US.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.243266602213208
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+cK:+sv+K5+CtTFCqsUz0AUoey+cK
                                                                                                                                                                                                                                      MD5:D7312080A80B0500E15A85FEF7232A47
                                                                                                                                                                                                                                      SHA1:0315B5CA4EB059396FDBEE7DFC2D34A699CAC84B
                                                                                                                                                                                                                                      SHA-256:B937CE2BFB9473D3AB0393B99CA678206E1F2CBA86F949FCF33EB27CF4AE8075
                                                                                                                                                                                                                                      SHA-512:0DBDBB00067B15849FC53489A302BA2E030E07F2C1D9C706E83D853572C480D4288A1CA067E4853812BB1B879F9E2A4937D271E7ED20A09896456716CE2978B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-es-ES.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.250696425957449
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+gJ:+sv+K5+CtTFCqsUz0AUoey+I
                                                                                                                                                                                                                                      MD5:E59186A282F1CC2D32C402346EDE7C26
                                                                                                                                                                                                                                      SHA1:EB6966A9C610198D2C89D4E2E076007CFBBC047D
                                                                                                                                                                                                                                      SHA-256:41E557D485346F535E109A6EBE8B33C593349C3160DB937C915FB7860048A861
                                                                                                                                                                                                                                      SHA-512:4A3A26E8B6E01A34D3A1A32B41EC65342D558CEA23C1193A01D50CF784CCF78E7B7C4C6C4693392FEE45B1EB2E435EB78509AFAC24A0705A73AC9E5FC61A20B0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-es-MX.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.265257639782756
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+QiWDH:+sv+K5+CtTFCqsUz0AUoey+/sH
                                                                                                                                                                                                                                      MD5:4B8F8AACE43200520CC90A6F993F0678
                                                                                                                                                                                                                                      SHA1:8043122F124589EC5F21B37CD411F6470E9695C7
                                                                                                                                                                                                                                      SHA-256:04AA5C603EEA688303420EA12E4358EF28933AA41305E8D2C7C16741E14204F9
                                                                                                                                                                                                                                      SHA-512:53FB65E8C2D6E4ED98062F5E1C943210A929B749CF048C2EC8963E25E889FDD26CB39AA302CB536E995272915B1AC2C3FF912EF6F1B9C85EB1EA1BC0EFCD26FC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fi-FI.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.258251898892065
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+S:+sv+K5+CtTFCqsUz0AUoey+S
                                                                                                                                                                                                                                      MD5:53F0F412D0E225E4E463F516A1DBF9C9
                                                                                                                                                                                                                                      SHA1:4A5ED14B479D5DC0EFC731D7093D8F14858E6A36
                                                                                                                                                                                                                                      SHA-256:1FA0A1D588EE553E0E9A14DF90A2AEB0AB12D991F17C6487B27316E39B205CBB
                                                                                                                                                                                                                                      SHA-512:0562BC1EE777306E1BE12D19CEC36096239BD455311B85FD117D92DC053795F4F75F8EAEC3194C192CFDE1027F98C276CEEBCD7EABA07B649E0447CC26FE8AF8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fr-CA.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.254812378549176
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm++Cut:+sv+K5+CtTFCqsUz0AUoey++Z
                                                                                                                                                                                                                                      MD5:B20EFB148ADE478056081E7E156558BB
                                                                                                                                                                                                                                      SHA1:4A0F047BA6E68BD9A7725B330413152963E2DA7B
                                                                                                                                                                                                                                      SHA-256:A261BA0069F2311B1C2F2D5E5388DAB077741635621D4230ED50783BFBD79DF8
                                                                                                                                                                                                                                      SHA-512:4035759314C945DE8DBBE60797283BE8F959501AA7FC9FC4504248234DA92F5DB7B4BE836912968A966B83ACDF9BE3797B4F8F809504305F2B0BB443DE55BED2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fr-FR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2583485711034355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+gO3:+sv+K5+CtTFCqsUz0AUoey+h3
                                                                                                                                                                                                                                      MD5:A867503CD7ACD8C4368B6C8276724C11
                                                                                                                                                                                                                                      SHA1:D31A8724B1576D72B608FEC71EC663371FD939C0
                                                                                                                                                                                                                                      SHA-256:A7DBE18B8104B7278E0E30FEF8D6FF981EC52D7B7D22AE14BFB248E1233386A1
                                                                                                                                                                                                                                      SHA-512:70FA6E06554B883A644AD176A4F58B992CAAB339E7DE2D53D2E2B9E1B5F34E1BF18D6D85B6F6D3BF16FB8901866E5DF6602558ECD7F6A27F6F54A7EF5AB4FD46
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-hr-HR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.254337718481135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+bX6:+sv+K5+CtTFCqsUz0AUoey+G
                                                                                                                                                                                                                                      MD5:6B36616CBAFCBED40D9EB33FFDC4341B
                                                                                                                                                                                                                                      SHA1:458FC07A542E27A1D0345E16598F85AF6D84923D
                                                                                                                                                                                                                                      SHA-256:20AB0077D8F1255021F065AD216C3FC63797DFAD6B4529E9652509D85E06645D
                                                                                                                                                                                                                                      SHA-512:65517FA212F866BD3CBC1FE8026241D9395C060E5A7F8745DA59F0E60E7279E7E4BC4E5C7043A36ED735EA1551AFB5998644F0583AD50350C4143B24C4CB99BE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-hu-HU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2625577539374495
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+urR:+sv+K5+CtTFCqsUz0AUoey+urR
                                                                                                                                                                                                                                      MD5:F9624EABDF41A451BCDB751B7DEB11AD
                                                                                                                                                                                                                                      SHA1:08F5FF926A40C7DFAAB832805CD66C12363AECF9
                                                                                                                                                                                                                                      SHA-256:6CBB5CB3135887868BA7712D84E2479FBE8968A7A44195BC7F97674B602478DC
                                                                                                                                                                                                                                      SHA-512:9B4CB1D76FCBB46B46D589703039D15B664759CF0F9E7B9A5353FD71FC555B7E0B0BE5596DAE4143A1607979E8A5B9EAB6AE6849A8A07AD835A49CF1B139EC13
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-it-IT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.25108209866081
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+VI8Yrx:+sv+K5+CtTFCqsUz0AUoey+grx
                                                                                                                                                                                                                                      MD5:422781D3C61E3141B09A720EF8F0C65E
                                                                                                                                                                                                                                      SHA1:13FD1DEC703F89528694BE9AB92C8DC332F6CB2C
                                                                                                                                                                                                                                      SHA-256:C370A634BDD112AAB248A2511616F9740D9DE02403F86CE648A436270EEBC6C7
                                                                                                                                                                                                                                      SHA-512:49D21321AE9234B45C45BA72B19E9EE74EC52E132A0DBA9481392FF0042BC0912D2FAABAD847C887DD5EFF2F1B0718EE6FD1D79DACC4AB1361D37CD3743051D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ja-JP.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.265981496655582
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+XaC:+sv+K5+CtTFCqsUz0AUoey+r
                                                                                                                                                                                                                                      MD5:2E71BB3C06EF3A19DAD806128A7EB9BF
                                                                                                                                                                                                                                      SHA1:809F4215A513770797CBD937952E76E30B14448A
                                                                                                                                                                                                                                      SHA-256:36E88C29A71987A2843A9B4AA9797F1D42BDBBFAF64DD27322D8C43EB8AC97A2
                                                                                                                                                                                                                                      SHA-512:AF7D59CCCB9338340FC57656C42BB08133F62ED2025267C8CE79A9DC640567CFA36C511980A07127B0BFCF7547E66E822EBDAE846CB10B2CC3AD57EAF9D334E3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ko-KR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.259416151331059
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+ngV/:+sv+K5+CtTFCqsUz0AUoey+4
                                                                                                                                                                                                                                      MD5:05E3FA9D152FDCC30AA589FE4AFBB027
                                                                                                                                                                                                                                      SHA1:A3E854E4F60E6969797C9D50390CFB8C2BCC08A6
                                                                                                                                                                                                                                      SHA-256:ABED2576057201A6EE6215BBD7DEC8F8725011349B7CCBC7B0112E12CC2543F3
                                                                                                                                                                                                                                      SHA-512:BCA45F6BA662B812CAEF9C5B6EE70C7A786A7CDC6981BFED93C9DA154D956E6E78848716F1251990AC033C0D10C2F032174C5D8BFDA31E49612A014D50D78019
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-nb-NO.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.252748587133753
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+j7mQ1AC0O:+sv+K5+CtTFCqsUz0AUoey+jS6
                                                                                                                                                                                                                                      MD5:5015C8E02697436D076CF8D5AA5AB4B9
                                                                                                                                                                                                                                      SHA1:462F510E72BDCC9B8B77B8D0FC211EB45005BDEF
                                                                                                                                                                                                                                      SHA-256:A5EF6E08D20A48D3ED2C243DD2D750FB312CFB38EB631043A47E6D0FEFD6F58D
                                                                                                                                                                                                                                      SHA-512:73E795189BE3D53DD39DC376D2DF966469DEB0AEBEC32D425EB3A748474A53E33909A09E5AB117C81C9A31B88FCFC2F2E09166421B1C08C414D133E4B1B436DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-nl-NL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.247024049910334
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+ZApBd:+sv+K5+CtTFCqsUz0AUoey+kd
                                                                                                                                                                                                                                      MD5:4C559B09402FC72CF0039F9449875F7B
                                                                                                                                                                                                                                      SHA1:438D5D0009E0FDF3B690B1F7D11EDF405488085A
                                                                                                                                                                                                                                      SHA-256:C3D11AED36D63D5CCEDC7B35C7CFEE98888E44B9FA6A3635604D8BFD40F5121E
                                                                                                                                                                                                                                      SHA-512:0DB9BE361233024FEBD61AB7FB38423005074E5B48AE1C148ABD7B3492233367D8B804B9764C935787E80F4B581406DCD5096425BC14DAD509C400C60395AE8B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pl-PL.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.261588271944215
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+g2UJ:+sv+K5+CtTFCqsUz0AUoey+g2UJ
                                                                                                                                                                                                                                      MD5:935332DD32ED7AC4EA801D8DC0618E39
                                                                                                                                                                                                                                      SHA1:7C85828C6F246F4147248294B3C16B828EAA5C1F
                                                                                                                                                                                                                                      SHA-256:871643D98D408C3F5FC48C9669694F6137820C43042E7168D7D06D9D7AE88AEC
                                                                                                                                                                                                                                      SHA-512:44B31516E6A2B1B73818D943AB13978E51A2F74084CA28833F86FF8A234C353FB4EC85107513D57F1F386B4C779C8D2B96B40AFFF849B3FACF3ACE09E0784AD3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pt-BR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.261881224001805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+wxZi:+sv+K5+CtTFCqsUz0AUoey+wPi
                                                                                                                                                                                                                                      MD5:33F4F0C1F2713CCD8F6A4C52F4C9E49C
                                                                                                                                                                                                                                      SHA1:843C946D369FDA781A2327A01624E5A9F72E811B
                                                                                                                                                                                                                                      SHA-256:FBC00CA81968C58F40ED0E8217390D81BDA0EEB0E0AC8775750C1E8B025A6860
                                                                                                                                                                                                                                      SHA-512:4421271F273EAB389493AA61AD05A029C3FDCB46533C524C91EC9B6C5C25A149891683B826BE204E0192E0198FD226999E0E25A7E3ECC97C85C61CF553849F24
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-pt-PT.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2655188555078665
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+wcI:+sv+K5+CtTFCqsUz0AUoey+wz
                                                                                                                                                                                                                                      MD5:84F33CE44F54CA624E94DDD30FC47128
                                                                                                                                                                                                                                      SHA1:D28AF13994841FFBB22CBD9FA18996F45C0915BE
                                                                                                                                                                                                                                      SHA-256:91F08518A1C9FD5CDF0782840B46EA72E599BD26E80327C505BC1D9F283AAFD4
                                                                                                                                                                                                                                      SHA-512:9E79595536021839A68385A8BF88F4829717475E43E23E2C882C1B56D28DAC39D99E9B529C5D137B488F4B024DBBC97BC120B0125D3079E47EC969130DEBA745
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-ru-RU.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2542428100556355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+bnP5:+sv+K5+CtTFCqsUz0AUoey+jP5
                                                                                                                                                                                                                                      MD5:06B4D0116712B169787D48E111692A2B
                                                                                                                                                                                                                                      SHA1:1EA4E01C932501ECAABA1160AECDAABDD9FE55B2
                                                                                                                                                                                                                                      SHA-256:3A83E52ACA9DBEB18E8CD11CC2C056FAD00F03DFFDB83462EF710007E0DD610D
                                                                                                                                                                                                                                      SHA-512:7AB8D7CCFF9AC30A5917271CD0DC0DB608D55422CFB5ACC179A693D5152154CEF91A48C34D8E9535455B27B368E85A237026F8A3AAB881EDF6952D9665C56F32
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sk-SK.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.250190768707083
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+OzI:+sv+K5+CtTFCqsUz0AUoey+j
                                                                                                                                                                                                                                      MD5:BD62E302B565104084BB2E8C9BBE5F47
                                                                                                                                                                                                                                      SHA1:532D805EA4391A405B7F18982CBB30301D45A5BE
                                                                                                                                                                                                                                      SHA-256:D0434948E2A7FCD0B4D07734DB528D7989892E7FEA1A2C1BFF4B3A0D47C16517
                                                                                                                                                                                                                                      SHA-512:3AA9D3B0BC564BEC1B000BADE3331901A064C963BCA0EFB3A8E00CD6C9737BDFB96FEC7B79B5C45CCFD02FD773B2BFFF34D24150838AF75AC994507161A25F49
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sr-Latn-CS.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.262592634159151
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+dPEM:+sv+K5+CtTFCqsUz0AUoey+FN
                                                                                                                                                                                                                                      MD5:B99337AF6B861F2E45EB0EE26CEB937A
                                                                                                                                                                                                                                      SHA1:C125913F059CF9A8EB8A091E7140318BBEA85591
                                                                                                                                                                                                                                      SHA-256:3386411C7990A899DCDD075392D0212AF01FD35489ACF1E41C717895093B37E6
                                                                                                                                                                                                                                      SHA-512:E733F350212206B0F29B5222D2B218FCD53D579CACB63AF36EA8A29F8B4B2F0989DD2E59DEFCF148BEA614D6940AA509505CEB1FD06812D58129AFDB03B09C36
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-sv-SE.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.2645985951773655
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+EM:+sv+K5+CtTFCqsUz0AUoey+EM
                                                                                                                                                                                                                                      MD5:3A39DF7AC5CB324057E1EADE44C33A62
                                                                                                                                                                                                                                      SHA1:041831C8F4A816E0AE554D841573B96EC8DDA23F
                                                                                                                                                                                                                                      SHA-256:DDA4366D6F5D5B28DF1090839E22E1A09C51E1009782A01059864F59F6D1F73C
                                                                                                                                                                                                                                      SHA-512:82570FDF8AFD3B88B05495AC0B98543F61597F5E37987108A74F8B34C552A8D1169EEA45D9DA864F135C788710B4DBB6F6355A5E885B3FC1CED82DE1C1B6EB29
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-tr-TR.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.264767868747017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+rDkEZY:+sv+K5+CtTFCqsUz0AUoey+3O
                                                                                                                                                                                                                                      MD5:9721A8A972265178A904F6479558C78A
                                                                                                                                                                                                                                      SHA1:3522F69A983130C2B2337792B5A1DBBD45AEAEC9
                                                                                                                                                                                                                                      SHA-256:9F887388FDB7E8DF8942BD925438B150CEA841E198BBD72B663E11F6E404B0A2
                                                                                                                                                                                                                                      SHA-512:C03BB5633CB390AF3823ED730D2C08855EE940875717F0D61CD3C3BC6D1D4D53836F8435D8A64B6337D06E5BC66B8A90578447D98A6078053B771FC41852315D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-zh-CN.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.249175073480621
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+tFk:+sv+K5+CtTFCqsUz0AUoey+nk
                                                                                                                                                                                                                                      MD5:D93BB99E0CA3E214460A1CAD9E6406F6
                                                                                                                                                                                                                                      SHA1:CA8EECFDD9847BB1EA08A49B1DA5395CF4598A3A
                                                                                                                                                                                                                                      SHA-256:3DFD01245A5D9E57B52027B62E5EC90E8A2E77544D46F0A5531BF15C296076C8
                                                                                                                                                                                                                                      SHA-512:E878142D179451DD0822ED4CBE18B9DBFC16B081A28EBB7E81B414EC9881A4E3D8F4D026F5DF5F729E6657489D15C6F7FE0095C8D70A97C466A264575DB2DB47
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-zh-TW.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2380
                                                                                                                                                                                                                                      Entropy (8bit):5.262866395958329
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:atsGm+KQfpzm+RkPlLnFSpqsbSjufrW0GtUoefLm+QXQ:+sv+K5+CtTFCqsUz0AUoey+WQ
                                                                                                                                                                                                                                      MD5:EA03F290A6673E896A7DFFF93E74D8AF
                                                                                                                                                                                                                                      SHA1:F948D593126680BAD542E2B99DA3E1B988D819D7
                                                                                                                                                                                                                                      SHA-256:83A15F44D155D46D500DE69225F4B591D45CA750EE991FCEA96262CF9A752C42
                                                                                                                                                                                                                                      SHA-512:C97D6D5441946A2EBBF6E49E781ED270B8171DA932CF1D09B2840E9D043CA67CC80115A91DBD9BA47A1F3BB1753C77DE732D0DF2776337E7A4A823A36A4B7309
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var _lrSecureSearchToast_ = {.. WA_ST_M_STATUS_P:"Protection Score",.. WA_ST_M_MESSAGE_TITLE:"Increase your protection score",.. WA_ST_M_MESSAGE_TITLE_V1:"Search safer online and boost your protection score",.. WA_ST_M_MESSAGE_DESC:"Your protection score helps you monitor your overall digital health and safety. Get search protection for safer online searches and boost your protection score.",.. WA_ST_M_MESSAGE_DESC_V1:"Turn on search protection for safer online searches and see your protection score increase. Feel confident knowing you can monitor your overall digital health and safety with Protection Score.",.. WA_ST_M_ONLINE_PROTECTION_STATUS:"ON",.. WA_ST_M_ONLINE_PROTECTION_TITLE:"Online browser protection",.. WA_ST_M_ONLINE_PROTECTION_FREE:"Free",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE:"Browser protection is your first line of defense against unsafe websites, links, downloads, malware, and more.",.. WA_ST_M_BROWSER_PROTECTION_MESSAGE_V1:"Browser protect

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\aj_logic.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3309
                                                                                                                                                                                                                                      Entropy (8bit):5.582346600381333
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:dOOh0XuzdrxGs+HhNDBlXv9O52Jea6iS2OiXTkZ6yXbo068OACTkt2:dOVe+PN6IS2ObPR7I
                                                                                                                                                                                                                                      MD5:7E8B8D478D2F89ACF837D5F699C01A41
                                                                                                                                                                                                                                      SHA1:926CC676DD8724887C4ED9D2B5704A6FDB36CB97
                                                                                                                                                                                                                                      SHA-256:4EA094C4A0FE12538375C820A817943FF2869745B965ABD59317F1FC35AC3933
                                                                                                                                                                                                                                      SHA-512:54E49B42A32824D584CABB7AE96C55EF5ECDEDD9B8C96E53501AA2C77D420FF4C1715AFEFC1261223D11702A61A007CEEC3EF291F4A5DC2346E3D77F74334871
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.......... 4...7.......7...%...>...4...>.......T...4...7.......7...%...>...)...H.......7...>...4...7.......7...%...4.......>...$...>...H....tostring)[BL]: is_aj_blocked: end, returning .is_active1[BL]: is_aj_blocked: standalone installation.get_oem_implementation.[BL]: is_aj_blocked: start.info.log.core........~4...7.......7...%...4.......>...%...4.......>...$...>...4...7...7.......7...)...%.......'...>...'.......T...'.......T...4...7.......7...%...4.......>...%...$...>...)...H...4...7...7.......7...)...+.......>.......T...4...7.......7...%...>...)...H...+...>.......T...4...7.......7...%...>...)...H...4...7...7.......7...)...+.......%...>.......T...4...7.......7...%...4.......>...$...>...)...H...3...:...'.......T...'.......T...4...7.......7...%...>...%.......F...T...4...7.......7...%...>...%.......F...G.........Ewacore:mfw\packages\webadvisor\aj_toasts\wa-aj-toast-toggle.html8[BL]: aj_logic.get_template: returning toggle toastGwacore:mfw\packages\webadvisor\aj_toasts\wa-aj-toast-che

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\base_provider.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1736
                                                                                                                                                                                                                                      Entropy (8bit):5.802009878123512
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:svcBul+GI4gCGnPVj1fEX3Oh0KxAACEEzF:svplE7PvaS0KxApvzF
                                                                                                                                                                                                                                      MD5:A8A7028F17CC52426902347F00E503F6
                                                                                                                                                                                                                                      SHA1:A611AEA67561322EC9F6B92D9017BF29FEF4AFD4
                                                                                                                                                                                                                                      SHA-256:DC93A94433CAD7302667C42C4B479896D2AD0F0AC058945E6BB5494A705B4D9D
                                                                                                                                                                                                                                      SHA-512:F564502AF41892108E779B546C43866FBB45DECC645B1AE72325B2BC14B9E66A1935A0AD225D62268E6D14E4D5CA87E933E29771789EDBB72151A12871D262D8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..8.......:...:...:...G....providerName.providerId.priority........)...H...........)...H...........)...H...........)...H...........)...H...........G...........G...........)...H............4...7.......7...%...4.......>...$...>...%...2...%...F...Hfile:///[WA_FILES]/mfw\packages_web_view\webadvisor\wa-sstoast.html3wacore:mfw\packages\webadvisor\wa-sstoast.html.tostring0[BL]: calling get_toast_template_path with .info.log.core........%...H....default........%...H....DefaultSearch........)...H............4...7.......7...%...4.......>...%...4.......>...$...>...4...+...>...T...4...7...7.......7...)...............>...A...N...G......SetBrowserSetting.BrowserUtils.utils.ipairs., browser_type=.tostringM[BL] calling Base_provider:fill_url_settings_with_the_same_url with url=.info.log.core......%.?4...7.......T...4...2...:...4...7.......T...4...%...>...3...5...4...7...1...>...5...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\edge_onboarding.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4215
                                                                                                                                                                                                                                      Entropy (8bit):5.708566164315219
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:vS5r1iy0HVRJ+ak1BB/vknvkxvkg4+ZPxVVnM/pxewRQHcTG64:vSR1eqJ/vwvCvxZpVMpxdRQAGl
                                                                                                                                                                                                                                      MD5:29F407240D0120852E87DE9CA27DB793
                                                                                                                                                                                                                                      SHA1:3B55C113972912E3551AD48F303BAA1BF774202E
                                                                                                                                                                                                                                      SHA-256:86FB69430E3B8C6F281A4D1A1AD4E4D8E7BFE63EE26BD04309649F0A906521E5
                                                                                                                                                                                                                                      SHA-512:8409D788EF06F63B666F90ADF87622838F573B3FAAD9A3DD289B5794B513DE6EA99CC9B711D9B57058A613CAFBB987437B78EA51513F51E84B7A3E315288323D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........;4...7.......7...%...>...4.......7...4...7...7...7...7...+...>.......T...4...7.......7...%...>...)...H...4.......7...4...7...7...7...7...+...>.......T...4...7.......7...%...4.......>...%...$...>...)...H...4...7.......7...%...>...)...H......common_checks: end., won't proceed.'.tostring$common_checks: extension state .get_extension_state*common_checks: registry entry present.edge.BrowserType.BrowserUtils.utils!has_extension_registry_entry.browserSettings.common_checks: start.info.log.core.........'4...7.......7...%...>.......T...+...>.......T...4...7.......7...%...>...G...4.......7...)...%...+...>...4.......7...%.......>...4...7.......7...%...>...G.......!schedule_edge_ext_check: end.on_edge_check.SetEventTimer.timerFactory.edge_onboarding_check.GetOption.settings2schedule_edge_ext_check: common checks failed#schedule_edge_ext_check: start.info.log.core......B...4...7.......7...%...>...+...>.......T...4...7.......7...%...>...G.......T...+...)...>...4.......7...)...%...+...7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\ff_monitor.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3412
                                                                                                                                                                                                                                      Entropy (8bit):5.573341748501057
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:2S5CTNSU5oEKBcys6pE+Zo1VsLjgUj0knS2EfXdYv:2SoSU5obxvnZo1VLknS2gXdYv
                                                                                                                                                                                                                                      MD5:4BA4A91EEB45D5295DFBA9FF8624307C
                                                                                                                                                                                                                                      SHA1:BE70262F3C0533E340470EC2018337D1E03A6480
                                                                                                                                                                                                                                      SHA-256:29EADB3D3F32C2B8CCEECD213BC4A7DFCDEE442B48375270C8C77540E0295CB6
                                                                                                                                                                                                                                      SHA-512:2E016CBFC642C525AA77905C86BCB3ABAA32D1C5FE67F595D7DAC710097B30B40A8A6E6028A884446DBC37D015FAF6265D7E09769501EE6EA8464DCB26DD3CFE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........T4...7.......7...%...>...4.......7...4...7...7...7...7...>.......T...4...7.......7...%...4.......>...$...>...)...H...4.......>...'.J.....T...4...7.......7...%...4.......>...%...$...>...)...H...4...7...7...7...7...4.......7...4...7...7...7...7...4...7...7...7...>.......T...4...7.......7...%...>...)...H...4...7.......7...%...>...)...H....common_ff_toast_checks endBcommon_ff_toast_checks: WA extension is installed and enabled.ff_wa_ext_id.get_extension_state.ext_enabled.ExtensionState$ supports registry installation%common_ff_toast_checks: version .tonumber.tostringIcommon_ff_toast_checks: failed to get Firefox major version . Error .err.ff.BrowserType.BrowserUtils.utils.get_browser_major_version.browserSettings!common_ff_toast_checks start.info.log.core......#.l4...7.......7...%...>...4...4.......7...)...%...'...>...=...4...7...>...4...4.......7...)...%...'...>...=...4...7...7...7...............>.......T...4...7.......7...%...>...G...3...4...7...7...7...:...4.......7...)...%

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\logic_loader.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2022
                                                                                                                                                                                                                                      Entropy (8bit):5.7969664378376935
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:eurHi7o5purHi70dyMGhKz8urHi7u49UEtnhhvwJwkCLkTB+2QS5Vpx7WsE:eujiYujiQGoAujibNtnhNbkCoTAdS5dc
                                                                                                                                                                                                                                      MD5:0E51B32A148FBAF0177C1EB7514F37F4
                                                                                                                                                                                                                                      SHA1:94D39C14DB66C254003D0DA279CF71FEC99F5850
                                                                                                                                                                                                                                      SHA-256:8D1207154C3EB90FD1834AE802FFB22C09FE4AA06CB7C97CA8DD0722B266520F
                                                                                                                                                                                                                                      SHA-512:8AA7E98D62265AC498303B95B819CBCF31CE0BDE3D173DBDF75C62A8EE18E1BEEA116F3E88CE05B049B18C680775D2FE8A1F0D0909C167F5DFA5D83AED217BF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...6.......T...6...H.......T...)...4.......7...............>.......T.......T...)...9...H...4.......'...>...G....error.include.external.loaded.package.........3...%...4.......>...T...4...........>...A...N...G....require.ipairs.MFW\core\.....logger.dkjson.json.utils\stringUtils.utils\browserUtils.class.win32helper.utils\common_utils.........3...4.......>...T...4...4...6...%.......$...>...A...N...G....Module does not exist: ._G.assert.ipairs.....external.settings.subdb.telemetry.utility.browserSettings.registry.timerFactory.........3...%...4.......>...T...4...........>...A...N...G....require.ipairs.logic\.....usage_calculation.MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.ff_monitor.type_tag_utils.tests_logic.aj_logic.edge_onboarding.oem_utils\oem_util.oem_utils\oem_utils_wss.oem_utils\oem_utils_wps oem_utils\oem_util_selector.oem_utils\affid_monitor.........3...%...4.......>...T...4...........>...A...N...G....require.ipairs.telemetry\serializer

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\miscutils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4260
                                                                                                                                                                                                                                      Entropy (8bit):5.702833100833656
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:+EmzFkWog99GVWuFqisQmu/JN4/+PzDlN7qmjFBHMSPSr460TSVUOgXw6Zr/Ikxx:GmzO9CWeqiZ7jNNuYjaxwSC1Ckxjd
                                                                                                                                                                                                                                      MD5:AC4B0FAA52B6DFA4B765E8D94FBDFE80
                                                                                                                                                                                                                                      SHA1:EF63A9847E3AB925EF4F39EE80C851F9543CD08E
                                                                                                                                                                                                                                      SHA-256:6365FABF53722E6EE54C7C1F2B5022621216E7A76C12BC8E5D0BB7C0395806F6
                                                                                                                                                                                                                                      SHA-512:D1E4A1E046CB9779B49F23D13EEBF8F1440C5C04DD115BA67F5EEEB016AEA88AED920620472F79EE508D8D5E7765CD2B0B93F5389BE3821A7F376BFA346B8D80
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........$4...7...7...7...4...7...7...7...>...'...+...7...%.......>...4...7...7...7.......4...7...7...7...........'...>.......T...)...H...+...7.......@......string.GEO_ISO2.SYSGEOTYPE.GetGeoInfoA.char[?].new.GEOCLASS_NATION.SYSGEOCLASS.GetUserGeoID.kernel32.Win32.core..........4.......7...)...%...%...>.......T...4...7.......7...%...>...4...7...7...7...>.......H....GetUserLevelGeo.MiscUtils.utilsH[BL] GetGeo: Got empty value of SystemGEO, falling back to user GEO.warn.log.core..SystemGEO.GetOption.settings.........4...7...7...+...7...7...'...'...%...>...=...7.......T...)...T...)...H......handle+{B3251298-6CD7-4C88-A541-A62A7500D233}.OpenMutexA.C.Win32Handle.Win32.core........8+... ...........T...)...T...)...4.......>.......T.*.....T...4.......7...).......4...4...7...7...7...........>...=...=...T...4.......7...).......%...>...4.......>.......T...4.......>.......T...4.......7...)...........>...H......(current<setting).days_elapsed.common_utils.utils.core.tostring.SetOption.settings.st

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_business_logic.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10019
                                                                                                                                                                                                                                      Entropy (8bit):5.832205746569477
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:S9w9/Cam+UDm7fGivdL5Z3F4u6xiTbTIbcqa+aBaMTtmC0FKgv4d7dS27pnvWSJA:VKaVbfGULn15kSTIIqDI81KgQ7dSItv8
                                                                                                                                                                                                                                      MD5:EC793972999E80F949D6BF21FB9EDF0E
                                                                                                                                                                                                                                      SHA1:4440C44980518FEF4D24D96796B8FB2EDD31D9A4
                                                                                                                                                                                                                                      SHA-256:A892622449790373831BEC9516E5033A13101A017826B19022828344F7DA1244
                                                                                                                                                                                                                                      SHA-512:0CE78689E06BFB195D3D5260FC6D9642398A2789616CB054F66D174A100E30DA1DFE4644BA513019CAF739E7E28C1B010DF87BBD9933F1E37AE50E4CDDDA2B48
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........J4.......7...)...%...'...>...4.......>.......4...7.......7...%...4.......>...$...>.......T...4.......7...)...%...4...4...7...>...=...=...4.......7...)...%...%...>...)...H...4.......7...)...%...'...>.......T...4.......7...)...%...%...>...)...H...4...7...7...7...4...4...7...>...=...........%...@....MinimumDaysElapsed.MiscUtils.utils.(interval=0)3*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL.(just set).OEM_WSSUninstallDateState.time.os.SetOption.tostring.[BL] *WSSUninstallDate = .info.log.core.tonumber.*WSSUninstallDate.GetOption.settings.........V4.......7...)...%...)...>...4.......7...)...%...'...>...4.......7...)...%...%...>...4.......7...)...%...%...>...4.......7...)...%...%...>...4.......7...)...%...%...>...4.......7...)...%...%...>...4.......7...)...%.......>...4...7...7.......7.......>.......T...4...7.......7...%...4.......>...$...>...G...4.......7...)...%.......$...%...>...G....NoError.RecoveryAttemptLastError_.tostringA[BL]: SetSearchOfferAllowed: nil browser string

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\affid_monitor.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1187
                                                                                                                                                                                                                                      Entropy (8bit):5.687082306313735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:pTS2+KnFwDzFcPfiwOaw2pFVIW17rF89lMLpFmJpFKljo8o0NRN:RS2psqPfiwO52pFVIW7589yDypFKljoc
                                                                                                                                                                                                                                      MD5:E44B243D13AB21FAA2842E11862548EE
                                                                                                                                                                                                                                      SHA1:E830DEFB0DD1A7131F41C88641B0D9098E74B05D
                                                                                                                                                                                                                                      SHA-256:0F5F3DCF0EAAC59BAE9510A01A02581D034EB68545EC5D9FD4CBF983958D5454
                                                                                                                                                                                                                                      SHA-512:3DB85A227FA63588766AE62626B1D74A5019D8F8B471B6EF37A1A259F0B8CFDFE347B03FE246008E6B4C950992CEC0846976579E86290DB08A375A1E8B4C6F3F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........{4...7.......7...%...>...4.......7...)...%...+...>...4.......7...%.......>...4...>.......T...4...7.......7...%...>...G.......7...>.......T...4...7.......7...%...>...G...4.......>...4...7.......7...%.......$...>...)...4.......7...)...+...>.......T...4...4.......7...)...+...%...>...=...4...7.......7...%.......$...>.......T...4.......7...)...+.......>...)...T...4...7.......7...%...>...4.......7...)...+.......>...).......T...4...7.......7...%...>...4.......7...>...4...7.......7...%...>...G........wps_affid_check end.apply_customization.wps_utils,wps_affid_check: applying customization.wps_affid_check: affid is not updated yet.SetOption1wps_affid_check: current WA saved aff_id is .0.does_setting_exists$wps_affid_check: wps aff_id is .tostring'wps_affid_check: wps aff_id is nil.get_aff_id/wps_affid_check: wps implimentation is nil.oem_utils_wps.wps_affid_check.SetEventTimer.timerFactory.wps_affid__check_period.GetOption.settings.wps_affid_check start.info.log.coreB.......(...%..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):560
                                                                                                                                                                                                                                      Entropy (8bit):5.1103919625520815
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:+ayl0lqwtLHlRX/qmLQafHtfLBGgiO6CaMAEKRjsj2zHc5xh:p+00Ez/qmPRLBx2ChAEK2Czmxh
                                                                                                                                                                                                                                      MD5:E4A082A664D2F17638C9DAFE6F027D3B
                                                                                                                                                                                                                                      SHA1:5D5FA68165FD1858D6CBEDD6A14DCF95CAE23EDD
                                                                                                                                                                                                                                      SHA-256:EDFEC5EF4193B9E2C99E0CD21B4AD5B935E792CB0705D90D8187913A692A9727
                                                                                                                                                                                                                                      SHA-512:E2FB91D6848096A5AAE6B4763AB6FD0FAAC6078F627CF331BD3948BBCFC2553C14D4EA2AE26D3327240BEB79246A10C0D8FF963238055C1C892C99301351A829
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........G...........)...H...........)...H...........)...H...........)...H...........)...H...........)...H...........)...H..........."4...7.......T...4...%...>...4...7...1...>...5...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...4...1...:...G.....is_active..get_expiry_date..get_activation_date..get_install_date..is_trial_active..is_trial..is_installed.oem_util..class.core.class.require.core._G...//2B28664ECBEB214C38C9DCFCDA5A56647A905E35CDB03ABE2EC5E0D5A68D6DB07F454B0377350402AFA7A2EAB22337FF76FDD3420D9ED57978BAE9F48FE2C350++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_util_selector.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):672
                                                                                                                                                                                                                                      Entropy (8bit):5.385011388701981
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:uFVVJP2VOB4kML2lBOphYfR2MQyPiOhYfQIMBFxUNWbGdYZ279hH8bO:uD3P4OBf8wfR2MQsmfQIMBFC7H8q
                                                                                                                                                                                                                                      MD5:CA920D159AD3737BAB806A3A5C9628D2
                                                                                                                                                                                                                                      SHA1:5D9DE79A94FC88CB69442A4A7D6FA2610930AE21
                                                                                                                                                                                                                                      SHA-256:6490715DE7C02E3343081040E6DF7D4E37965E4E588217D051C9436089E0DA30
                                                                                                                                                                                                                                      SHA-512:A3E7A8899CA9402F7B01C44BA38DA7457D52EB0EC81C068AF075BE9FA010DC3D48698821432C9345C50ECE200ACBF0DE88999329F7EE1FA87BEE312B10DA18E8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........44...7.......7...%...>...4...>.......T...4...7.......7...%...>.......7...>.......T...4...7.......7...%...>...H...4...>.......T...4...7.......7...%...>.......7...>.......T...4...7.......7...%...>...H...)...H...0[BL]: get_oem_implementation: wps installed2[BL]: get_oem_implementation: wps_oem not nil.oem_utils_wps0[BL]: get_oem_implementation: wss installed.is_installed2[BL]: get_oem_implementation: wss_oem not nil.oem_utils_wss([BL]: get_oem_implementation: start.info.log.core+.......1...5...G....get_oem_implementation....//0629AC9444D8F7AED73120ACB3B93D2B7B491A64C2CB84DE9779506A9029A1275CA0D1D034DFC03029BAD96455E35286431B79724CE7EA0639D49DAFC980E973++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wps.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4951
                                                                                                                                                                                                                                      Entropy (8bit):5.580678162122476
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:7vFn/LxjkPu0UxfF7dJHTelC9sjXFXT/k2NJyPTvUE6+lRUD:hh7RG/koJYsD
                                                                                                                                                                                                                                      MD5:F260CC25B487C009F699F6AE2B7533CE
                                                                                                                                                                                                                                      SHA1:79EB03B199A105691F9FE1CB0ED6F7AA337BF738
                                                                                                                                                                                                                                      SHA-256:A7E9B87C4DC419055FB573A9CDFB74E10885104D6BACEAF1BF47FAE81705CA85
                                                                                                                                                                                                                                      SHA-512:D73219EB16C6FECF6B853C892CBC9577AE561B41CC8E31B9B4F7F23A1A7E0AD9FD90233549CC8F39A08923773DEA28D0C202230037FD44A358817B5A70883923
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........14...7.......7...%...4.......>...$...>...4.......7...+...>.......T...4...7.......7...%...>...G...4.......>...4...7.......7...%.......$...>...4...7.......7.......>...4...7.......7...%...>...:...G......wps_data5[BL]: oem_utils_wps:constructor: parse succeeded.decode.json1[BL]: oem_utils_wps:constructor: setting is 0[BL]: oem_utils_wps:constructor nil setting.get_setting.wps_utils.tostring.[BL]: oem_utils_wps:constructor. self is .info.log.core........;4.......>...4...7.......7...%.......$...>.......7...+...>...4...7.......7...%...4.......>...%...4.......>...%...4.......>...%...4.......>...%...4.......>...%...4.......>...%...4.......>...$...>...4...7...3...:...:...:...:...:...:...@......sec.min.hour.day.month.year....time.os...:. .-([BL]: wps_date_to_lua: parsed date .match)[BL]: wps_date_to_lua: input string .info.log.core.tostring.........4...7.......7...%...>...4...7...7...7...@....is_wps_installed.common_utils.utils%[BL]: oem_utils_wps:is_installed.info.log.core........#4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\oem_utils\oem_utils_wss.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2385
                                                                                                                                                                                                                                      Entropy (8bit):5.582950659599468
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:zWlW7vpFo1Qv16uEzskWQ5FkRkA4VGsPClXZ8G+R:xjpFo1Qt6ckzFkRkXGsPClXZ8j
                                                                                                                                                                                                                                      MD5:7E60A29FAA164F6EB7656D8CEFB0DE1C
                                                                                                                                                                                                                                      SHA1:5DEFC40EE08CFC543FBCED5EDD90FF53419FCC0E
                                                                                                                                                                                                                                      SHA-256:FF4DE5E72604187A2957AFE6F1E46ACAED8B2BC8108FD3D120D4E6A894247B57
                                                                                                                                                                                                                                      SHA-512:E10BCEA323C8CE3F72F1C88175121379C4E9F972D64F2DD0DADC8174415FD9FF85B9925277288FFAFF9066C19F3A813031CFDB8B2DF2A1E8F9855A00B3C0DEF5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7.......7...%...>...4...7...7...7...@....IsSuiteInstalled.common_utils.utils%[BL]: oem_utils_wss:is_installed.info.log.core.........4...7.......7...%...>...4...7...7...7...@....check_wss_trial.common_utils.utils![BL]: oem_utils_wss:is_trial.info.log.core.........4...7.......7...%...>...4...7...7...7...@....is_active_wss_trial.common_utils.utils([BL]: oem_utils_wss:is_trial_active.info.log.core........44...7.......7...%...>...4.......7...%...%...>...4.......>.......T...4...7.......7...%...>...)...H.......T...4...7.......7...%...>...)...H...4...7...7...7.......>.......T...4...7.......7...%...>...)...H...H...:[BL]: oem_utils_wss:get_install_date null expiry time.SubDBTimeToOsDate.common_utils.utils>[BL]: oem_utils_wss:get_install_date data is empty string.;[BL]: oem_utils_wss:get_install_date data not a string.string.type.installed.vso.GetProperty.subdb)[BL]: oem_utils_wss:get_install_date.info.log.core........L4...7.......7...%...>...4.......7...%...%...>...4.......>...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3880
                                                                                                                                                                                                                                      Entropy (8bit):5.96183758603513
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:vsIcJdhv4MbMz7hSgahA1NPbQiSQVT/mnmrdTS/q8pYQqBtJwg6svBTJ0go66SH/:OdhlQhNPEiTTe+gq8qJvpN3HKTS
                                                                                                                                                                                                                                      MD5:DAD7305B382270FF11A080D0540625E5
                                                                                                                                                                                                                                      SHA1:A24EE20E8C7D37FEF4A0D94F793FE531D4874756
                                                                                                                                                                                                                                      SHA-256:6EF9D885FF1C500E542E6824687FE8E326A65AE760C32D34FF9CB27B3ED2561E
                                                                                                                                                                                                                                      SHA-512:4E3B0D77353B0E87DD55C4E2D4C32FD866DACC757C92040F627D8B5DCFD788444D04E0BE40962CA48F62F6DA4B1159E5B55A055B9ADB932E774FE29C9FBC2C71
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........E4...7.......7...%...4.......>...$...>...4...7...7...7.......>.......T...)...H...4.......7...)...%...4...7...>...4...7.......T...4.......7...)...%...%...>...4...7...7...7...%.......>...4...7...7...7...>...6.......T...)...H...4...7.......7...%...4.......>...%...$...>...)...H.... end.GetGeo.,.Tokenize.common_utils.AU,DE.BingCountrySet.Bing.Yahoo.SearchProviderCodes.ProviderForced.GetOption.settings.ShouldSelectBingOverYahoo.MiscUtils.utils.tostring$[BL] Bing:ShouldBeSelected for .info.log.core`.......4...7...7...7...>.......T...%...H...%...H....0.1.IsSuiteInstalled.common_utils.utils.core\.......4.......7...)...%...)...>.......T...%...H...%...H....0.1.*Orphaned.GetOption.settingsZ.......%...4...7...7...7...>...+...>...+...>...$...H........GetGeo.MiscUtils.utils.core.FC[.......4.......7...)...%...%...>.......T...%...H....MC01.BingPartnerCode.GetOption.settingsY.......%...+...>...%...+...>...%...$...H........&q=.&PC=%http://www.bing.com/search?FORM=........'4...7.......7...%..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\providers\yahoo.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14688
                                                                                                                                                                                                                                      Entropy (8bit):5.9242648114796745
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:5pu5kFI/DHGaeQiemuPjngh0hyKc1BlqNBqBPFqngsIrpqu7Y:DOkF0HGaeQiemuP8kyKc1BKqBCqrpqJ
                                                                                                                                                                                                                                      MD5:247FA451AA8AD78492C3ABC691C5A284
                                                                                                                                                                                                                                      SHA1:27ADFD7796BD5BB7191AA81CF44A7708ED748E55
                                                                                                                                                                                                                                      SHA-256:40B5334C15A206222614E707C16A22931A5A88B1124AAB94A9340A634AC1D462
                                                                                                                                                                                                                                      SHA-512:36C1D832A651E5532F5CBF757B05F8BCE4BB83067B85B1FAEB9B34B22C5B7E970D9E3FF15F274B3DBD3FBA34A26CF65D4427A1C2245343F9EBAEEDF47040982B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.........."4...7...7...7...>...+...6.......T...)...H...4.......7.......4.......7...)...%...%...>...=.......T...4.......7...)...%...)...@...)...H....."*EMEA_COUNTRY_SUPPORT_ENABLED.HU *EMEA_COUNTRY_SUPPORT_REGEX.GetOption.settings.RegexTest.utility.GetGeo.MiscUtils.utils.core........14.......7...)...%...+...>...4.......7...)...%...%...>.......T...4...7.......7...%.......$...>.......T.......%.......$...T.......4...7.......7...%.......$...>.......T...+...%.......%...$...;...G........).*..^http(s)?://(us\.|ar\.|at\.|au\.|br\.|ca\.|ch\.|fr\.|fi\.|de\.|dk\.|hk\.|in\.|it\.|kr\.|mx\.|no\.|es\.|se\.|tw\.|uk\.|cf\.|cl\.|co\.|id\.|nl\.|nz\.|pe\.|ph\.|sg\.|th\.|pl\.|tr\.|espanol\.|ve\.|vn\.|malaysia\.)?search\.yahoo\.(com|co\.jp)/search.*(\?|&)fr=(mcasa|mcsaoff|mcsaoffblock|slv8-mcafee|$AdjustRegex: regex addition is .|,AdjustRegex: got special chrome frcode .info.log.core..YAHOO_CH_FR_CODE_REGEX_ADD.*YAHOO_FF_FR_CODE.GetOption.settings........7....T...)...H...7.......T.......T...+...4...7...7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\providers_selector.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1771
                                                                                                                                                                                                                                      Entropy (8bit):5.866517586690726
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:y6EaYQrEfyAb/taw2mx/Yz9UlEQmiR5Ftk+gIZN0dw:xEWEfyAb/Yw2mx/+9UlVbFtk+gIZN0O
                                                                                                                                                                                                                                      MD5:66CE8692324759DC6A478C60175EA603
                                                                                                                                                                                                                                      SHA1:A4B1149C8894E88745DA62BDF232D3E968CE50E6
                                                                                                                                                                                                                                      SHA-256:6ED52DAFF2AA1AA2B7A9990CC20EB97E87B324FE7CF5D46B6926D1B928542F62
                                                                                                                                                                                                                                      SHA-512:7AB36B50C0A05EC305C2AC577B43F7397BE5B31B7DED6BB38D63132015D57B465DDBB7DCC54C441C3DE822CA2B354B93296C8DA91C90BEA6B1B3E2FB29B9F8B1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........`4...7.......7...%...4.......>...$...>...2...4...4...>...D...4...7...........>...B...N...4...7.......>...'.......'...I...4...6...6.......7.......>.......T...H...K...4...7...4...7...7.......7...%.......4...7...>.......T.'.4...7.......7...%...>...4.......7...)...%...%...>...4...7...7.......7...)...%.......%...>...4...7...7.......7...)...%.......'...>...4.......7...%.......>...)...H....(empty)(fill_url_settings_with_the_same_url.Base_provider.SetBrowserSettingInt.(Unknown).ProviderToastedName.SetBrowserSettingL^http(s)?:\/\/(www\.)?yandex\.(com|ru)\/search\/(\?|&)fake_param=fake.*.SECURE_SEARCH_REGEXES.SetOption.settingsI[BL] ssProviderSelector.GetSSProvider nullifying settings for Yandex.Yahoo.ProviderToasted*GetUserBrowserSettingWithSystemBackup.BrowserUtils.utils.Yandex.SearchProviderCodes.ShouldBeSelected.sort.insert.table.ss_providers.pairs.tostring/[BL] ssProviderSelector.GetSSProvider for .info.log.coreh.......4...4...>...D.......7...........>.......T...H...B...N...)..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\ss_logic.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):30783
                                                                                                                                                                                                                                      Entropy (8bit):5.89942808249202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:hvZUXY2aT8m+mpVGakHyf4cMrRcFFHazfdOmWOD:r52aT8/rAX4cTKf9
                                                                                                                                                                                                                                      MD5:3700A6BED0756A2869A5A94CD5CF0F8C
                                                                                                                                                                                                                                      SHA1:433C418C3BD195184503562BF08D753311F56C53
                                                                                                                                                                                                                                      SHA-256:2F8A54758AD7F85F3224768A129581F3BC08CBFC50EFB48A12917481794EE638
                                                                                                                                                                                                                                      SHA-512:26D5AF303495D6B9B2CC1ECB4BB9CD43449C4BB2986A83411CA6E062CB705BC2AB83D7F7AAB4C981EAD57FDE5A5416215DA8AB481F864C61CA6E74E7BB66422F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........74...7...7.......7.......>.......T...4...7.......7...%.......$...>...G...4...7...4...7...7.......7.......>...=...4.......7...)...%.......$...4.......7.......>...=...4.......7...)...%.......$...4.......7.......>...=...G....GetCurrentMinVersion.MinBrowserVersion_.GetCurrentMaxVersion.browserSettings.MaxBrowserVersion_.SetOptionInt.settings.GetBrowserStr.lower.stringLInvalid browser type passed to UpdateSupportedBrowserVersionDimensions.info.log.IsValidBrowser.BrowserUtils.utils.core........%4...4.......7...)...%...+...7...>...=...4...7.......7...%...4.......>...$...>...+...7.......T...+...7.......T...4...7.......7...%...>...+...7...H.....7[BL]: alt_triggers_get_cohort: setting cohort to 0.logon_unlock.tostring6[BL]: alt_triggers_get_cohort: settings value is .info.log.core.regular.alt_triggers_cohort.GetOption.settings.tonumber........14...7.......7...%...>...4...7...7.......7...)...%.......'...>.......T...4...7...7.......7...)...%.......'...>.......T...4...7...7.......7...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\tests_logic.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10053
                                                                                                                                                                                                                                      Entropy (8bit):5.628325035446554
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:J7ugghiOQu22Tww/N0pOFbGskXtOib/S2RS2Q9MS2DFqiAQVJMisKvDk5cFd9Q:dughP2ThN0pOFbGskXtOib/SF2Q9MSoc
                                                                                                                                                                                                                                      MD5:E74888C165822541DCE51BD6C655889F
                                                                                                                                                                                                                                      SHA1:26F0FC2204A3C0AEDE4B1CEE4E07109AEE10C2F6
                                                                                                                                                                                                                                      SHA-256:8A5D4402460EE6DD7C0644E687F5E26203D4987BD694076BE45E7577E918F6AF
                                                                                                                                                                                                                                      SHA-512:A9C892B33542259B42000DB5DEABB07EA995CB5D732235CAD8401513D4B332C296F69850DADE49AD8D584AE1DE2CD54A41FF488E1B8D69248E836473467924B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........)...4...7.......7...%...>...4...7...7...7...7.......T...4...7.......7...%...4.......>...$...>...4...7...7...'...F...4.......7...)...%...)...>.......T...4...7.......7...%...>...4...7...7...'...F...4.......7...)...%...'...>...4...7...>...'.......T...4...7.......7...%...>.......4.......7...)...%.......>...T.*.4...7...7...7...........>.......4.......7...)...%...'...>...4...7.......7...%...4.......>...%...4.......>...$...>.......T...4...7.......7...%...>...4...7...7.......F...4...7...%...>...7...4.......7...)...%. .'...>...4.......7...)...%.!.'...>...4...7.......7...%.".4.......>...%.#.4.......>...%.$.4.......>...$...>.......T.......T...4...7.......7...%.%.>...4...7...7.&.....F...4...7.......7...%.'.>...4...7...7.(.....F....ignore_within_timeframe.tests_logic.tt_check: end.no_toastAtests_logic.tt_check: time of date is out of limit. No toast., higher limit ., lower limit *tests_logic.tt_check: current hour - .tt_higher_hour.tt_lower_hour.hour.*t.date.ignore_threshold_passed?tests

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\type_tag_utils.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2316
                                                                                                                                                                                                                                      Entropy (8bit):5.935897009049318
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:lSoy0q4tCvGRWooQSiEdA/mlV8OsgRNmELm1M+G3hWpfus:lSnxGRWo/SiEiiDRNNyGx+fus
                                                                                                                                                                                                                                      MD5:A0A5D3B0ACD07B78ACB78C8DB76C4915
                                                                                                                                                                                                                                      SHA1:3CE1CF25D0A9AF212E6F08FCCCE25A525024773D
                                                                                                                                                                                                                                      SHA-256:40179C4F721BDC90B0BCB8CAF4DE4E64A7F046296918A9DB058B43654EB34F4A
                                                                                                                                                                                                                                      SHA-512:AAA79A6E7F81DE3B06A921E00075DEC9F8F4D2C4DC4B64EA432C9267656C41B70945978558C82D4677CEE39313C91B9B421AA22586662ADEFAE8B48DE9691186
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........(...4.......7...)...%...%...>...'...4...7...7...7...>.......T...4...7.......'...>.......4.......7...)...%...)...>.......T...4...7.......'...>.......4.......7...)...%...)...>.......T...4...7.......'...>.......4.......7...)...%...'...>...4...7.......%...>.......T...%...T...4...7...........>.......T...%...T.......4.......>...4...7...7...7...7.......T...%...4.......7...)...%...)...>.......T.C.4...7...7...%...%...'...(...>...%.......7...>.......T...4.......7...%...>...=.......%...%...4...7. .....>...4...7. .....>.......T.......T...4.!.....7.".................>.......T...4.!.....7.#.....>.......%.$.........4.......>...........%.%.4.......>...%.&.....$...H...%.'.........4.......>...........%.%.4.......>...$...H....type=E.M.G.type=F.EscapeA.HMACSha256.utility.len169+WMDgzyMpkvioeK5ZWOdq0SVmpw1jBePppGXgqisQ=.MachineGuid.QueryValue.IsValid.$Software\Microsoft\Cryptography.HKLM.Registry.Win32.typetag_includes_machineid.5.edge.BrowserType.BrowserUtils.tostring.find.%d+.match.string.*Exp

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logic\usage_calculation.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2030
                                                                                                                                                                                                                                      Entropy (8bit):5.624982895800952
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:8lO2MV+JJOlwc59u2HHw8DAyTh4Bdj5minH3lY3I+v3M:cO2rKwc5E2HHw8DAzQiHulM
                                                                                                                                                                                                                                      MD5:589EDE004DDD1F138AF6135AAA60A48C
                                                                                                                                                                                                                                      SHA1:75F5CA3C63BC5F1BFDACBFD0289F8C4F9A2C9EE0
                                                                                                                                                                                                                                      SHA-256:83B952A0DACC3D60FFC89564B273B716C0C61DEBB882D11EC6A3300189C35728
                                                                                                                                                                                                                                      SHA-512:5D6E432B78DE8908204D85C03EEF25508A46C04CAE82BFFFACCE88D213842A69014AE60A8DEAD599953A6C6B3AD8A804E038F959398F41125A15D47B88394707
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........P4.......>...4...7.......7...%.......$...>...4...4...7...7.......7...)...+.......'...>...=.......T...4...7.......7...%.......$...>...G...4...7...>...4...7...7.......7...)...+...........>...4...4...7...7.......7...)...+.......'...>...=.......T...4...7...7.......7...)...+...........>...4...7.......7...%.......$...>...G.......)calc_on_browser_start: end. Browser .SetBrowserSetting.time.os=calc_on_browser_start: session started already. Browser .GetBrowserSetting.BrowserUtils.utils.tonumber+calc_on_browser_start: start. Browser .info.log.core.tostring...........4.......>...4...7.......7...%.......$...>...4...4...7...7.......7...)...+.......'...>...=.......T...4...7.......7...%.......$...>...G...4...7...>.......4...7...7.......7...)...+.......'...>...4...4...7...7.......7...)...+.......'...>...=.......4...7...7.......7...)...+...........>...4...4...7...7.......7...)...+.......'...>...=...4...4.......7...)...%.......>...=...4...7.......4...7...7...7...!...>...4...7.......4...7..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\logicmodule.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4503104
                                                                                                                                                                                                                                      Entropy (8bit):6.484928376088644
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:DyAfbxqfL2fX5p9/aBO6BIClYsMhxOWCUCP:DrfbxqfL2fXZHg5P
                                                                                                                                                                                                                                      MD5:60AD222689CB58D59BB8DFC8D820A47D
                                                                                                                                                                                                                                      SHA1:9E8235B62132B505C64AA16A6B0F4FC3018DA5EC
                                                                                                                                                                                                                                      SHA-256:1A9AEAACC9B974296F11B34DADD914E5AEE5AD465633D044EFB676E018B45E81
                                                                                                                                                                                                                                      SHA-512:2D4831F2DACDF05A2384515AAF4ACB43DED940C4EC3488298A77F0397E41AC1E113720C8684F199371FD68B0A10C87E99232E2A181AD024A304847DA22D9CAB8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........$.}rw.}rw.}rw..qv.}rw..wv,}rw..vv.}rw..qv.}rw...w.}rw..wv.}rw..wv.}rw..vv.}rwt.vv.}rw.}rw.}rw.}sw.|rw..sv.}rw..tv.}rwS.vv.}rwS.wv.}rw..{v~}rw..rv.}rw...w.}rw..pv.}rwRich.}rw........................PE..d...rj1e.........." ......3..p........-......................................`D......|E...`A..........................................=.P...P.=.......C.X.... A.\....0C.@.....C..c....:.p.....................:.(.....6.8.............3.......=......................text....3.......3................. ..`.rdata...r....3..t....3.............@..@.data...T.... >..*....=.............@....pdata..\.... A......(@.............@..@.didat..8.....C.......B.............@..._RDATA........C.......B.............@..@.rsrc...X.....C.......B.............@..@.reloc...c....C..d....B.............@..B........................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\lookupmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1567296
                                                                                                                                                                                                                                      Entropy (8bit):6.3477184607648445
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:jUIoyrMg2ANjVafu5Af0Z3Loh4dr6QMNE1JPsek/cMmH:/J2AFiu55Jkh+mEnPsekEMmH
                                                                                                                                                                                                                                      MD5:6379364C82163E538D930F3995DC27AB
                                                                                                                                                                                                                                      SHA1:FAA6C0163DC38D26EF4A93B7859A146671E52128
                                                                                                                                                                                                                                      SHA-256:B35E805FC2BB794C801BF1E3EC6658B1ABBE938F9E3D3F985A5F2BAC9C8FB231
                                                                                                                                                                                                                                      SHA-512:719DB7FBF3DEB6D2B05C3490E5221340D2F972D32D4714E5989885947B6A18438A25A0F6372325D8DAD4E01E4D5B2795910F4C2F85E6AFABD42FE2BAA7FC68E3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......!..qe."e."e.">..#o.">..#.."7..#u."7..#o."..j"g."7..#..">..#q.">..#d."...#c."...#o.">..#p."e."Q."...#Y."...#d."..h"d."...#d."Riche."........................PE..d...li1e.........." .....V..........0................................................b....`A........................................p...T...............`....`.......*..@........!......p.......................(....6..8............p...............................text....T.......V.................. ..`.rdata..0....p.......Z..............@..@.data...l....@......."..............@....pdata.......`......................@..@.didat.......p......................@..._RDATA..............................@..@.rsrc...`...........................@..@.reloc...!......."..................@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\microsoftedgewebview2setup.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1785632
                                                                                                                                                                                                                                      Entropy (8bit):7.942738490429967
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:NSI3oiG08swq0fhLy0fEg6IGJIlq+S6O8:NSCG08sw3YyEg6IiYq8
                                                                                                                                                                                                                                      MD5:080FF9263F39F62DBDAE513C66B7B9D2
                                                                                                                                                                                                                                      SHA1:32DF585659003B10E7ED769932727D53480B9C34
                                                                                                                                                                                                                                      SHA-256:326CBB6CD7D6062B850337A50200C805CDCBF59A6E05818990E6352AC68B4935
                                                                                                                                                                                                                                      SHA-512:7A7A21D05FA8D2562A0598B254A25A49099AFA5EBD072DE391D9EE8DC30F57CD2830816C8A2B5997AE74C0B9924185334B15EC5CC3587B74C2E7957296E6E02B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.c......................................................9..............................................[...........Rich............................PE..L....R/`.....................t.......t............@..........................P............@.................................l)..x....`..,............... +...0..p.......T...................<...........@...............H....(..`....................text.../........................... ..`.rdata.............................@..@.data...\....@.......(..............@....rsrc...,....`.......2..............@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\resource.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):38888
                                                                                                                                                                                                                                      Entropy (8bit):6.344666762097508
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:EBr3M65hS2HiPvYumAMxkEVLpq41tuAMxkEW:Et3xzS4iGxNp31tcxK
                                                                                                                                                                                                                                      MD5:9FC3387AB7332BA77EC8EDAEAF67FFCB
                                                                                                                                                                                                                                      SHA1:9DFB79913911F0810357021026F72088138F4A44
                                                                                                                                                                                                                                      SHA-256:7E3BE8083094958386B39F4A2C2E0E7267065EF4D2D44495058B0E571D76A17D
                                                                                                                                                                                                                                      SHA-512:D758A43AD9FF77CF976C5C72AAC120D5BD361353295510312A2501D0E6D45BFCCBBDBAC8CCF99718C673CCE723D84281E6A64489FB92DD8981FB52DE2049AE07
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......yj=.=.S.=.S.=.S..~..<.S..~Q.<.S.Rich=.S.................PE..L....k1e...........!.........>...............................................`......c.....@.......................................... ..\:...........@...W..............p............................................................................rdata..............................@..@.rsrc...\:... ...<..................@..@.....k1e........z................k1e.........................k1e........l................k1e............................................RSDS.{xU%..H.|5.+.s'....c:\jenkins\remoting\workspace\ebAdvisor_WABinary_release_4.1.1@2\build\Win32\Release\Resource.pdb.......................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\servicehost.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):882136
                                                                                                                                                                                                                                      Entropy (8bit):6.370603887914517
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:8yK58M1kekJCPjbvBMiW1nCVCqlidLu9R1i9xccHLmyI9Mm9h5nftINWm9sTlfx2:JK58MyeUiVINd9s9x1DEeH+NtYcp
                                                                                                                                                                                                                                      MD5:786DA7AE2B6CCFE4A6A15675EE687036
                                                                                                                                                                                                                                      SHA1:B0759D0C5F117D852F67640B75A19E21EA69C0A1
                                                                                                                                                                                                                                      SHA-256:76CEBA89586E496BFB006A30676C403ED6B0DF091693660434210CAE541D14A7
                                                                                                                                                                                                                                      SHA-512:07D9F35B9E740662E906DEC665A92531C00DA64E5C07F2855F24B683F343ECCCD1835114B63DAFBB2907C2C6AD91D5589EEDD3E6F1A230394E91859B89174579
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........Z..S;.IS;.IS;.I.S.HX;.I.S.H.;.I.N.HA;.I.N.HY;.I5T.IQ;.I.N.H7;.I.S.H@;.I.S.HR;.I.S.H^;.I.N.HR;.IS;.IS:.I.U.HT;.I.N.HD;.I.N.IR;.I.N.HR;.IRichS;.I........................PE..d...-k1e.........."......p..........po.........@.............................`......4h....`................................................. ........0..p....p..D...........@..........p.......................(.......8...................h........................text...,n.......p.................. ..`.rdata..*6.......8...t..............@..@.data...............................@....pdata..D....p.......0..............@..@.didat..............................@..._RDATA....... ......................@..@.rsrc...p....0......................@..@.reloc.......@......................@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\settingmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2218528
                                                                                                                                                                                                                                      Entropy (8bit):6.513803936106778
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:hG8in55RFKuRyFGkDmuEFkqAqVYni55ZUeURpcQEvRE1dJ:sPdAuRyFJCuEFkqALiZUTRWU
                                                                                                                                                                                                                                      MD5:FCE1CF5801B5BBC4577EF226DFF7C793
                                                                                                                                                                                                                                      SHA1:19BB3C4EC85BD7AE6EACED425260452FA22ED48B
                                                                                                                                                                                                                                      SHA-256:0FBE3031F9323C94D70F35BD84E787C4635FD5114F08A46FEFFC817637873051
                                                                                                                                                                                                                                      SHA-512:E387ACE1BDB0DD0E14CF69B0A6FFC2D7475B15F5D3AFD4C431F811D7A2D7B3638BAE912F2A6B2F98CBDB51EB23C25AAD62CADFF2B8D5B37927ED3A6E41ED3B13
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$............~..~..~.....~....e~.....~.....~...0..~.....~.....~.....~.....~.K...~.K...~..~........~.l...~.....~.....~...2..~.....~.Rich.~.................PE..d...9h1e.........." .........0...... .........................................!......="...`A........................................@...T............@!.h........E.... . ....P!.h$......p.......................(.......8...............h.......`....................text............................... ..`.rdata..............................@..@.data...d...........................@....pdata...E.......F...z..............@..@.didat..P.... !....... .............@..._RDATA.......0!....... .............@..@.rsrc...h....@!....... .............@..@.reloc..h$...P!..&.... .............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\taskmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4098816
                                                                                                                                                                                                                                      Entropy (8bit):6.448991671950014
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:19Fe+gumupH64C7/1PQWZiBa2Ij7+2qpfS5n3lJiWZONDfFu53bTWXFzdId6ttLq:lxd6KfvId6HfDnQh+iPyAIBRGH4qEWG
                                                                                                                                                                                                                                      MD5:71C85B5122F5804B17DD71048F20E6BA
                                                                                                                                                                                                                                      SHA1:8090BC583DA341C8371A9256049460317F74640B
                                                                                                                                                                                                                                      SHA-256:DAD3A45714614C62A4052E5653213332E42CF0EED7AFF3CDFB3E970CAAF93A3D
                                                                                                                                                                                                                                      SHA-512:76BFA5E5B2E92798F62DEAB617D0AE7C4CE140B54018E746F6CC42FB03D0847F1A0B3BFE28F656880B316881728108C27CB170776D220E0418ACA4B9D8D9CF04
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......\.Q..v?..v?..v?.C.<..v?.C.:..v?.J.;..v?.J.<..v?.~...v?.J.:.iv?...:..v?.C.;..v?.C.9..v?...;..v?.C.>..v?...;..v?...>..v?..v>..w?...:.Yv?...6..v?...?..v?......v?...=..v?.Rich.v?.................PE..d....j1e.........." ......-.........._(......................................0>......z?...`A..........................................7.P.....7.......=.X.... ;..`... =..k....=..e..l84.p....................94.(.....0.8.....................7......................text.....-.......-................. ..`.rdata..L.............-.............@..@.data...L,....7..~....7.............@....pdata...`... ;..b...P:.............@..@.didat..x.....=.......<.............@..._RDATA........=.......<.............@..@.rsrc...X.....=.......<.............@..@.reloc...e....=..f....<.............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionconfig.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23764
                                                                                                                                                                                                                                      Entropy (8bit):5.620433567212455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:GAKYbQS98ai+io3JaiklfBXZkHf5c2slkiCJH:GAKJ+io3kRhFZkHfqJlkiI
                                                                                                                                                                                                                                      MD5:CE57A7B6F19E9B918C69E59E99B42F08
                                                                                                                                                                                                                                      SHA1:CAB304283D388A429EAA471CBCF51EF0B495DB13
                                                                                                                                                                                                                                      SHA-256:CF78F2039AD1E2671E82B27B441A00C709BA6076A8914622917B3CDB509AEB0D
                                                                                                                                                                                                                                      SHA-512:0192DA1DA69EC43DAEF1BF6F706FF917C13AA52038120ABF41FAF1433D87D99F81149BB41B17BC75B22D9F26998120F9B1A9ECB59D011FCE032390EDECEE913D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.............3...3...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...3...:...3...:...:. .3.!.3.".:...3.#.:...:.$.3.%.:.&.3.'.:.(.3.).:.*.3.+.:.,.3.-.:...3./.:.0.3.1.:.2.3.3.:.4.3.5.:.6.3.7.3.8.:...3.9.:...:.:.3.;.3.<.:...3.=.:...:.>.3.?.3.@.:...3.A.:...:.B.3.C.3.D.:...3.E.:...:.F.3.G.3.H.:...3.I.:...:.J.3.K.3.L.:...3.M.:...:.N.3.O.3.P.:...3.Q.:...:.R.3.S.3.T.:...3.U.:...:.V.3.W.3.X.:...3.Y.:...:.Z.3.[.3.\.:...3.].:...:.^.3._.3.`.:...3.a.:...:.b.3.c.3.d.:...3.e.:...:.f.3.g.3.h.:...3.i.:...:.j.3.k.3.l.:...3.m.:...:.n.3.o.:.p.3.q.:.r.3.s.:.t.3.u.:.v.3.w.:.x.3.y.:.z.3.{.:.|.3.}.:.~.3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...3...:...3...:...:...3...:...3...:...3...:...3...:...3...:...3...:...3...3...:...3...:...:...3...:...3...:...3...:...3...:...3...:...3...:...3...:...3...3...:...3...:...:..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):511
                                                                                                                                                                                                                                      Entropy (8bit):5.260911221069017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:x9cLdRk5IdLkL3B/ApCOpCz8TkEJtDV09OS7jamKnALrIY9dxn:ULHk+o3Bwj1JDV0THzIkn
                                                                                                                                                                                                                                      MD5:3D4D244FB94757E55F7B2563A0520611
                                                                                                                                                                                                                                      SHA1:9607E0A60C1B15860228A6617047C456733C410D
                                                                                                                                                                                                                                      SHA-256:643A96A89DF3BE3FC9588656B32ADB8EFE9C2268DDF0DC841E2C7A50899B1A43
                                                                                                                                                                                                                                      SHA-512:FA311234FE6EB08674A71FC2D7BDA29F06793AA09A47334AD26EE73A3C69E31E0DAF06F48F67C270DAA52470B4081026B543FE46B3979C00031363C7A9EA0F05
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..B.......4...%...>...G...)get_dimension_string not implemented.error........+...H.............+...H.............,...G.............,...G..............2...........:...1...:...1...:...1...:...1...:...1...:...0...H.....set_event..set_dimension_config..get_event..get_dimension_config..get_dimension_string.m_logger=.......2...5...4...1...:...4...0...H.....new.DimensionHandler...//3FCCFAC5AED175758B03FDFE622777EE677B4D3301024611FFA7EEBA4F78BF1EFC9AC3E3C867A7C9BD30DE7162564F48C7322446AA4481B31B1F4C97708C0794++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\dimensionprocessor.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1746
                                                                                                                                                                                                                                      Entropy (8bit):5.603565323103171
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:o3+rfeZe5P8UNkD02hI30tZjKg5jP2OX20OlsuEXzFs9/:oOrfeZIn3iZjP26pgsuERs9/
                                                                                                                                                                                                                                      MD5:99B212F454A75B87B54198288C50F2C2
                                                                                                                                                                                                                                      SHA1:45BB257BE6AF3094A3AC123A2757AAC54C467540
                                                                                                                                                                                                                                      SHA-256:17C20B773E6D30F0E69804E1CFCC75E67F043E31D28784EF84C8F8263FFA6947
                                                                                                                                                                                                                                      SHA-512:D84C34FA859D047FDB349C7DDD1565C9C640AC2D1A28648BEF94233DE9C84BF3004128E092C18EA5BEFB0541537CF9E29F8B1F3B3A4F6EBFE4B152FBD57F96EE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...............T...7.......T...+...7.......7...%...>...G...4...7...>...D...+...7...9...B...N...G........pairs>Invalid dimension configuration supplied on construction..err.m_logger.dimensions........+...H.............+.......>...G.............+...H.............,...G............./2...4...+...7...>...D.&.....T...7.......T...4...%...7...$...>.......T...7...+...7.......+...>...7...>...3...:...:...9...T...+...7.......7...%...>...T...+...7.......7...%...>...B...N...H.........5Nil dimension handler configuration encountered.'Nil dimension handler encountered..err.value.config....get_dimension_string.m_logger.new#telemetry.dimensions.handlers..require.handler.dimensions.pairs........<....T...7.......T...+...7.......7...%...>...G...4...7...>...D.).....T.......T...7.......T...+...7.......7...%...>...T...+...7...6.......T...+...7.......7...%.......%...$...>...+...7...9...T...+...7.......7...%.......%...$...>...B...N...G........).qAn non existing handler configuration was present in the overrid

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\baseaffidlookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):476
                                                                                                                                                                                                                                      Entropy (8bit):5.4136788360204715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1Q6U6p/WKbI8xRGlbL22soWLIDvKZP9T9rNigX:ZT/WKBrQj2IWZB9pDX
                                                                                                                                                                                                                                      MD5:F95B98EF537E26458134EB5FB3BEF30E
                                                                                                                                                                                                                                      SHA1:29AD79B8811B69508E6EA04EAE75AD997BD728F0
                                                                                                                                                                                                                                      SHA-256:59E0EABD8CE66503543F3B8FCAC73B77DF2344285F0ADBDCDD691947577B4876
                                                                                                                                                                                                                                      SHA-512:660DC1D39F20CF63A3EB8EACCABD5747A32B3DEBD2A4457F443AC922041524CE4BA4E626F8E740BC697A49B57323882B69E146B4BD976E8FBDA892ACD1E05B5B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..t.......+...>...4...7.......%...>...5...5...4.......T...4...7.......'...4.......>.......H......sub.i.j.-.find.string.Z.......4...7...........>...7...1...:...0...H.....get_dimension_string.new.SettingsDBLookup........4...%...>...2...5...4...1...:...4...0...H.....new.BaseAffidLookup3telemetry.dimensions.handlers.SettingsDBLookup.require...//A466B53D82BBB0975B64778B14D01E5F1B53297FB66AFCE5511BB47A555157C7DEB700EF942EC74C13FE9A69C5E0061F3765AB4E95AB737E04E2D109908DE8FB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\bingpartnercode.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):477
                                                                                                                                                                                                                                      Entropy (8bit):5.533719804431993
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Vuuim/fnFF87fuPbI8xRGlbLgusoWLIDvKIVZXYP62Q8:VuuRF42PBrQgu2IWIBI
                                                                                                                                                                                                                                      MD5:D42D60D65C6EAAAB29BC2A2FAB3B2C83
                                                                                                                                                                                                                                      SHA1:1E2B193CD64D9F2DA8A8710F08595A395703A817
                                                                                                                                                                                                                                      SHA-256:6ABCBC75D5CA313B6E8DBC148D31A69A7394B3AE65D4C5EC2F9ACCF48C47F320
                                                                                                                                                                                                                                      SHA-512:E43ECEB7FA7B65B4D4ECD7C59799CB2159AF71C2815A512FB72C22FE53308E4FD93457C19B7C5BAF160B6367BC73AE8223D3A6341C94C49B0CCB1BE28E16D96B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..u.......+...>.......T...4.......7...)...%...%...>...H...%...H......DISABLED.MC01.BingPartnerCode.GetOption.settings.23Z.......4...7...........>...7...1...:...0...H.....get_dimension_string.new.SettingsDBLookup........4...%...>...2...5...4...1...:...4...0...H.....new.BingPartnerCode3telemetry.dimensions.handlers.SettingsDBLookup.require...//1F339FE28D89322EE90A62F559D2FC070167987A57611AB6D54C70E67257D11D93961D437D012689EC5CFCB3BDF210E5CD3A0E9A284BA525D91C802913E8AF22++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\chromebasedbrowserversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1227
                                                                                                                                                                                                                                      Entropy (8bit):5.749537089926924
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:DawizRHhOyyNMvcUv8LvIWFlh5NsBiyvF7o7dOF/yfGIE/oSZf:epvwNmc+UTlh5NsBBN85OZEzSd
                                                                                                                                                                                                                                      MD5:59E3660DF6B2362196C6B8E8CA1F54AE
                                                                                                                                                                                                                                      SHA1:F7ADDDD67022A003647EF6B7DFBE772ED8BDFBA7
                                                                                                                                                                                                                                      SHA-256:8651AE4E29AD18CA32D4BE52F9F3F298C95E36D83698A84CB67BDF6314DE644D
                                                                                                                                                                                                                                      SHA-512:D3C6806383675BB78A126E10D3F17CE78499774C09807931FEB731C6F218F4BD04C956BF28273AAC36B0A30372CC7AF8D0E9D4D668F582A6F98612D0E82E66EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........!%...'...+.......'...I...+...6...4...7...7...7.......'...7...>.......7...>.......T.......7.......>...........T.......T...H...K...H......QueryValue.IsValid.options.root.Registry.Win32.core.........8%...%...+...7...>.......T...7.......T...+...7.......T...+...7.......7...%...>...H...7.......T...7...+...7.......>.......T...4.......T...4...7.......%...>.......T.......T...+...7.......T...+...7.......7...%...>...4.......@........tostringPCould not determine chrome based browser version. Returning default value..warn.%d%.%d.match.string..verion.value_nameRInvalid configuration specified for the chrome based browser version handler..err.m_logger.reg_value.get_dimension_config.pv.0.0.........4...7...............>...2...3...;...3...;...3...;...3...;...1...1...:...0...H.....get_dimension_string.....options.....root.HKLM....options.....root.HKCU....options.....root.HKLM....options.....root.HKCU.new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\currentbrowserversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):664
                                                                                                                                                                                                                                      Entropy (8bit):5.438934203268319
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pn2YuWXhHI7vNiLm5+WRR2JZJAx8hvDIFELGlbLx+b/Iusoa8EeJKk4FVZk5gUmA:5FB2JckwPQxIjE/DFM5gUmRhU
                                                                                                                                                                                                                                      MD5:D6887D9272A72FE94030767AD6DA8741
                                                                                                                                                                                                                                      SHA1:7502CB926BB3F604476B5FB8E6A496101A3FB383
                                                                                                                                                                                                                                      SHA-256:C99CBEC6A54B99F2891A870A534CABBD80E6EC80BD8E9EEF2AD7A344F9227066
                                                                                                                                                                                                                                      SHA-512:F3E6AA5A19EE259A8BD702D0BE93DAFB18B6029859A9DD5B770C10582A1322718C815EC53C1B172B0FEBB344141CD6C7F2D9075176DCC8A1B4045AF611A011D4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........'%...)...+.......T...+...7.......T...+...7.......7...%...>...H...+...7.......T...+...7.......T...)...4.......7...+...7.......>.......T...4.......>.......H........tostring.GetCurrentBrowserVersion.utility.minKInvalid configuration for the CurrentBrowserVersion dimension handler..err.m_logger.browser.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler|.......4...%...>...2...5...4...1...:...4...0...H.....new.CurrentBrowserVersion*telemetry.dimensions.DimensionHandler.require...//318D5E4946AC07064727E087C738C68E0D0892169495B76D381A08014929DA0BAA886E0F4641BCE5A53EEAFA70C690BB903C250453C8747C9115F95A4DE70C90++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\dayssincesettingsdblookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1082
                                                                                                                                                                                                                                      Entropy (8bit):5.6369477565027735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:5Ng/EWZO2o/uAsbD6P1NWcaJDYVysxl6LBPX/KQ382IWkvpSOnh:5NvWZ7o/V1+JeTl6UU82YvpSIh
                                                                                                                                                                                                                                      MD5:978DB8D0F75F299B303FCA069623AD15
                                                                                                                                                                                                                                      SHA1:98BAC6455AD467C4B3F55C2D41DBCE376A62B234
                                                                                                                                                                                                                                      SHA-256:50F24700DCACA141AEBCD9609331C700FDBAB7A5C7CFE054B74553981BA3C80A
                                                                                                                                                                                                                                      SHA-512:AFAC58AE845CA39B07A6159306EC6B7BB064115C40DEE0027F45DE95B594D372D93B2D52EA911EDB2B273380661589C39C06EC6CA360D4EC7AFDABA24FC03F49
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........D4...7...4...7...%...>...=...+...7...>.......T...7.......T...+...7.......7...%...>...%...H...+.......T...+.......T...4...+...>...'.......T...+...7.......7...%...>...%...H...+...4...7...>.......T...+...7.......7...%...>...%...H...+.......4...7...+...!...>.......4.......@..........floor.math.NeverDeclined]seconds_since is default_no_value, toast likely never declined, possibly toast accepted..info.tostringcNo or empty seconds_since or less than 0 database lookup dimension handler (dimension string)..warn.tonumber..UnknowncNo settings configuration specified for days since settings database lookup dimension handler..err.m_logger.default_no_value.get_dimension_config.!*t.date.time.os.i.......(...4...7...........)...>...7...>...1...:...0...H.....get_dimension_string.new.SettingsDBLookup............4...%...>...2...5...4...1...:...4...0...H.....new.DaysSinceSettingsDBLookup3telemetry.dimensions.handlers.SettingsDBLookup.require...//DA9CF16A1D4F2211DD035AC2A514927A9B861CB8E60D7531

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\defaultbrowser.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):960
                                                                                                                                                                                                                                      Entropy (8bit):5.742066795667539
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:qvyNTiZmpV6YlUrZMldjrC+4w3wW4PeQRE/MrF9oOBAPh:nT5pzn7jroM4WUlJBAPh
                                                                                                                                                                                                                                      MD5:16A757D4353469CA57A8FD8B798089AB
                                                                                                                                                                                                                                      SHA1:4D7253ADE67DD89D43956844C7723EF59A314284
                                                                                                                                                                                                                                      SHA-256:53F2A5608EE9148A51A5EAE1FEDEA2E1581FC060B65CD6F8DFA2DDC1C2B6535D
                                                                                                                                                                                                                                      SHA-512:CA1193069E4416EE48EA358FCF00991ED5FB9A7EC24B61B5DFEE58B03D79324225C2DC576B56E7F8F0769F307E7AB3BBFE1B7889E1063FBE4CEF33DE5A6E957F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........!%...'...+.......'...I...+...6...4...7...7...7...%...'...7...>.......7...>.......T.......7...%...>...........T.......T...H...K...H......ProgId.QueryValue.IsValid.optionsRSOFTWARE\Microsoft\Windows\Shell\Associations\URLAssociations\http\UserChoice.root.Registry.Win32.core.........)%...+...>...4...7.......%...>.......T...%...T...4...7.......%...>.......T...%...T...4...7.......%...>.......T...%...T...4...7.......%...>.......T...%...4.......@......tostring.ED.^MSEdge.*.CH.^Chrome.*.FF.^Firefox.*.IE.^IE.*.match.string.UNKNOWN.........4...7...........)...>...2...3...;...3...;...1...1...:...0...H.....get_dimension_string.....options.....root.HKLM....options.....root.HKCU.new.DimensionHandleru.......4...%...>...2...5...4...1...:...4...0...H.....new.DefaultBrowser*telemetry.dimensions.DimensionHandler.require...//F0D953EE9EFD9E49B91FD09048ED16FECC4AE5FA99A99EB7D83C30AB742FF5634F25BBEDDEE6ACDFCD447F7DC3E3AD6636135B819383D3A765128A795E40DDD9++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\eventsupplied.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):710
                                                                                                                                                                                                                                      Entropy (8bit):5.574151663922507
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:jaQk3/t9f1sBivMGpRXJAapC0Bid/9IFEzGlbL1soa8EeJK9FvdFTQRMhkd3h:GRlVT75PRBidxQ1E/99zhk9h
                                                                                                                                                                                                                                      MD5:F103A0CB3D64D9A13ED059B5510AAD56
                                                                                                                                                                                                                                      SHA1:CEDE40B26B28EBAC6AD7E896FC3398A4D814E6BC
                                                                                                                                                                                                                                      SHA-256:C1E372001BE3F4F627BB2A16C4FD38A2317D879573134FA5337AD34562542C64
                                                                                                                                                                                                                                      SHA-512:D48752EBFB84A0774D598C8CE46A1BB56FA672C35D87D07ECEFE42D856627B307E5073CB6AC8540E5D8525CD75DDB26B9BAD1F5D58A4EE10D54DF17984206C33
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........%%...+...7...>...+...7...>.......T.......T...7.......T...+...7.......7...%...>...H...7...6.......T...+...7.......7...%...>...H...T.......4.......@......tostringLNo data found for event_mapping in the EventSupplied dimension handler.CInvalid configuration for the EventSupplied dimension handler..err.m_logger.event_mapping.get_event.get_dimension_config.Z.......4...7...............>...1...:...0...H.....get_dimension_string.new.DimensionHandlert.......4...%...>...2...5...4...1...:...4...0...H.....new.EventSupplied*telemetry.dimensions.DimensionHandler.require...//63B46B40570148D617372C3A84C9AD52F0E8515F04F0ECD147AFDCD5A2B6B5826A74E5F32D6B826E97DA4C65CE8AE45E789C79501F8E14F92AF31F248807BDB3++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\externalutilityfunction.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):920
                                                                                                                                                                                                                                      Entropy (8bit):5.586798976747188
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:VxuQ23xqRopU5aedVf507iUXU0Ol4lRqwJQgJE/dNE+Qd0:OF3xyVf5Ci4lR/dJ5+I0
                                                                                                                                                                                                                                      MD5:BF496804EE8F1648634531ECFAB05CC9
                                                                                                                                                                                                                                      SHA1:C1E96EA1650B5D0D033EF60385B780F99C6C48B5
                                                                                                                                                                                                                                      SHA-256:00AD60FD1ABC465098CDDB5DC5C10540F8DE2FFD3C20C05FAD08490B20874301
                                                                                                                                                                                                                                      SHA-512:26D238B9ED93358A5FEC4CE3AC08BA85AAAE291FC3028FF4585663CB80E429D4085B7A97D5B30929C58291A1E97C727A847B493B7338A4C20ED4CE5E83A3B08B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........B+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...%...H...4...7...).......T...7...6.......T...+...7.......7...%...7...%...$...>...4...7...@...........>.......T.......T...+...7.......7...%...7...%...$...>...4...7...@...4.......@.....7) return invalid result. Returning default value...tostring0) does not exist. Returning default value. External utility function (.utility._G.defaultSInvalid configuration supplied to external utility function dimension handler..err.m_logger.func.default_no_value.get_dimension_configZ.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler~.......4...%...>...2...5...4...1...:...4...0...H.....new.ExternalUtilityFunction*telemetry.dimensions.DimensionHandler.require...//3C179FEF97B64028ADF59B457194394F521EB355283D579B45DECD3F1E03A83BF711F2658E375FE332B81020DE03F78C48C62E6B3972C284C7BA6C0BCAA28F42++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\featuretrackingfeature.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10367
                                                                                                                                                                                                                                      Entropy (8bit):5.515936680866457
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:s/NSy1sOMTnv9O5xwTlStiBDbEfFwE+0aH1zatOH+Cndm:iNSWMTvgxwTNmFz+FTm
                                                                                                                                                                                                                                      MD5:6223FBF275EACAF67EC3BC8D5EBC7D91
                                                                                                                                                                                                                                      SHA1:8884BB8C79D159E5C0AED920ED6866632958CD1D
                                                                                                                                                                                                                                      SHA-256:92A453D67DE1A2035302EFF4746E31D629CDEE881C038F6D113B527C74532AC2
                                                                                                                                                                                                                                      SHA-512:CBAE276DBAF7064088E3A08B868211AAF1A9678B00C7D6BA9599A3709F83BCDC7BDE53C248431D659CDD54C5F3890B7D38A03D190055FD449818508B9D4C734C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..V.......+.......,...+...+...6.......T...+...+...6...+...+...+...6...6...F...G..........d.......2...4...+...>...D...........9...B...N...4...7.......>...'...1...0...H.......sort.table.pairs.........P%...+...>...T.I.%...'.......'...I.>.6...7...6...7...6...7.......T.......T.......T...4.......7...4...4.......7...........%...>...=...4.......>...=.......T.......%...$...T.......%...$...T...6...7.......T...+...7.......7...%.......%...$...>...T...+...7.......7...%.......%...$...>...K...........%.......%...$...A...N...H........=2) was detected when processing FTF dimension..Invalid information for (.err%) when processing FTF dimension.'Skipping version information for (.info.m_logger.version.0.1.GetOption.settings.tostring.IsMatch.regex_helper.enablementCriterion.enablementSetting.scope..,.........4...7...............>...4...7...1...1...:...0...H.....get_dimension_string..FTF_Registry.FeatureTrackingFeature.new.DimensionHandlerj.......+...7...6.......T...'.......'...I...6...7.......T...6...7

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\firefoxversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):944
                                                                                                                                                                                                                                      Entropy (8bit):5.7311123343592
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6uEizpoK7Pl5ABlvQceBBiTA/3UJPyfZIE/4ERRGhyeC:6Tep/zl5ALQceBBz/EJPfIRRuC
                                                                                                                                                                                                                                      MD5:0AD2BBA2034104BAA6AA1F16F1C57C58
                                                                                                                                                                                                                                      SHA1:8054F1B5476B1DF5230ABFC54CBF57E1FB70FA22
                                                                                                                                                                                                                                      SHA-256:2F8D887C0A49853B0F2513D388C009C4CEFB1543CC348AA3B8C00EC8655B6C91
                                                                                                                                                                                                                                      SHA-512:082794C77E146E228F769F3687C04E27EDEBB01AB04F457BD3DC653F59BBF5E49D2D315D724E488FFDF48FF640F9604548A13A2EB8B2582F12ADF749F145C895
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........!%...'...+.......'...I...+...6...4...7...7...%...%...'...7...>.......7...>.......T.......7...%...>...........T.......T...H...K...H......CurrentVersion.QueryValue.IsValid.options%Software\Mozilla\Mozilla Firefox.HKLM.Registry.Win32.core..........%...+...>.......T...4.......T...4...7.......%...>.......T.......T...+...7.......T...+...7.......7...%...>...4.......@........tostringKCould not determine Firefox browser version. Returning default value..warn.m_logger.%d%.%d.*.match.string..verion.0.0.........4...7...............>...2...3...;...3...;...1...1...:...0...H.....get_dimension_string.....options........options.....new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.FirefoxVersion.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//1A1A3E479663120B55DBAA4CD7FDA571FC6B9D644F1F549C59FDD58DB8F244B24BCFA8B75323489F3553692066177F9D1E850742E6EFF326F2DDE24D3D176485++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\freesysdrivespace.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):877
                                                                                                                                                                                                                                      Entropy (8bit):5.648593845506757
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:NArqbNXua3My0VqQJsFDTwVZQIrE/Dok60ZcjtG:6rqb5ueMy0VqQJsFDsZZrW606G
                                                                                                                                                                                                                                      MD5:98271AB7D7831BDD20DDA244B59C6217
                                                                                                                                                                                                                                      SHA1:AFB04701AC93F8BCB011302868159901DCF11324
                                                                                                                                                                                                                                      SHA-256:3304431B9BCF2ADC4D6B8690F91114BF308260BD35F90AD058938CAEBE8C73F5
                                                                                                                                                                                                                                      SHA-512:7EEE6C1452D5A04C0156A1FDD31FA515E5385F458E420179AF0881717565CA6B8CEA781B59AC90FB2EDC9F07A691C4E4C18A4C4B1FC505DDD6F14CF014B9A7B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........4+...7.......7...%...>...4...4.......7...%...%...%...%...>...=.......T...%...H...+...7.......7...%.......$...>...4.......7...%...%.......%...$...%...%...>.......T...%...H...+...7.......7...%...>...4.......@.....#FreeSysDriveSpace handler: end.FreeSpace."?select FreeSpace from Win32_LogicalDisk where DeviceId = ",FreeSysDriveSpace handler: sys_drive - .(error).top.SystemDrive2select SystemDrive from Win32_OperatingSystem.Root\CIMV2.get_wmi_properties.utility.tostring%FreeSysDriveSpace handler: start.info.m_loggerZ.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandlerx.......4...%...>...2...5...4...1...:...4...0...H.....new.FreeSysDriveSpace*telemetry.dimensions.DimensionHandler.require...//0B10908333B1C12FA7A6DA366AEEA49A5D0BB8E1CA901DEBD81FFADF4085738FBB7FC3A84B0CA034909006C0343C552BAF6A2DED45C033F301CB8F3788330F53++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\installdate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1201
                                                                                                                                                                                                                                      Entropy (8bit):5.702915106510578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:btQqS50t5bpZwMyS/Qns3e+vkB3dMuaBUiXJkhyfGV72IWP9+CNGb:h5S5cZPwY/Ks3GByuaBUi58F72pfNW
                                                                                                                                                                                                                                      MD5:CE421C13B30127C0A13ADDC6951F41E6
                                                                                                                                                                                                                                      SHA1:45C491452BC88F35705E474E69E2E72667944236
                                                                                                                                                                                                                                      SHA-256:8A4D7387E61905D5AB7E182C34EB462FFAC515B590A52384D55B82E2B31C027C
                                                                                                                                                                                                                                      SHA-512:6F89315B163A47F68BADB7083EFCC9992525D231AF0618EF441C96AE1E4B766BFC19089079BFD83BB50A005D334C230BA5B1C0CFB2900488C1D131A014E5546A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........-)...4...7...7...%...%...'...(...>.......7...>.......T...+...7.......7...%...>...T.......7...%...>...........T.......T...+...7.......7...%...>...T...4...7.......%...%...>.......H......-.gsub.stringVCould not find registry value (HKLM\Software\McAfee\WebAdvisor\EulaAcceptedDate)...EulaAcceptedDate.QueryValueDCould not find registry hive (HKLM\Software\McAfee\WebAdvisor)..warn.m_logger.IsValid.Software\McAfee\WebAdvisor.HKLM.Registry.Win32.core...........6+...>.......T.......T...+...>.......T...4...7...%...4.......>...=...4...7...%...4.......>...=...4...7...%...4.......>...=...4.......>...4.......>...4.......>...$.......T.......T...+...7.......7...%...>...%...H...H..........00000000=Invalid date returned. Returning default of '00000000'..warn.m_logger.tostring.!%d.!%m.tonumber.!%Y.date.os._.......4...7...........>...7...1...1...:...0...H......get_dimension_string.new.SettingsDBLookup.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.InstallDate.mfw.core.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\isbissecuresearch.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):593
                                                                                                                                                                                                                                      Entropy (8bit):5.607703051109243
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:SX+7QkyCnxljwuG/FBid/9IFEJnZGlbLJ2jsoa8EeJKAZ5fLDsUVv5maCGw:SX+mCxljoFBidLZQJ2jE/W5PVpCGw
                                                                                                                                                                                                                                      MD5:337313A443011638657399399F352370
                                                                                                                                                                                                                                      SHA1:41091C791859122EA78316FFED681A76AA91627B
                                                                                                                                                                                                                                      SHA-256:CE4CA20AA963F91CF62FD695AE5002AB07BC3C5FEC0240BDDBE49E6A10C58C08
                                                                                                                                                                                                                                      SHA-512:3F59C5C1C4F5EF4DA76241B1F095661D4BA03D4C7ACF8B562A3622CD01A054536DDD95A720F72401410C68244788262A947B245D653A904D06D140F03B20DFC9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...'...>.......T...+...7.......7...%...>...'...H...4...7.......%...>.......T...'...H...'...H......search.yahoo.com.find.string3Received nil value for ISB default search url..info.m_logger.GetDefaultSearchURL.browserSettingsZ.......4...7...............>...1...:...0...H.....get_dimension_string.new.DimensionHandlerx.......4...%...>...2...5...4...1...:...4...0...H.....new.ISBIsSecureSearch*telemetry.dimensions.DimensionHandler.require...//45F2E5345915E5A6A6787A720D83D9FB23E309D878F18AD219E787E1C9B823E0E3ABAE65CD4CA87408A1E14A70234B207EB894A90D27984AF8D7D228F3B763BB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\lastbrowserused.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):614
                                                                                                                                                                                                                                      Entropy (8bit):5.660852486267045
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:5UQ3FgiWlB+fVMHkp/n09fqbI8xRGlbL3gUsoWLIDvKmViawhpU2XfJ96sD:5UQ3eF4QA89fqBrQ3V2IWmViJpUubD
                                                                                                                                                                                                                                      MD5:ECC87EDA6FD32AAA2689AF907A28656D
                                                                                                                                                                                                                                      SHA1:84ECB84093D36747BF82A2ADD21CDDD62D816C37
                                                                                                                                                                                                                                      SHA-256:66DC68566487E547D82563F276B39F6C968443B585E4333C455A8947B3D788B7
                                                                                                                                                                                                                                      SHA-512:7F5C3E4263D35513285814088139AAABEF46EF2F4641B73B0E2C977B736D9B4BF413CEEF0AB7467F502125E80D2C0CA470C8E250DB521D71DFBFE58ED89E219F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........!+...>.......T.......T...+...7.......7...%...>...%...4.......>...%.......T...%...T.......T...%...T.......T...%...T.......T...%...H........UNINITIALIZED.CH.2.FF.1.IE.0.OTHER.tostring.-15Invalid date returned. Setting default of '-1'..err.m_logger.Z.......4...7...........>...7...1...:...0...H.....get_dimension_string.new.SettingsDBLookup........4...%...>...2...5...4...1...:...4...0...H.....new.LastBrowserUsed3telemetry.dimensions.handlers.SettingsDBLookup.require...//91C8E78C3654B8BFBFE76D384E9C6539A9C82FD8ACA8384673892C1FF8EFF386BD4EEB21EC13BDE7AB8BB5D89C47CEAFA8AD16DDAEEDFB701146DFABAC33E824++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\lastoemcheck.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):671
                                                                                                                                                                                                                                      Entropy (8bit):5.528820547453615
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:dI/fkUv7/UgSeYgi/qfu8cUEWWI8xmGlbLxg3soWLIDvKFAwcTU/5NKp6:dtUT/UmSq2GJkUQm32IWwgLE6
                                                                                                                                                                                                                                      MD5:135E16B9EF79E219D898AB5156726B27
                                                                                                                                                                                                                                      SHA1:BD33051138E0CB209B657D50A9CD19E01F9660E0
                                                                                                                                                                                                                                      SHA-256:C5254E87B9BFE0B3F0E23865334D84158B5B7098D2756098DCF985D1F21B3CD8
                                                                                                                                                                                                                                      SHA-512:DF6BB0B7A4F527A0FFB66CEA78E56CC8E3A61DA4BEEC00267E69B24F304F70F861AD1273D5517EC00F69A364F166A822F77125D8372FAE1CEEC3A487AC13C3EA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..4.......4...7...4...7...%...>...?....!*t.date.time.os........(+...>.......T.......T.......T.......T.......T...%...H...+...>...4.......>...4.......>.......T...%...H...4...4...7...4.......>...4.......>...........>...=...H........floor.math.tostring.(LastOEMCheck>current).tonumber.(LastOEMCheck=0).0.default....._.......4...7...........>...7...1...1...:...0...H......get_dimension_string.new.SettingsDBLookup|.......4...%...>...2...5...4...1...:...4...0...H.....new.LastOEMCheck3telemetry.dimensions.handlers.SettingsDBLookup.require...//554F50A25DA476623BDA04D3A3CA4A791DF61BD039BAF97197D9C4A5B381E4FA441DE680707DF867ADE92C583736CFC9356B2DB35D35BB2A398980516375F2E0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\locale.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):624
                                                                                                                                                                                                                                      Entropy (8bit):5.581493778568022
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:ojgqedo93EwgjZ7rcf/FBid/9IFEKGlbL73Usoa8EeJKzOWqGj:23hercXFBid4Q7EE/3j
                                                                                                                                                                                                                                      MD5:8316788EAEE6FB806CB893F88632913C
                                                                                                                                                                                                                                      SHA1:6F5E0049C6B2DA6083DA116037C5F58ED50566B5
                                                                                                                                                                                                                                      SHA-256:DA06F323536810ED8CC8EAA3B743BAC9A0D328EECD1A86A06D1AB1BE4301A944
                                                                                                                                                                                                                                      SHA-512:A40BAE9C9C805F133058A8D01E87EA4F8B5F6940C26E80937A3C1E5F211253F435B48029FEF0E3A14F16614F5991F44362CC8919699A33E6CF3A974F7E11D50F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.........."4.......7...)...%...%...>.......T...4.......7...>.......T...4.......7...)...%.......>.......T...+...7.......7...%...>.......4.......@......tostring1Failed to update locale in settings database.err.m_logger.SetOption.en_us.GetLocale.utility.UNKNOWN.*Locale.GetOption.settingsZ.......4...7...............>...1...:...0...H.....get_dimension_string.new.DimensionHandlerm.......4...%...>...2...5...4...1...:...4...0...H.....new.Locale*telemetry.dimensions.DimensionHandler.require...//6E9B51B55FA8BE769D4151577A621951C0B17DF68D72AAAEAF911E4006BB0242BF889FF7DC4E549BC93D4DD456752A6AB7851D496DFBD0DF55FFA4E5D673C214++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\msspstatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1535
                                                                                                                                                                                                                                      Entropy (8bit):5.649690417942136
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:4tBgAtMXhaXNkgKeVdV90+r3uShqVJCaZRetVGalRikZyCmBiuIwyfaAIE/il3Wg:4tmAi09K8V9ppqfCasHlRikZyCmBrtbH
                                                                                                                                                                                                                                      MD5:318E250B73F7345FBA36D2D8F10A71E8
                                                                                                                                                                                                                                      SHA1:4A3E877AD4CA294C840EDF10AF93815BAE2005D4
                                                                                                                                                                                                                                      SHA-256:DAAE907E933B1C69AE4D4DFFF6F3F14A33829834E2CAD2F599FF9A4ED740278E
                                                                                                                                                                                                                                      SHA-512:8D259D6EFA70731DC1B0D414FFC77A2D824BB3E83C6B3AA961969EFBBF6327736F44C6F9957038304FC080BAB947C15E416CDFDBA35D2AB05D1A164AE2340652
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..k...........7...%...>.......T.......7...%...>.......T.......7...%...>.......T...)...T...)...H....|.&.%%.find........1+.......>.......T...+...7.......7...%.......$...>...)...H.......7...%...%...>.......4...7...%.......%...$...>.......7...%...>.......7...>.......7...%.......$...'...)...>.......T...)...T...)...H........Directory of .find.close.*a.read." 2>nul.dir ".popen.io..\$.gsub%Unsafe directory path provided: .warn.m_logger........*%...4...7...7...%.......'...(...>.......7...>.......T.......7...%...>.......T.......T...4.......@...T...+...7.......7...%...>...%...H...+...7.......7...%...>...)...H..... MSSp not found in registry..version_not_found1MSSp 'DisplayVersion' not found in registry..warn.m_logger.tostring..DisplayVersion.QueryValue.IsValid.HKLM.Registry.Win32.coreYSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Security Scan............%...+.......>.......T...%...H...+...7.......7...%...>...)...H.......3MSSp default installation directory not found..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\osflavour.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):796
                                                                                                                                                                                                                                      Entropy (8bit):5.734009988260523
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:42zss2kgRt5EIjq0MexRV2DiXwr7yf0IE/tP51chn:4zs29Rt6dozA7KG1chn
                                                                                                                                                                                                                                      MD5:ADF9E9B1B576B3F6CF82A999061099DA
                                                                                                                                                                                                                                      SHA1:C33401687C31BBF06B0C9E36C037C3EC85742CCD
                                                                                                                                                                                                                                      SHA-256:87DFD7610A853A2D94706DC9E2340824609469A7BCCB9E5B4674DA9CF05FBEA4
                                                                                                                                                                                                                                      SHA-512:95D53FCFADCAE71C4F3E07AEB975AF9C1A5CAE19470C242F9FAC9EAD816BBC673D2C4DF95F3605A2332B4B30289AD8115C9545D2E525385BDEDD301685C69CE9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........../%...4...7...7...%...%...'...(...>.......T.......7...>.......T...+...7.......7...%...>...H.......7...%...>.......T.......T...H...........7...%...>.......T.......T...H.......%.......$...H...... .CSDVersion..ProductName.QueryValueTInvalid registry configuration specified for registry lookup dimension handler..err.m_logger.IsValid1Software\Microsoft\Windows NT\CurrentVersion.HKLM.Registry.Win32.core.UNKNOWN...Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.OSFlavour.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//85E1D2A00A01796D0C31F1E6B50FA843A39394323D2668A0CB8ABAE0EF71F44F4E4476DF578DD026ACC48E12330D1E7D6C77EF0C393F863A612DE1AB299CE14D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\percentagehandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1139
                                                                                                                                                                                                                                      Entropy (8bit):5.617910814753135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:oJTFkYWS+9WJA7R2l18u4xCogvpYe0HBJ2sF8xDoSUU1dqE/7wh+1kHi:IBWJWHV4xCoHHB5MxUPASokC
                                                                                                                                                                                                                                      MD5:57677ABC319C470A0BC98EA829B1D819
                                                                                                                                                                                                                                      SHA1:F8C42BDEAE999DCA885AF61DFF75B090EED2E641
                                                                                                                                                                                                                                      SHA-256:9DFBFD03E5B052442A4C596BA3DF3E73AAF03720888EF1EA2018E304E22FDF84
                                                                                                                                                                                                                                      SHA-512:AC33236E074260BEEEBCE94A51B7CA1A480F39E99E5184823E171C2DFC3FA4A76E0F531889F19D36B150728C808DA5271D82C59E2AF3CEAEE21A6243CAB6D7E1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........C4...7.......7...%...>...%...+...7...>.......T...+...7.......7...%...>...%...H...7.......T...7.......T...+...7.......7...%...>...%...H...4...4.......7...)...7...'...>...=...4...4.......7...)...7...'...>...=...'.......T.......!...4...4...7.......>...=.......T...%...H......(Division by 0).floor.math.tostring.GetOption.settings.tonumber.(invalid config)]Invalid settings configuration specified for settings database lookup dimension handler..Denominator.Numerator.(no config)XNo settings configuration specified for settings database lookup dimension handler..err.m_logger.get_dimension_config.+PercentageHandler get_dimension_string.info.log.core...........4...7.......7...%...>...4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.PercentageHandler new.info.log.core.........4...%...>...4...7.......7...%...>...2...5...4...1...:...4...0...H.....new.PercentageHandler"PercentageHandler file loaded.info.log.core*telemetry.dimensions.DimensionHandler.req

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\postupdatereboottimelookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1077
                                                                                                                                                                                                                                      Entropy (8bit):5.61305864934836
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:3/xh0BpUZbdJDsPA3VCoSej7eG7wnQMaE/aUeRWdN:3/yybzgPmCsi37a5WX
                                                                                                                                                                                                                                      MD5:1E077DC5770C978C805EF2AF627A4515
                                                                                                                                                                                                                                      SHA1:02ACF886C4519E1C11147F7C2783103401C2B91E
                                                                                                                                                                                                                                      SHA-256:26B49287BEC95B0A904F84B28A9C14D6256E167C74C4CED9B691CE9CFFAE8F75
                                                                                                                                                                                                                                      SHA-512:6B72FA92CD3BDE85B8EC772CE4D4444970279A070FE2D7B78841C1C2E495EFAB28C1318B18AF06009C644755B47D9B8D972B610B43696E6E073C6559B02E1234
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..i.......4.......>...5...4...7...4...>.......T...Q...%...4...$...5...T...4...H....0.len.string.str.tostring........n4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...%...>.......T.......T...%...H.......T...%...H...4.......7...)...%...'...>.......4.......>.......T...4.......7...)...%...%...>.......T...H...4.......7...)...%.......>...4...7.......>.......................................'..'....T...'..'+.......'...>...+.......'...>...+.......'...>...+.......'...>.......%.......%.......%.......$...4.......7...)...%.......>...H......:.floor.math.SetOption.UpdateDelay.tostring.UpdateDelayDelta.pending.fresh.!VersionChangingRebootPending.*InstallDate.*LastUpdate.GetOption.settings..x0_.......4...7...........)...>...1...1...:...0...H.....get_dimension_string..new.DimensionHandler.........4...%...>...2...5...4...1...:...4...0...H.....new.PostUpdateRebootTimeLookup*telemetry.dimensions.DimensionHandler.require...//BE73AD670CE8B09363882C12396CBA992F134E88D5AC37760D7F2

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\profilescounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):574
                                                                                                                                                                                                                                      Entropy (8bit):5.63619246865634
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:akDwdyqX6hmC+zivcxC7yBid/9IFEemGlbLrsoa8EeJKoW3hKVstScx:akDwdyqX4D+GkjBid3QrE/L3hAstSS
                                                                                                                                                                                                                                      MD5:ACB46C42AFF4FBABF60498703950DCA7
                                                                                                                                                                                                                                      SHA1:76E28263AD2D1EF994BF8980D1D2ED6E18A7CBB5
                                                                                                                                                                                                                                      SHA-256:A334539053034345E14AF6FD2006FA860BD16C81068C4435A21E741B6378BB65
                                                                                                                                                                                                                                      SHA-512:56BA3B65894D95587AB59925328D1A2D94D1D27EE0C5A96FA884A7D1D0FE6F93C519CDA6E14A10461AB8EF244E10C01DE42838D7C47E0AD34C3BE043571A23FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...>.......T...+...7.......7...%...>...%...H...'...4...7.......%...>...T.......T.......A...N...4.......@......tostring.SYSTEM.[^,]+.gmatch.string.0.Failed to get scopes.err.m_logger.GetUsersScopes.settings.Z.......4...7...............>...1...:...0...H.....get_dimension_string.new.DimensionHandlerv.......4...%...>...2...5...4...1...:...4...0...H.....new.ProfilesCounter*telemetry.dimensions.DimensionHandler.require...//675EB2632D1930A1976E5FF6B84AFCF0FF6E02C979EC4898FF31B1F27CC2BE987E73B219A44882649C1B0D66E3CE9511242A81C1084E7DA76B3AF427BBF1703D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\proxysubtypehandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):788
                                                                                                                                                                                                                                      Entropy (8bit):5.711728334221568
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:HX4kaJmDRtgHnaDf4cQjENpE/3VWupTpER0t:H+3nFcp0BER0t
                                                                                                                                                                                                                                      MD5:50A921F933295E9A77C2E2EECD16FF5A
                                                                                                                                                                                                                                      SHA1:031898160EA59924ED1D4E8A362EE5F4A8B26381
                                                                                                                                                                                                                                      SHA-256:ED96A719FDA62ABAD169D53AB29A2A14D5BDEAA3757B1CD316E8B1AA53F7F027
                                                                                                                                                                                                                                      SHA-512:5C0189AAC109D9426625D8767AAC9B1AC7E1CC3FC882DB0F0088F0D663F544FCEB620919F396C9E9D95A0D481777600CFEDDB354AD4CA061E73EEDB7FFDB65F6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........<%...4.......7...)...%...)...>.......T...%...T...%.......%...$...4.......7...).......'...>.......T...%...H...4.......>.......'...+...7.......T...4.......7...)...%...'...>.......T...+...7.......T...4.......7...)...%...'...>.......4.......@......tostring.ProxySubTypeFirefox.FIREFOX.ProxySubTypeSystem.SYSTEM.tonumber.-1._PROXY_PREF.StreamingHost.*GTI_REST_URL.GTI_Streaming_Disabled.GetOption.settings.X.......4...7.......)...>...1...:...0...H.......get_dimension_string.new.DimensionHandler.........4...%...>...2...5...3...4...1...:...4...0...H.....new....FIREFOX...SYSTEM...ProxySubTypeHandler*telemetry.dimensions.DimensionHandler.require...//93503AE5773A9C3FA8483A5A8628EDBDC5B354CF795466C83C097ECA3CC64FE563E58445B87F497003366B900212D03EAA11BDE6956A5CE4B75A1C1CDED936D2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\proxytypehandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):745
                                                                                                                                                                                                                                      Entropy (8bit):5.653400225958077
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:J1Z6GeBYv/BwkSIQCD3czFAE5fzyrofsx/+WIFEthoU1wZDZtsoa8EeJKMIpY102:2Sv6koDfLwokIBU16E/u84x3
                                                                                                                                                                                                                                      MD5:6052055C887D45B0FC4921A4686C056C
                                                                                                                                                                                                                                      SHA1:60C8EAAD9C57195E3ADC503269EC4B8B0F3CF576
                                                                                                                                                                                                                                      SHA-256:30A6A0E8E0E5D1ED67D20DE05A3487AE0A24A6A9AA515E98BB1D27E92B3CD282
                                                                                                                                                                                                                                      SHA-512:F90597C58376F5A61A3FFC2262CD8109338DD908CD19536F7839230D3444D91DC96FAF5597F0ECB124BC8AC184C4B66854332C168CD70432EC72F9684D53A2BE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.........."+.......7...%...>...%...4.......7...)...%...)...>.......T...%...T...%.......%...$...4.......7...).......'...>.......T...%...4.......@......tostring._PROXY_PREF.StreamingHost.*GTI_REST_URL.GTI_Streaming_Disabled.GetOption.settings./ProxyTypeHandler self.get_dimension_string.info.............7...%...>...4...7.......)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.ProxyTypeHandler.new.info.........4...%...>...4...7.......7...%...>...2...5...4...1...:...4...0...H.....new.ProxyTypeHandler!ProxyTypeHandler file loaded.info.log.core*telemetry.dimensions.DimensionHandler.require...//7968E13D37266FDA58C03F3105A31D33B4C9359114CFC7E62BB97ADC7B7065991E0B0F4A6CF6223B27B87A4E76D5BF343C1E5E543DD57BD94418E873F5C69A19++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\registrylookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1256
                                                                                                                                                                                                                                      Entropy (8bit):5.680360827283436
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:2BUmzVlTMnj8PiiRyWDt2LpdfFUpFe7xFnwmyfqGIE/tzLL:2BV9MnjoiiRJDULpkARFQ
                                                                                                                                                                                                                                      MD5:48CD1C03EABB49BFF8E9FA49A9ED8AD8
                                                                                                                                                                                                                                      SHA1:446A761DB2BE89C7D0F16DEB55A644DB8287D983
                                                                                                                                                                                                                                      SHA-256:1B9312CE2E101697C99327441406F842FC537139114439C724AF260A6C3B2FC8
                                                                                                                                                                                                                                      SHA-512:4E2A7108C4CB3958F8EBFF960A8446F7E4C5CD91230AC5EFF03895E257892BE4DEB9621C43E8493283B37209A6FF26867B8B7A14F789920BC43583648AB0E63C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........m%...+...7...>.......T...+...7.......7...%...>...H...7.......T...4...7...>.......7.......T...7.......T...7.......T...7.......T...7.......T...+...7.......7...%...>...T.@.4...7...7...7...7...7...7...>.......7...>.......T...+...7.......7...%...7...%...7...%...$...>...T.'.....7...7...>...........T.......T...+...7.......7...%...7...%...7...%...7...%...$...>...7.......T...4...7...>.......T...7.......T...4...7...>.......T...%...4.......@......default_no_value;Invalid result returned for registry lookup on value (.QueryValue.)..) (#Could not find registry hive (.warn.IsValid.Registry.Win32.coreTInvalid registry configuration specified for registry lookup dimension handler..sam_desired.value_name.options.sub_key_name.root_key_name.tostring.default_no_keyONo registry configuration specified for registry lookup dimension handler..err.m_logger.get_dimension_config.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.........4...%...>...4...%...>.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\samrecoverable.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):851
                                                                                                                                                                                                                                      Entropy (8bit):5.75245667676142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:pUiFYQQOdiwWe9f6wMHjDVaaVoavoa7h4aVdZIfOq8hvDIFECGlbLnCybsoa8EeU:pUEYQTxkwMDwaLvpV53SJw2QfE/DAmNh
                                                                                                                                                                                                                                      MD5:0B7E38C5D82915C65DF025CC35F3FD34
                                                                                                                                                                                                                                      SHA1:E25865E7DECF9BB352C67EBD46DFB9FFB09E5040
                                                                                                                                                                                                                                      SHA-256:F04184539F0B6018F0CBE1C3E3FC216A585C4790B326DB19B3A410A601FA6358
                                                                                                                                                                                                                                      SHA-512:09AA09B9C6D650CED888F8181906DA461CEB0C046665EB8A629447BAA48515C178222D849B404871EE7AAEF789DCDDC3F406909C4B23C9F451F362EA51F4F89E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........;'...4.......7...)...%...)...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...)...%...)...>.......T.......T.......T.......T.......T.......T...'...4.......@....tostring.oem_recovery_v2_disabled0*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WA_INSTALL3*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_UNINSTALL4*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_ACTIVATION0*DEFER_SEARCH_MINIMUM_DAYS_AFTER_WSS_EXPIRY.*ShowSearchSettings.GetOption.settings.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandleru.......4...%...>...2...5...4...1...:...4...0...H.....new.SAMRecoverable*telemetry.dimensions.DimensionHandler.require...//6A816EE479C15CC53D89B083D9927869BBBC034409DE50B77404B4916F869E20A214EAFD1B8D7054774B29DB17C641692C3FD07FA8D63C2968870B285C9F7E36++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\searchannotations.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):597
                                                                                                                                                                                                                                      Entropy (8bit):5.623510286623993
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Tg6Yp3Rc9rGSxfzJWW7WIFEJnZGlbLx3fsoa8EeJKQThdW/Z5IdDOrwph:TWVO9rGkNJUZQx3fE/whMR5Trwph
                                                                                                                                                                                                                                      MD5:9E054FD0148467838980D195AA1ED6EB
                                                                                                                                                                                                                                      SHA1:BA9D55DF49FD1DD01305746D329075F46AF229D9
                                                                                                                                                                                                                                      SHA-256:5BE3C042207CAACE9533070229B4B1552897813C1DF06CF77462D2E8E854892C
                                                                                                                                                                                                                                      SHA-512:F7570E12F9A7BDAEA7A6E06BBAC629BBDB2C8C03286CE9F6AF39DD9F4F12A6B6D209B98180CD1E5EB8FFCF8396E7B550B6C6AC106E4D3A44A6F6F65D9D553ABA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...)...%...%...>.......T...%...H...T.......T...%...H...T.......T...%...H...T...%...H...G....InvalidOption.AllSearchAnnotations.ALL.NoAnnotations.NONE.SecureSearchOnly.ONLY_SECURE_SEARCH..*CurrentSAOInExtension_ch.GetOption.settingsV.......4...7.......*...>...1...:...0...H.....get_dimension_string.new.DimensionHandlerx.......4...%...>...2...5...4...1...:...4...0...H.....new.SearchAnnotations*telemetry.dimensions.DimensionHandler.require...//B4B64BB1391FEF389BB39AE23E77C3A386CCEAAB34ACAC5D48A71FC573BF4E564F2A9AC32DBEC55B7214E348C20033A02E37793DB3E0CF96F76D24B2504FE7B2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\sequencenumber.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):834
                                                                                                                                                                                                                                      Entropy (8bit):5.629087733674158
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:138//rPMsptXkvTkZSrs0kI07iMNRtfYNiVWW7WIFECGlbLnrWbsoa8EeJK3eQzL:m/zkszSaFiWnQ+J/QrWbE/r+kqaT
                                                                                                                                                                                                                                      MD5:29007B45FA7BCA00DCFFAA7F4583B516
                                                                                                                                                                                                                                      SHA1:E8C6E4416F1AADB33FB10C4FE95BA3A450032327
                                                                                                                                                                                                                                      SHA-256:EFF0BC9336531CE9D9F7355C838DDA79DB3AC28EE41033A8F0B1F1EF76C6DA05
                                                                                                                                                                                                                                      SHA-512:6D6E54271756A63FED5B14177DD1F9BB0A51B41E64C769948B9B20EEF95EA0509EC8506C12DA29CBE6A50EED73B4CC713F73CA5D81E5193A4D3AA3B7390815AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........G%...4.......7...)...%...)...>.......T...H...4.......7...)...%...'...>.......T.......4.......7...)...%...'...>.......T.&.+...7.......7...%...>...T...4.......7...)...%.......>.......T...+...7.......7...%...>...4.......>.......4...7.......>...'.......T...Q...%.......$...T...4.......@......0.len.string.tostring&Failed to update sequence number.;Failed to update sequence number after rollover event..warn.m_logger.SetOption.*SequenceNumber.*SequencingOn.GetOption.settings.OFF.....V.......4...7.......*...>...1...:...0...H.....get_dimension_string.new.DimensionHandleru.......4...%...>...2...5...4...1...:...4...0...H.....new.SequenceNumber*telemetry.dimensions.DimensionHandler.require...//05B097150632CDA41E050A36A6B34028F8FDA9E300EFAD23C1CE4403DA17A58CBF2EA374834EFFB32A7F305BAF0A753066099CF1E2575F38408A2C5929EF6908++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\settingsdblookup.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):811
                                                                                                                                                                                                                                      Entropy (8bit):5.552253677614322
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:gd8kIXhHUnPKItqP8+/4lqWvfsb97ZsCodUjb97ZsJArspCe8hvDIFEcGlbLvxzQ:5BUHE/4lqoKqdUvsFnwQQvpE/rcoOTvO
                                                                                                                                                                                                                                      MD5:EC0E4731BD267CA4C7109F33C5D9381F
                                                                                                                                                                                                                                      SHA1:538DD93C4313623A95DC59DB0720F592E422138A
                                                                                                                                                                                                                                      SHA-256:C1F2C578B7B5F7B6210EF72DCCBFCBDA96236ECC5033A6571FE160BC547DA0FB
                                                                                                                                                                                                                                      SHA-512:8F1E57292BCC3B3C46529CE52C5D1E1BF252D4D446D18B108809FBDA9F0608EFFDA8F293C06F0999916FAF0A769CEF07019EFBE49CEC15BACCE62CFA5094790E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........+%...+...7...>.......T...+...7.......7...%...>...H...7.......T...7.......T...7.......T...+...7.......7...%...>...T...4.......7...7...7...7...>...........T...%...4.......@......tostring.GetOption.settings]Invalid settings configuration specified for settings database lookup dimension handler..default_no_value.setting_name.in_contextXNo settings configuration specified for settings database lookup dimension handler..err.m_logger.get_dimension_config.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandlerw.......4...%...>...2...5...4...1...:...4...0...H.....new.SettingsDBLookup*telemetry.dimensions.DimensionHandler.require...//73F464983B043C393CEADF615BF8A143C26CA717E4823552B1875963890CDFFC95B3661362D64705B3135680C9F20CE95ADD037343D403C3FF418B71038140C1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\simplewmiquery.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1058
                                                                                                                                                                                                                                      Entropy (8bit):5.66779650722283
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:7XPWUNk6W0pzsxOLs0tl17FDTw2QFPjE/JK:7u6kN0pqOLJPtFDHCrV
                                                                                                                                                                                                                                      MD5:B52BE7685A3F5E6FDF38B54DAC075FC0
                                                                                                                                                                                                                                      SHA1:6743394C4EB37F71D3A52D84186AF8A285055308
                                                                                                                                                                                                                                      SHA-256:BC9C72AF40AE7573541F13099C47D3A40809F0EAEED9C3EB794196840550B907
                                                                                                                                                                                                                                      SHA-512:51727DBDD0ECF5945EE49E27C5F870BEC5C583AED49B498A4CE99F8BED13D574947FE651285CCE025029A44A6D72A11D5DCF88CE5189421B7F3F36E602818355
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........U+...7.......7...%...>...+...7...>...%...%...*...%.......T...+...7.......7...%...>...H...7.......T...4...7...>.......7.......T...7.......T...+...7.......7...%...>...H...T...4...7...>.......4...7...>.......7.......T...4...7...>.......7.......T...4...7...>.......4.......7...................>.......T.......+...7.......7...%...>...4.......@..... SimpleWMIQuery handler: end.get_wmi_properties.utility.aggregation_type.namespaceUInvalid settings configuration specified for simple WMI query dimension handler..field.query.tostring.errorPNo settings configuration specified for simple WMI query dimension handler..err.top.Root\CIMV2.(error).get_dimension_config"SimpleWMIQuery handler: start.info.m_loggerZ.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandleru.......4...%...>...2...5...4...1...:...4...0...H.....new.SimpleWMIQuery*telemetry.dimensions.DimensionHandler.require...//66F1EC412E736F1C0CCC9A12BF1055FACE5F525B7E3141612F03D6BE9D1B2A6749373FCD

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\staticvalue.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):555
                                                                                                                                                                                                                                      Entropy (8bit):5.509844220882659
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:KkFS8ryNrRryJAnDpCe8hvDIFEXZGlbLKsoa8EeJKUNh8wn5HpYFO:djyNFaolnwFQKE/WX2O
                                                                                                                                                                                                                                      MD5:4637B8199333805438D75ED45E7799A9
                                                                                                                                                                                                                                      SHA1:BCC6E82AAAFE155E4549724FF0033DE3AF68F85C
                                                                                                                                                                                                                                      SHA-256:53EB57810A2925E94C9EB9F4D9C3A826AFA3FC69517DB300B190DBF7C5FD07EC
                                                                                                                                                                                                                                      SHA-512:04F13CF4F7874D946D089C343D85921615661595C74C396315F476B089636686D0B06DCC22E5B829C3B62EF23DC86637565DBC6EC98B131DFB8298115A1BE52E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........%...+...7...>.......T...7.......T...+...7.......7...%...>...H...7...4.......@......tostringAInvalid configuration for the StaticValue dimension handler..err.m_logger.static_value.get_dimension_config.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandlerr.......4...%...>...2...5...4...1...:...4...0...H.....new.StaticValue*telemetry.dimensions.DimensionHandler.require...//400D4C88170CD6778859769389FA9085AC18A94EEDF91086F9FF10D7E73DCEECBEC7067F0168F7FF1ADD87106DAF2B181D7ACBD7BBB82FC1AC65CEA6E456F06C++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\suitestatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                                                                      Entropy (8bit):5.606874764161418
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:myyWXSPyfuugXc/dBiGgPRyfuxAIE/KUGRthn:6WiVugM1BSRbvTUGthn
                                                                                                                                                                                                                                      MD5:7264A96B387197AFCD17B576692283EB
                                                                                                                                                                                                                                      SHA1:6ED65CB6F5E5A1B3F0A36C7F5430D2A66A3870A4
                                                                                                                                                                                                                                      SHA-256:106F7913ED5CA35DD52DBEE824C6B85A0777A47998B4C577ACAA6E595F06D0E0
                                                                                                                                                                                                                                      SHA-512:96F414CF18697DFE24B14BCFA03F83D139593519F1EAC4DE756CE29A0D620C184278CC532AC375F09DDC21517029DB56933963DC49CD6BF35967454BC74ABD16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........&'...4...7...7...%...%...'...(...>.......7...>.......T.......4.......7...)...%...)...>.......T.......4.......7...)...%...)...>.......T.......4.......@....tostring.*Freemium.*Orphaned.GetOption.settings.IsValid5SOFTWARE\McAfee\MSC\Settings\ApplicationInfo\MSC.HKLM.Registry.Win32.core......Y.......+...7...>...4.......>...........T...)...H...)...H......tonumber.get_suite_status..&.......+...7...@......get_suite_status.........4...7...............>...1...:...1...:...1...:...0...H.....get_dimension_string..is_suite_installed..get_suite_status.new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.SuiteStatus.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//C1EEF333C82066E7D7FC4781A5E75E241897FB68754FEC7718DE74FD5A43CB9B412BF5435AEBE74A8EBEB23A8C583659B8BE07A4DC0A7115F4EB4B1EA3F9A5BB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\telemetryversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):732
                                                                                                                                                                                                                                      Entropy (8bit):5.541102705302123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:T5Qkw4I44/Y+C/nVAOwitZm9j4a8pCwUitZJAooDpCe8hvDIFEcGlbL9UiH/Iuss:4FY+SVAOwiKE7uiZqlnwQQ9UiHjE/Xj2
                                                                                                                                                                                                                                      MD5:DC35C5F2BE7C487E10DBECA8378FAC4E
                                                                                                                                                                                                                                      SHA1:C5D92FA1686208506F6902933628C5CD6BD42948
                                                                                                                                                                                                                                      SHA-256:F6B4417634E6FC3FB1EDF279BE9DA61124DA1C3D9C3FDC83DBEB73CFE0584B33
                                                                                                                                                                                                                                      SHA-512:2E00ADC09D73AD48A58B31CAD061334DF5D711F597EDA90CC88A13027649FF5582C134FE9E842000E50A921BE0DD4ACDDBF03BA368360ED62C8B4D1CE785DF85
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........%%...+...7...>.......T...7.......T...7.......T...+...7.......7...%...>...%...H...4...7...>...........T.......T...+...7.......7...%...>...7...H...H.....GUnable to read version data in TelemetryVersion dimension handler..warn.require.UNKNOWNIInvalid dimension_config for the TelemetryVersion dimension handler..err.m_logger.version_path.default_no_value.get_dimension_config.Z.......4...7...........)...>...1...:...0...H.....get_dimension_string.new.DimensionHandlerw.......4...%...>...2...5...4...1...:...4...0...H.....new.TelemetryVersion*telemetry.dimensions.DimensionHandler.require...//403C7158D8AA03A43B1CAF5F57337E220E36E9F22907DCC9B0741C0FDA53CAAA3F8B89D09DB1F4EAFC9EBE429D72B3D9E1833846EAFBFB422344BDD119F17331++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\updatepending.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):551
                                                                                                                                                                                                                                      Entropy (8bit):5.627028799484036
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:3YKhS6zgmXydWW7WIFEP39R5gfl/80Isoa8EeJKBmYEzGhkGiGn:jrzg6ydJkyf1NIE/BmYEzakxG
                                                                                                                                                                                                                                      MD5:3A3097E1A151007EB24D7D46EA7AE028
                                                                                                                                                                                                                                      SHA1:D76482ED200EE11086265869ECB68D7824EC7456
                                                                                                                                                                                                                                      SHA-256:49A762D9275776B541A7C0D5EE73148A590623D0319C1CE4B14113731ADCD5FD
                                                                                                                                                                                                                                      SHA-512:700A1EEF54A49AE5108E77D95E89F4A49E9C7BE10B68598822D3F2731455BAF1B53577422CC9B0A6CC192DAEE95023E01C48439C41213F520DE3C7DF7ACE79E3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...7...%...%...'...(...>.......T.......7...>.......T...%...H...%...H....true.false.IsValid-SOFTWARE\McAfee\WebAdvisor\PendingReboot.HKLM.Registry.Win32.core...V.......4...7.......*...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.UpdatePending.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//83C3E253360B527854F297BC93C15A90AFCD67C6E867CD86BF57B724DB6A1CAB6ED85C64C8639B74F70C5566043FBD52E0114D3A8481C9961F6F3575DA734658++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\updatependingversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):731
                                                                                                                                                                                                                                      Entropy (8bit):5.6192343197477586
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:ZeKhSDLnHSpPsXQ8tzT46iuatmXydWW7WIFEQ39R5gfls+0Isoa8EeJK2+gCJeO:PYQsQ8BUhH6ydJDyf2jIE/CCJR
                                                                                                                                                                                                                                      MD5:9ECA22B44DA40B7EF8E680BEEFF8D6D6
                                                                                                                                                                                                                                      SHA1:AFCA19F167DD91EEEA33395327C7D9361E1D44AB
                                                                                                                                                                                                                                      SHA-256:15046C04362166DD2ADB20B60B7F8BC4A9FC52CBBE8C8B4A5F81FE550D0DA66F
                                                                                                                                                                                                                                      SHA-512:A0104B4664F7D2B7B6DB706FD6B870AE46BAFF22EDBCD8BA4468F9EE5C142CACE8907969CB1496043511F621F8028751C1736F38075515ECA0E9A56AAECC4141
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...7...%...%...'...(...>.......T.......7...>.......T...%...H...4...7...7...%...%...'...(...>...........T.......7...>.......T...%...H.......7...%...>.......T.......T...%...H...H.....FullVersion.QueryValue.UNKNOWN.SOFTWARE\McAfee\WebAdvisor.RebootNotPending.IsValid-SOFTWARE\McAfee\WebAdvisor\PendingReboot.HKLM.Registry.Win32.core...V.......4...7.......*...>...1...:...0...H.....get_dimension_string.new.DimensionHandler.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.UpdatePendingVersion.mfw.core.Win32Helper*telemetry.dimensions.DimensionHandler.require...//14B216E97CFF8E7AD9AAF86DAE8A4C51DC0FC9DF5899F73D39196735EBFC26764AF7BC5393D62325073255F9B51FFB50A77A44FD94C28374B3EF378C548DAF1D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpsdatesetting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):486
                                                                                                                                                                                                                                      Entropy (8bit):5.538318694426931
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:f+ns1vm32QsxjXkkuBid/9smRgGlbLj0usoWLIY3pKfEgLkOdbCly6:Ysl6sNkHBidamgQj0u2IY3k/YOdbV6
                                                                                                                                                                                                                                      MD5:B2D512C47E3AC1A928073445375A98E0
                                                                                                                                                                                                                                      SHA1:90FCEB2317AA72303C53A2343800A055F2EAEC89
                                                                                                                                                                                                                                      SHA-256:FC367379D33D55C8DFB94BD2C12741A67BA568DE7F64C5EAD7B41D71FCFB8417
                                                                                                                                                                                                                                      SHA-512:48C60CD7FFC6950A5D68D05CCFA1D677FD10FFFCB22D268B2CECA76F807AC7028804B2551CF37FFDC9BE5B4A6F1B6C87A7A5E2516D68D14DBB901B04DB9940B2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7.......%...>.......T...4...7.......'...'...>.......4...7.......%...%...>.......H.....-.gsub.sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.stringM.......4...7...............>...1...:...0...H.....format_output.new.WPSSettingx.......4...%...>...2...5...4...1...:...4...0...H.....new.WPSDateSetting-telemetry.dimensions.handlers.WPSSetting.require...//05C96186F08538C6E7E1E9B7FE9FCA517B488B8D33791E211DC41F65D7E73798391CDE2544F437154E39BA51F807E94E1B159A72F9C6A8898F64B809A351574C++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpsdayssinceexpiry.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1208
                                                                                                                                                                                                                                      Entropy (8bit):5.642009565436857
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:bwEX9j1RXQmU3PZ4Kdm6MOKNh+CVUkM0dabVtgBiDS2kQUhk2IY3kd6UuClx5:3JQZdIhP/M0ssBfFi2woCl
                                                                                                                                                                                                                                      MD5:BEFF4C1FCB74EF90E136088F835FC04B
                                                                                                                                                                                                                                      SHA1:CC1078B4247077E861F716397F8148CD209B34C2
                                                                                                                                                                                                                                      SHA-256:21DDF6B469777692E97E5915E76201B7B043E85D4D13C64C8DFC0D2E5326A1ED
                                                                                                                                                                                                                                      SHA-512:6A0F6B2A2D895A35DC70C0E7107D39FE10B802352F7FB3C425CCC8A6B6D750977A8935E7171FBE3FCD6B161B955FD0769226B8E3E371594790917A7DC4BBDC53
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........J'.......T.......T...4...7.......>.......T...4...7.......%...>.......T...'...H...4...4...7.......'...'...>...=...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...7...3...:...:...:...>.......H....day.month.year....hour...time.os.sub.tonumber.%d+.match.len.string..4.......4...7...4...7...%...>...?....!*t.date.time.os........:4...7.......7...%.......$...>.......T.......T.......T...H...4...7.......%...>.......T...4...7.......'...'...>.......4...7.......%...%...>.......+.......>...'.......T...%...H...4...7.......>...4...7...+...>.......>.......4.......@........tostring.floor.math.INVALID_DATE_FORMAT..-.gsub.sub.^(%d%d%d%d)-(%d%d)-(%d%d).find.string.NO_WPS_KEY.NO_WPS_SETTING.NO_INPUT_SETTING%WPSDaysSinceExpiry: input date =.info.log.core...W.......4...7...............>...1...1...1...:...0...H.....format_output...new.WPSSetting|.......4...%...>...2...5...4...1...:...4...0...H...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpssetting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1424
                                                                                                                                                                                                                                      Entropy (8bit):5.694461302632784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:+cRvGiHyRDmClnA5RzKx39Ptcc/dRucV8AXV4UjseE/DSs9:+YPHyM5Uv1x/dR/vjse29
                                                                                                                                                                                                                                      MD5:295DE66F5A6C4F8F53523FEC1DFD3D43
                                                                                                                                                                                                                                      SHA1:A58E12901396C3DDF3A2843D8C7F8672612C8F5C
                                                                                                                                                                                                                                      SHA-256:0680AF99418C27958D779A3095A13D5B030A75E5D00AE1C50E07502669A7DB7C
                                                                                                                                                                                                                                      SHA-512:20BC63AAEEEE25DDB7B8F5C48E53EAE29662D9710CFFCBDC4339971762915EDCB378B6A3B5283389F16F729CF6997FA193FFF2B62764F0F457423A23D5AA132D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........g....T...4...7.......7...%...>...%...H...T...4...7.......7...%.......$...>...4.......7.......>.......T...4...7.......7...%...>...%...H...........T.5.4...7.......7...%.......$...>...4.......>...4...7.......7...%.......$...>...4...7.......'...)...>...4...7.......7...%...>...4.......>...D...4...7.......7.......%...4.......>...$...>...B...N...%...6.......T...6...4...7.......7...%...4.......>...$...>...4.......@....WPSSetting: returning .NO_WPS_KEY. = .pairs,WPSSetting: parse succeeded. Json keys:.decode.json_parser%WPSSetting: wps json setting is .tostring.WPSSetting: key = .NO_WPS_SETTING)WPSSetting: returning NO_WPS_SETTING.get_setting.wps_utils.WPSSetting: setting = .NO_INPUT_SETTING+WPSSetting: returning NO_INPUT_SETTING.info.log.core........H............+...7...)...+...7.......T...+...7...+...........>...+...7.......T...4...7.......>.......+...7.......>.......H..........format_output.lower.string.lower_case.key.setting_namev.......4...7...........)...>...1...1...:...1...:

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpssuitestatus.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):586
                                                                                                                                                                                                                                      Entropy (8bit):5.504816023485099
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:DFNql6nGUm8dcfzOdNuI/9/ECGlbLjEsoa8EeJKquNzOiOn:DFNeIGUm+coNh3QjEE/TzOtn
                                                                                                                                                                                                                                      MD5:E50025927B3EE89895724005BD1843B4
                                                                                                                                                                                                                                      SHA1:8A423EC272DF863273BA3CD1F51951155018DA8F
                                                                                                                                                                                                                                      SHA-256:FF76BAE738C35C860130CB68E1D04225BFD270A684F07E7A29ADA7D275A01072
                                                                                                                                                                                                                                      SHA-512:CAC18EFE7213D7E4D823167F31072C41376D8021D075017C7F746B58FEE8F5E5A51D6E41E61B36A04E3C24E0BBCC562E7A36C361F82C270C60FDBC62CDF28041
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........'...4.......7...>.......T.......T...4.......7...)...%...)...>.......T.......4.......@....tostring.*WPSEverInstalled.GetOption.settings.is_wps_installed.wps_utils..&.......+...7...@......get_suite_statust.......4...7...........)...>...1...:...1...:...0...H.....get_dimension_string..get_suite_status.new.DimensionHandleru.......4...%...>...2...5...4...1...:...4...0...H.....new.WPSSuiteStatus*telemetry.dimensions.DimensionHandler.require...//8F9B9968DEA36A649AC4B6C92CB646B54133DE7540F695612905E76BF9B5E696B24BE2D15CD6EF394D3174CA886D01A4EC9F1D86C5D3342F81CEFB6457538714++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wpstrial.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):461
                                                                                                                                                                                                                                      Entropy (8bit):5.558376283871401
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Ilc9I7tdi9Gu/9smROGlbLTsoWLIY3pKxdSL0bfyFBRNnHKQ:Ie9GLikuamOQT2IY3k7U8yFVV
                                                                                                                                                                                                                                      MD5:CB619158239771D17A04F178EACCFFA8
                                                                                                                                                                                                                                      SHA1:894BD62A03FADCED1E1287B363D77F7EC8FC56E3
                                                                                                                                                                                                                                      SHA-256:67058411030E77CDF50A98DC59FFFC2FEF1C3432AD62A3E1ACEB47D4E05D6270
                                                                                                                                                                                                                                      SHA-512:9A0289A663BACAF63901765C40FD3703402C5D0E239B3C8C26B25701944E3BBC354FE3642D8A278870A40EF57AFB8953F571E15FE14487286065DB444F122176
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..............T.......T...%...H...T.......T.......T...%...H...T...H...G....0.Paid-Expired.Paid-Active.1.Trial-Expired.Trial-ActiveM.......4...7...........)...>...1...:...0...H.....format_output.new.WPSSettingr.......4...%...>...2...5...4...1...:...4...0...H.....new.WPSTrial-telemetry.dimensions.handlers.WPSSetting.require...//A3FEFD777182AE6500D5FABD34FB3434A2EBC001CAB5C3F505A3E53A8A906216C2E2FB4E6C4C2B80AA80B8E3046E1B8AE9E9EB6D769A4D3D45CEB859AC24A8DB++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wssaffid.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):651
                                                                                                                                                                                                                                      Entropy (8bit):5.738357741434148
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:5KMuuPgonhXPZq3kf5x64MxSmulXR1OkBid/9ZQ2GlbLuQdsoWLIEKvc4uX:LuuPgohRq3kGJJwRVBidg2QuQd2IjErX
                                                                                                                                                                                                                                      MD5:8773021C777D91CA6E4C80FDC96E05A4
                                                                                                                                                                                                                                      SHA1:74F718AA84145BB879A6181C70FA6790F96DAFAE
                                                                                                                                                                                                                                      SHA-256:0A8CAF5199483DE8FC975B96276DBC61A966111A27B236496E0A3EAF795DD307
                                                                                                                                                                                                                                      SHA-512:EC0800CE90D8E60120EC990A11FBA8DA434333D357F5E00E691C8FA48F7043F1AE18C7ED8AD8A002D9448B2E96798618719926E640B71E080BDBC2F6EA427BE4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........#+...7...>.......T...%...H...4...7...7...%...%...'...(...>.......7...>.......T...%...H.......7...%...>.......T.......T...%...H...4.......@......tostring.NULL_AFFID_ERROR..affid.QueryValue.READ_ERROR.IsValid+SOFTWARE\McAfee\MSC\AppInfo\Substitute.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed...U.......4...7...............>...1...:...0...H.....get_dimension_string.new.SuiteStatuss.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSAffid.telemetry.dimensions.handlers.SuiteStatus.require...//CF71D3C1A74FFCFD2086465753842A9AF628C1BCF37454A133703A7C00C6D7AD8F872CA8DF8E17B136FE75D2C3FFC97B9312D77FA180D203637F7FD10B73F901++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsscspid.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):577
                                                                                                                                                                                                                                      Entropy (8bit):5.636866033713191
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:quOsakaQybr0j/FoQ2vfrY1OvpCFUBid/9ZQ2GlbLPnusoWLIEK1iMnlThWKtW0M:quOVP4jNcvTYkhBidg2QW2Ij1dZRyh
                                                                                                                                                                                                                                      MD5:489F8ED2F2CB7AA952B632051662D757
                                                                                                                                                                                                                                      SHA1:ED5D48A2C2F331E43DB255BBA28FCEC6C47D1FE0
                                                                                                                                                                                                                                      SHA-256:924EB320527ED3D7BAD173871355572B1E9581B877CD19AA195BAB6713BD9D8E
                                                                                                                                                                                                                                      SHA-512:132CBC4DAFDF86082B991D7B7323A718B9C5A8487AF1508A45CF7DF691F071461CA7E9D1330399D420C9C3D66C97838AA7A6BB113C6C5AE06F6081A922BB0469
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........+...7...>...+...7...>.......T...%...H...4.......7...)...%...%...>.......T.......T.......T...%...4.......@......tostring..__not_available__.NO_CSPID.CSPIdValue.GetOption.settings.NO_SUITE.is_suite_installed.get_dimension_configU.......4...7...............>...1...:...0...H.....get_dimension_string.new.SuiteStatuss.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSCSPID.telemetry.dimensions.handlers.SuiteStatus.require...//D65B49B11E691DC2FC104113350CEADC2821735A8A733834BE36E06B9CD43629A006F01AAB4C3BBADE34F0C07CAC378FC94E24496A23BC70E8CF955F7C1A8C5E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsseuladate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):682
                                                                                                                                                                                                                                      Entropy (8bit):5.556491254388825
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:IAZyMnaVYEz71ObWLixqArstUCfQ/9Ep39R5gflG6hsoWLI/soWLI/3KsbmbgoiL:3MMnaVYGSWLPJU2Q0yfbh2I/2I/6sqiL
                                                                                                                                                                                                                                      MD5:B5CF9C3FB9876B2D91C3D42F2CE256B8
                                                                                                                                                                                                                                      SHA1:4A608B750FC0D5999486EF0EACC43ADE54D0F2E6
                                                                                                                                                                                                                                      SHA-256:DED9FAA6DC4A32745362134EAF2BA4CB3FAF10FAF850BB9EC0BB1A5056574626
                                                                                                                                                                                                                                      SHA-512:8D4AC82C0A2E750EA5EE2CA63C9191760B34B17CA90E7A26955747706E9CFE7FA5DA755A69E2BE225F8C2B12512AA19F2FA90D0A73A29915DD575FAD28FB06A8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........+.......T...+...7.......T...+.......T...+...7.......7...%...>...%...H...+...7...>.......T...%...H...+...@..........NO_SUITE.is_suite_installed.UNKNOWN3Failed to construct the WSS eula date handler..err.m_logger.get_dimension_string|.......4...7...........>...4...7...............>...7...1...:...0...H.....get_dimension_string.SuiteStatus.new.RegistryLookup.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.WSSEulaDate.telemetry.dimensions.handlers.SuiteStatus1telemetry.dimensions.handlers.RegistryLookup.require...//FF758F5ED7E6C93643C4CE800AC043764C8804F451F1FC67D35C16EB813C3B1302B13C538B543DDF830DA1636823C2786568D45EB535330C9F00732DC2530616++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsspackagetype.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):495
                                                                                                                                                                                                                                      Entropy (8bit):5.585748375264353
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:2IHvOkcriB2mvzXBid/9sYGlbLj2hAusoWLIPKct8DEZvR:2IH1KgrXBidaYQj2hJ2IyctfZ
                                                                                                                                                                                                                                      MD5:23233F394395A83B1A2093C1CCA20E20
                                                                                                                                                                                                                                      SHA1:DF03ACF9E5E0C28A5DEC6878AA1E9917E150F7C2
                                                                                                                                                                                                                                      SHA-256:74E02EFD9DE7579AD017BE1308CBF7EC3123F0E0210DDA120B2B06497270C1F4
                                                                                                                                                                                                                                      SHA-512:E00FD13C9AC4F3BA9FA2C766EB92354D671CE891E9F951DAEACD73845B15A3DAC1EB06A9DF6FC478B1A5E41B2D63ACC866F410F56BC5B6D687BCF509EF0695D5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ.......... ....T.......T...%...H...%...'.......'...I.......7...........>...4...7.......>...'.......T.......%...$...T...........$...K...H....*.byte.string.sub.M.......4...7...............>...1...:...0...H.....format_output.new.WSSSettingx.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSPackageType-telemetry.dimensions.handlers.WSSSetting.require...//24B1382054EEB399F14981CE61828A79BAB4CB589E932F291BCFB41BE9F45EC0969078863ECDA2AD19A81674DFFBDBE09A7DBE8A2A711607E0C01EC74847029E++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsssetting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1442
                                                                                                                                                                                                                                      Entropy (8bit):5.789325129237691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:axlOHbhNYSOaQemAENhRNWF1ltn2oXJ3qfswRfqNRV+mSWl8q4eBi1cAUQT2Ij90:sY7sSyAElNWF1lkoXJ3qUCyT8Al8leBl
                                                                                                                                                                                                                                      MD5:0285608A9DA28FEE53181912723444BA
                                                                                                                                                                                                                                      SHA1:556F82A74D520F6DA37D490A00E9670D81BB284C
                                                                                                                                                                                                                                      SHA-256:A219BF0A394D4059254332A285036F6B423E9DE49EAB02E199FB49E55EA8B1B9
                                                                                                                                                                                                                                      SHA-512:3C116BDC77AAC82FB56E5484AC78E0C9BD71F592A677186EAE1DEEC46496CAB9BE3CEDACBB130C35DCE7FDCFE2D4C1ADB0386D9547598B2F3BEADC8082D09133
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........(%...+...7...>.......T...%...H...4...7...7...%...%...'...(...>.......7...>.......T...%...H...4.......7...........>.......T.......T...%...T...4.......>.......H......tostring.UNSPECIFIED.GetProperty.subdb.NO_APP.IsValid#SOFTWARE\McAfee\MSC\SubManager.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed....t.......+...7.......7...%...>...H.....FBase WSS Setting handler format called. Returning original value..err.m_logger........K%...+...7...>.......T...7.......T...7.......T...7.......T...+...7.......7...%...>...H...+...7...7...>.......T.,.7.......T...7.......T...+...7.......>...........T...+...7.......7...%...>.......7.......T.......T.......T.......T...4.......7.......>...........T...+...7.......7...%...>.......4.......@........tostring?MD5 function incorrectly hashed data. Using default value..MD5Hash.utility.UNSPECIFIED.NO_APP.MD5EFormat function incorrectly formatted data. Using default value..format_output.NO_SUITE@Invalid configuration for the WSSSetting dimension handl

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsssettingexpiry.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):922
                                                                                                                                                                                                                                      Entropy (8bit):5.472102399283966
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:bwEX9j1RXQmU3PZ4zMOhjUCVrtgBiDSuQB2Iygy:3JQZOhhGBUc2L
                                                                                                                                                                                                                                      MD5:61B2E8DC375AF2358D0D6811BCA56F43
                                                                                                                                                                                                                                      SHA1:6B56E981EA027C70AB3AC2496A91D2BEA242D241
                                                                                                                                                                                                                                      SHA-256:3F86AFB60076387722A0227DDD14A75B9F4EB76578AD370D2F55203E8F40F005
                                                                                                                                                                                                                                      SHA-512:691A4082443D2767852EEC62D5335627F71DE7268DDA1ED4D7E9C21A619E5561A757387B9C2145D0C6B96F3F91343ECC7ACD4A6E52DE18831206F4AEBD108287
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........J'.......T.......T...4...7.......>.......T...4...7.......%...>.......T...'...H...4...4...7.......'...'...>...=...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...4...7.......'...'...>...=...'.......T...'.......T...'...H...4...7...3...:...:...:...>.......H....day.month.year....hour...time.os.sub.tonumber.%d+.match.len.string..4.......4...7...4...7...%...>...?....!*t.date.time.os.........+.......>...'.......T...%...H...4...7.......>...4...7...+...>.......>.......4.......@........tostring.floor.math.INVALID_DATE_FORMAT...W.......4...7...............>...1...1...1...:...0...H.....format_output...new.WSSSettingz.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSSettingExpiry-telemetry.dimensions.handlers.WSSSetting.require...//97D1E003AC975DBDDCE346A9E823DB7C83BB7C3DBD13D5B517CB49E102B5899AC1767BBA68E133302A2E87903BCAF904035C3928E98D45302FB2492E3A669B6F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wssversion.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):653
                                                                                                                                                                                                                                      Entropy (8bit):5.6962767368247675
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:euuPgonhXPZqFbmP4XR1OkBid/9ZQUR39R5gflfA0csoWLIEKkb6mIsvqg0:euuPgohRqcPwRVBidgwyffc2Ij1lg0
                                                                                                                                                                                                                                      MD5:FD6D62F44753AB165A30E2328B4587A7
                                                                                                                                                                                                                                      SHA1:0888CF29985FDED3621ED63210B1A3B793AA634D
                                                                                                                                                                                                                                      SHA-256:A52D653983591D10689A3194999B72B5ACECA4E0ABFD393689F44B281889A0C9
                                                                                                                                                                                                                                      SHA-512:4AA4F992CF1FD6CBB573284CA1FEAD90AF704B075D35123737C2629717248DD83CC52A79EFD32A1A3FF4AE08A4104B72D16ACC59BCB609EB88C730FA8494C053
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........#+...7...>.......T...%...H...4...7...7...%...%...'...(...>.......7...>.......T...%...H.......7...%...>.......T.......T...%...H...4.......@......tostring..ReleaseName.QueryValue.NO_VER.IsValid.SOFTWARE\McAfee\MSC.HKLM.Registry.Win32.core.NO_SUITE.is_suite_installed...U.......4...7...............>...1...:...0...H.....get_dimension_string.new.SuiteStatus.........4...%...>...4...%...>...2...5...4...1...:...4...0...H.....new.WSSVersion.mfw.core.Win32Helper.telemetry.dimensions.handlers.SuiteStatus.require...//807EA437ADD7CD79FE45CF720A50165488A0B93040A2EFDDEEE92AFE70B56450EC99B9C7BEFC363A7F7440320C1396A37C9404CCF1155548A9AB4DC7177D1B05++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\wsswps.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1471
                                                                                                                                                                                                                                      Entropy (8bit):5.613185103328971
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:JQmnLxIesqSRxsESaytdoCnqyXgzysccVzoFnqy7g2ISNvt0Q+cOQv4Q7WJuE/WO:STesn3sdamo4qCmJ1opqX2hNF0Q+cAyO
                                                                                                                                                                                                                                      MD5:240D489DAC107AF03A78B6EB894D2AB3
                                                                                                                                                                                                                                      SHA1:D12E334F90C5AE748BA50C9410E52CB2753654F0
                                                                                                                                                                                                                                      SHA-256:D3CBBE00805415CA1CA17E25AFFA96B4234A352B253FCB1F0A99B05A7A64830A
                                                                                                                                                                                                                                      SHA-512:9CBC04B3A7B17F96F512A883EF357F204678A7456DFA54537102EBF4207A407B5B1209E182ECA5EF7C00543DD1D012F4B3B97E69C578A877E9FAEA64C0E996FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........~+...7.......7...%...>...%...4.......7...)...%...)...>...4.......7...>.......T.......T.8.+...7.......T.4.+...7.......T.0.+...7.......7...%...>...+...7.......T...+...7...7.......T...4...%...+...7...7...$...>.......T...7...+...+...7...)...>...7...>.......T.=.+...7.......7...%...>...T.6.+...7.......7...%...>...T./.+...7.......7...%...>...+...7.......T...+...7...7.......T...4...%...+...7...7...$...>.......T...7...+...+...7...)...>...7...>.......T...+...7.......7...%...>...T...+...7.......7...%...>...H.........VWssWps: Expecting wss subconfig and wss handler in dimension config, but got nil.3WssWps: Nil wss dimension handler encountered..wss!WssWps: WPS is not installedVWssWps: Expecting wps subconfig and wps handler in dimension config, but got nil.3WssWps: Nil wps dimension handler encountered..err.get_dimension_string.new#telemetry.dimensions.handlers..require.handler.wpsjWssWps: WPS is installed, or WPS was once installed and dimension is SuiteStatus or SuiteEverTurnedOn.ch

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\version.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):235
                                                                                                                                                                                                                                      Entropy (8bit):5.179285362994611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:8k4kikwIWmLQJX8n+OgUvoScmhUcbu9thjRQ2IIB+Zuuk2h:90kRLQJXcbvoSHhK9tZIIB+ZuuLh
                                                                                                                                                                                                                                      MD5:30E00470D0CC8435F2EDB28A5994EC01
                                                                                                                                                                                                                                      SHA1:5F728DB48A3A82F6499510A3BBC39FAEDDB9EAF6
                                                                                                                                                                                                                                      SHA-256:E20413C475DAF9DA3041B8AD9A6B0FA2E352D55E8F06751AF4F763C625590350
                                                                                                                                                                                                                                      SHA-512:4B6D8756403758F6EFE537B714E237ADB4577BA677F302C29395D00AC0228427ADE5C187281C898D03DF5566A0274119124343F29EA70EF873C5BF3F9B70D7E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:--$FileVersion=[VERSION_MAJOR].[VERSION_MINOR].[SUBMINORVERSION].[BUILD_NUMBER]..return "4.1.1.846"....//E3F4A489BB3DD7B03A3A175D5107ABFFC640F5E914D60572DF4697FF45BEA73757BD6795347E02BA8D518977EA7D87BAE9548933CE5F6CFBE55A01A8325E81F8++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventformatter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1412
                                                                                                                                                                                                                                      Entropy (8bit):5.529793179016961
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:NiQLb2i/BKZ2r3EKPNGwR0okfGRZcuKj55FXijk:N31pKCH9SIZeXSjk
                                                                                                                                                                                                                                      MD5:CE82840480225639C68A43AE53CAE343
                                                                                                                                                                                                                                      SHA1:68DECC623750846F3380E5655A62A7A05BE3B4FC
                                                                                                                                                                                                                                      SHA-256:3F77946427575326CD965D2CC9B5302F6FE62E59ADEE951B31545A21091D80DF
                                                                                                                                                                                                                                      SHA-512:99169BDB73EFACD81598118F7687B91E4358F728756D20DF280F50E7620076D1DC55E750F7C6246EF1E112292C768445A81F9A79B61CA60094BE3366A588CCE0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..$.......+...7...H......m_event_config$.......+...:...G......m_event_config........+...7...H......m_event........+...:...G......m_event".......+...7...H......m_dimensions".......+...:...G......m_dimensions........+...7...H......m_metrics........+...:...G......m_metrics".......+...7...H......m_extra_data".......+...:...G......m_extra_data........)....T.&.4.......>.......T...4.......>.......4...+...>...T...%...4...7...%...4...7...4...7...............>...=...=...$...5...4...7...........4...>.......A...N...H......gsub.replace.sub.byte.%%%02X.format.%.ipairs.tostring.string.type?.......4...%...>...G...&format_event_data not implemented.errorL.......4...%...>...G...3get_formatted_event_identifier not implemented.error......!.$2...3...:...:...:...:...:...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1...:...1. .:...0...H....#get_formatted_event_identifier..format_event_data..encode_uri..set_extra_data..get_extra_data..set_metrics..get_metrics.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2836
                                                                                                                                                                                                                                      Entropy (8bit):5.48340516067821
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:dqi8lAvo9fbszACcL3wlwY7AM1289qFwX3SUp4D9K74JL7SMHhoBbBR7/yXXWKzJ:/o9fIAhLLM12pFwJg/hFhIR7uJ
                                                                                                                                                                                                                                      MD5:C368DECA1F8107C51DE6CCF82D8DBA36
                                                                                                                                                                                                                                      SHA1:28CB88CA82AA95717B13409C97D3940A7E8516FF
                                                                                                                                                                                                                                      SHA-256:B8D3615AF142C4AE125B32103024C039AC3C8EF00A67B754D81EB49878F1112E
                                                                                                                                                                                                                                      SHA-512:86FCEB8EFF2932A50EA14C2D86E9017AB60B3BE834D379AB5B1D01FB3246096747E92DC37DA5AD9F2322FF705A5A20AE3A68B31E312896A22528D7694DA83EB7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........%...4.......7...)...%...%...>...........7...%...%...>.......4...7.......%...>...T.......T...)...H...A...N...)...H....([^,]+).gmatch.string.%s+.gsub.telemetry_deny_list.GetOption.settings.........,...G.............+...H.............+...H.............,...G.............+...H.............,...G.............,...G.............+...H.....D.......4...%...>...G...+handle_telemetry_event not implemented.error........+...9...G.............I+...7.......T.......T...+.......T...+.......T...7.......T...+...7.......T...+...7.......7...%...>...%...H...T...+...7.......T...+...7.......7...%...>...%...H...7...+...>...7...+...>...7...+...>...7...+...>...7.......>...7...>.......T.......T...+...7.......7...%...+...7...$...>...%...H...H.............5Invalid formatter supplied for telemetry event: .set_dimensions.set_extra_data.set_metrics.set_event.set_configCAn event name was not supplied in the telemetry event payload.._event_name.6Invalid event data suppied for telemetry handler..err.format_eve

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\eventtransmitter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):514
                                                                                                                                                                                                                                      Entropy (8bit):5.297065441549035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:jk3RM5oshcOBU6niGnkxiRM5mTmC6ET/n:poshc0UqjkxxmX6ET/
                                                                                                                                                                                                                                      MD5:F925EDB4F383F5D326D5F067D7EF17A8
                                                                                                                                                                                                                                      SHA1:376E765D326A685FB9B45A142CDC55830F3E198F
                                                                                                                                                                                                                                      SHA-256:BA588BD53C703F7F80699654AE1050D99759C81B8CC36CBC49F440CDA031B2E6
                                                                                                                                                                                                                                      SHA-512:0FC56A9EF61118DE6BB9D99A552AE26E9D867AB7E585F8A0BDD0324E9B3240AB7918D6BD4E47075D58C8AC37D7C2DD43BE2EEE31537E89D6371BD73D88C629B8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..B.......4...%...>...G...)transmit_to_endpoint not implemented.error@.......4...%...>...G...'get_endpoint_value not implemented.error>.......4...%...>...G...%get_header_value not implemented.errort.......2...:...1...:...1...:...1...:...0...H.....get_header_value..get_endpoint_value..transmit_to_endpoint.m_logger=.......2...5...4...1...:...4...0...H.....new.EventTransmitter...//48A0DDCE7E87F761A6659772461ECFB1DC52F2999FE7F0E84B383457747B72BBC0C404EF592538A86FDEAE4A35E00BDBC8CF4185BBCAF390A32C1DEF7BB12EEA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_aws.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4327
                                                                                                                                                                                                                                      Entropy (8bit):5.723624133425632
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:D6SSZjXlltQREGprKTmYYE9pbsxKMfuvvkIHjsBnKYl33:enx1lmprKTqyO5fMvkIDsBKa33
                                                                                                                                                                                                                                      MD5:6F2B25FF2EEEE1375E6EF02B0019EE41
                                                                                                                                                                                                                                      SHA1:9F5A17955B07E3FA652B75719B68B12070A80DF1
                                                                                                                                                                                                                                      SHA-256:F7F6CD0F0889C1EE5800F00848682DAA3F5B29E4AB7974F458D15028E40C56A0
                                                                                                                                                                                                                                      SHA-512:3E68F57077DEDD9A0DC0D72755B118DE58E13FD1A22BF554A17FB5BCE894F7A71055DD08A98CD100AAB152893E1A771C3B3C74945D2C4F14270D5AD09161056A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..?.......4...+...>...D.......T...)...H...B...N...)...H......pairs........-....T...+...7.......7...%...>...)...H...+...7.......T...4...+...7...>...D.......T...7.......T...7.......T...4...7...>...9...T...+...7.......7...%...>...B...N...T...)...H...)...H.....5Nil dimension handler configuration encountered..tostring.value.config.pairs.m_dimensions=Empty event data supplied for formatting dimension data..err.m_logger.............T...+...7.......7...%...>...)...H...+...7.......T...4...+...7...>...D...%.......$...4.......>...9...B...N...)...H......tostring.Metric_.pairs.m_metrics:Empty event data supplied for formatting metric data..err.m_logger......!.......T...+...7.......7...%...>...)...H...4...7...7...%...%...'...(...>...%.......7...>.......T...+...7.......7...%...>...)...H...T.......7...%...>...........T.......T...+...7.......7...%...>...)...H...%...+...7.......T...+...7...7.......T...+...7.......T...+...7.......7...%...>...)...H...4...+...7...7...>...D.M.+...7.......7...%...4......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_ga.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3124
                                                                                                                                                                                                                                      Entropy (8bit):5.623885295860992
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cf3fZPQzBS03YSNXvNLVvNIE75Ervs1s0JRxiVbBcuvy+xQhIH75u/Mgx4BO:cXZIzw0xxvvV5qs1s2RFuvvkIHwFX
                                                                                                                                                                                                                                      MD5:4282C17E1F603261C362AE3C4644B71B
                                                                                                                                                                                                                                      SHA1:ED37BF0C626C59A8D98DF1E544AC49FCD5E13456
                                                                                                                                                                                                                                      SHA-256:AF7E27BAEF3B740DF1B0729BAC4C1E486981BB72FEA582A8C2930FF42EC1C045
                                                                                                                                                                                                                                      SHA-512:2AFE9AA51A3387F2D57CD236B31AE195BAD638B4C96E379998167F12BB9481FD8A2A09C96560019925576C8C4A6553B6D85DC2C6B5EF91D38EFF2212D811A3AB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..L...........%...+...7.......>...%...+...7.......>...$...H......=.encode_uri.&?.......4...+...>...D.......T...)...H...B...N...)...H......pairs~.......%.......T...'.......T...%.......T...+...7...4.......>...=.......%.......%.......$...H......=.&cm.tostring.encode_uri.1.h.......%...+...7.......T...4...+...7...>...D.......+...........>...$...B...N...H........pairs.m_metrics........._%...%...+...7.......T...+...7...7.......T...+...7.......T...+...7.......7...%...>...%...H...4...+...7...7...>...D.,.+...7...6.......T...+.......>.......T...+...........+...7...6...>.......T.......T...+...7...6...T...+...7...6.......T...+...7.......7...%.......%...+...7...7...$...>...%...H...B...N...+...7...7.......T...+...7...7...'.......T.......+...+...7...7.......>...$...H............metric_id._event_name.) when processng event: -A mapping value could not be found for (.metric_value.pairs?Invalid configuration for GA formatter 'get_event_string'..err.m_logger.m_event.mapping.m_event_config.1.........v%..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\formatters\eventformatter_json.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3427
                                                                                                                                                                                                                                      Entropy (8bit):5.636906406793161
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qM6SHyVrZ9UptjYP+a/JlXjLiQ3Ns/rJVvBSIQ0xOx7Y2cnq5VMfuvy+xQhIHsMr:D6SSZNXv3qBK1Y2ckMfuvvkIHj2hRjG
                                                                                                                                                                                                                                      MD5:70960E0CDA687CA4B4F4187E9CC23A44
                                                                                                                                                                                                                                      SHA1:C5C2080012AB3A3CEB28BDF709BD1485EA330B91
                                                                                                                                                                                                                                      SHA-256:2E9D9A7A24797E577BD1EB3754D34F11311405D7CA4AE2FA42CB7ABCD055EC4F
                                                                                                                                                                                                                                      SHA-512:9DB3506ABF8F1CF7B61D9E9B95DAD09F41228CA074968895AF172F9C4E6056A573BFE27918E665CE33EBF031B144432FFBD12DB8A95B3C4B0B96726505270BC5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..?.......4...+...>...D.......T...)...H...B...N...)...H......pairs........-....T...+...7.......7...%...>...)...H...+...7.......T...4...+...7...>...D.......T...7.......T...7.......T...4...7...>...9...T...+...7.......7...%...>...B...N...T...)...H...)...H.....5Nil dimension handler configuration encountered..tostring.value.config.pairs.m_dimensions=Empty event data supplied for formatting dimension data..err.m_logger.............T...+...7.......7...%...>...)...H...+...7.......T...4...+...7...>...D...%.......$...4.......>...9...B...N...)...H......tostring.Metric_.pairs.m_metrics:Empty event data supplied for formatting metric data..err.m_logger..............T...+...7.......7...%...>...)...H...4...7...7...%...%...'...(...>...%.......7...>.......T...+...7.......7...%...>...)...H...T.......7...%...>...........T.......T...+...7.......7...%...>...)...H...%...+...7.......T...+...7...7.......T...+...7.......T...+...7.......7...%...>...)...H...4...+...7...7...>...D.-.+...7...6.......T...+......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handleonnavigate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):406
                                                                                                                                                                                                                                      Entropy (8bit):5.460121553558894
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:5B9GWUg5AopU3vLFANEz3+XZGlbLHIqfC4imug8JAbyKwsdUTiPMNRFVYWWWZhpq:17jf/N0upGlbLvCEu5JJKw1oMN6O8g0d
                                                                                                                                                                                                                                      MD5:61463F34A299E266F18656BE844BBEFC
                                                                                                                                                                                                                                      SHA1:C3463BF938CBF79CE0CAA12224191DA78634D787
                                                                                                                                                                                                                                      SHA-256:045F111C2562D762D8A381B0658C0C8D4E4782238DEBD64476AE9A2957EA7548
                                                                                                                                                                                                                                      SHA-512:2F4BF7C26B8FB9973D6AB5EB77E38AD52B3C91CFACA1E53D2D98E64495B39BA739F592396B42B2C9312B33DD06D64E3C80867D972ADFF623DBB7D69A6591EF95
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..>.......4...%...@...)handle_on_navigation not implemented.errorZ.......4...7...................>...1...:...0...H.....handle_on_navigation.new.EventHandlero.......4...%...>...2...5...4...1...:...4...0...H.....new.HandleOnNavigate"telemetry.events.EventHandler.require...//750992C92CE883F8662CA80954D5D7616FF836161C4473DD567E736D3DA94D637DEC1EF540D6E433B06C1BBDE92C79FF6BB2A53F43B23573FA78641DB74CB9C1++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\adblockcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3048
                                                                                                                                                                                                                                      Entropy (8bit):5.826944404850673
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:8k60gBNsO134g1yL1abB71E1SAEDhAJdo4MmriRsJi2B5yGzp0pKF:GBNT135b1eio2vYjyu
                                                                                                                                                                                                                                      MD5:4723216679A0344E3538DEA60CCBAA50
                                                                                                                                                                                                                                      SHA1:047CB30340BF1014F17D4E56C7549AEBBC785D31
                                                                                                                                                                                                                                      SHA-256:347D646BEBC10E0F27CC4ADCB9C10113061D9B8E0B9BD98E19787CD281C32F89
                                                                                                                                                                                                                                      SHA-512:C25D400B920A45C226E3FDD0F4B411E926694998455A1FBC1D6871FB4574988BEA91062F34B713776079516CB8668C548476B01BE703EF696F2C22112C6ADEDE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ............+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...7.......T...)...7.......T...4...7...>...........%...7...%...7...$...4...7.......%...$...>...4...7.......%...$...>...4...7.......%...$...>...4.......7...............>...4...7...>.......4.......7...............>...4.......7...............>.......4...7...>.......4.......7...............>...4.......7...............>...........4.......7...............>...)...H......SetOption.GetOption.settings._Occurence._TrackerBlocked._AdBlocked.lower.string._.tonumber.default_no_value.in_context.prefixFOEM Adblock counter handler called with an invalid configuration..AdblockCounter.get_telemetry_configVOEM Adblock Counter handler telemetry event called with an invalid configuration..err.tracker_count.ads_count.interaction_type.browser

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\blockpage.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1154
                                                                                                                                                                                                                                      Entropy (8bit):5.512940706826833
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:jBJ7LRbTMKqCvnujltHEa3saisfEWE5XLZ+nATLjQxvUMoh:LSyGZhEa3saisfEWE5bZ+ATLjq3oh
                                                                                                                                                                                                                                      MD5:6E66153A90A73683C675A263A4EA6390
                                                                                                                                                                                                                                      SHA1:2151CC580913E7B0F5CF4F31C2E8D72C4A6E9D35
                                                                                                                                                                                                                                      SHA-256:A1D28AE8B955C2928EF9D0691B19F7AD8A5909B63248E6BFD557A21C09F9CB96
                                                                                                                                                                                                                                      SHA-512:DA2F63E3BFACE30CB1474757F7982DBA00BBCA454FEE8671D384706A572D8D4FE80AC93DF48DB96B12FE5A6F4CBF67CBD267AC6DF61125FF1F7059E8C105E710
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..y.......4.......7...)...%...'...>.......4.......7...)...%.......@....SetOptionInt.*CounterPagesBlocked.GetOption.settings..........7.......T...7.......T...4.......7...%...@...T...7.......T...4.......7...%...@...T...)...H...G....msad.ads.blocked.Frame.msad.sites.blocked.PublishMessage.wssEventSender.Top.level.Typosquatting._event_name........2+...7...>...,...+.......T...+...7.......7...%...>...)...H...+...7.......T...+...>.......T...+...7.......7...%...>...+...+...>.......T...+...7.......7...%...>...+...7.......T...+...%...:...+...7...@............transmit_telemetry_event.default.metadata-Failed to report block page event to WSS2Failed to modify *CounterPagesBlocked setting.Impression.interaction_typeDEmpty telemetry information returned when processing block page.err.m_logger.get_telemetry_eventf.......4...7...................>...1...1...1...:...0...H.....handle_telemetry_event...new.EventHandlerh.......4...%...>...2...5...4...1...:...4...0...H.....new.BlockPage"telemetry.events.E

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\browser_host_launchers_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2577
                                                                                                                                                                                                                                      Entropy (8bit):5.737477998805083
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:JUlW/H3tnEowp8Gl5nt4uLxmnuCqI/Q5HneRmrROSExM9LgO5g+piVaK:LH3tnZwbrtvQITVeRme6K8g+QP
                                                                                                                                                                                                                                      MD5:7DEEED17E417E565AABACBB48C725DD1
                                                                                                                                                                                                                                      SHA1:EA3F158A6458D6CF8CB99CC08718CFF5D5BE6276
                                                                                                                                                                                                                                      SHA-256:0B905247C46581B25E1682C7475D5CCB53A11522BA6683303D2DD087F004533B
                                                                                                                                                                                                                                      SHA-512:91BFF101E974B62A3EB15AEFE178345363C0EB283420E200F5BC2CBE837CFFC4B9053622FC0B96231C8F3605BA60871D47CB2D97A4FC9133EE1283D724AEBF52
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ............+.......7...%...>...)...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...H...4.......7...)...+...'...>...4.......7...)...+...%...>...4...7.......7.......>...4...7.......>.......T...+...7.......T...+...7.......7...%...>...H...)...4.......>...D...7...7.......T.......+...7.......7...%...7...%...$...>...T...B...N.......T...+...7.......T...+...7.......7...%...7...$...>...2...7...:...2...:...4...7.......>.......9...)...4...7...>...D...7.......T.......+...7.......T...+...7.......7...%...7...%...7...%...$...>...T...B...N.......T...7...4...7...7...>.......7...9...4...7.......7.......>...5...4.......7...)...+...4...>...)...+.......7...%...>...H...........6browser_host_launchers.handle_telemetry_event end.SetOption.signers_json.encode. and signer "signer object for executable .signers.new object for executable . found.object for executable .pairs.Number of entries exceeds telemetry limit.warn.maxn.table.decode.json.core.{}.GetOption.settingsCbrows

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\browsernavigate.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1915
                                                                                                                                                                                                                                      Entropy (8bit):5.590531964701768
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:ll5bQHlV06e4yeGB23kfjHru5XtozKT/LTEuXwV/g:ll5bSV06edEeK+GEnV/g
                                                                                                                                                                                                                                      MD5:FC30D6C776D877F92C545D29033C79EB
                                                                                                                                                                                                                                      SHA1:F9C128A41752CC526CEBC93ED3961EE291FEC9C3
                                                                                                                                                                                                                                      SHA-256:7117236A653E27F636795D55D0D89B3189E28A7FCCC7F8942FBE4D36C81922F1
                                                                                                                                                                                                                                      SHA-512:3F61A7003E92867688BEF634C27159ECB56EBAA8F385EE58DF83034522A58111F31E7DD6CD22C5D0E67A734DA93F0946D3898EF1A146EA402CF06BD1261448E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........@+...7...>...+...7...>.......T...+...7.......7...%.......%...7...$...>...)...H...4.......T...+...7.......7...%...>...)...H...7...4...>...7.......T...7...7.......T...7...7...>...7...+...7...............>...7...>.......T...+...7.......7...%.......$...>...H......Failed to handle event: .handle_on_navigation.new.update_dimension_configs.dimensions.dimension_overrides.set_dimension_config;A global dimension configuration has not been defined..g_dimension_config.handler. Handler: 8Browser Navigate handler does not exist for event: .err.m_logger.get_telemetry_event.get_dimension_processor.........4.......T...4...7.......T...+...7.......T...+...7.......7...%...>...G...4...4...7...>...D...)...7.......T...4...%...7...$...>...........T...7.......T...+...3...:...:...9...B...N...G........config....handle_on_navigation.telemetry.events.handlers..require.handler.pairs;A global telemetry configuration has not been defined..err.m_logger.events.g_telemetry_configy.......4.......7...)...%...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\commonlogicloader.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1199
                                                                                                                                                                                                                                      Entropy (8bit):5.829302902903248
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:BJkCKQBwRdS53hIL71zgDjkwAcrwP/3d+kFtiuWeTxIPFBFG+:+awRdS9wRmkwZ4fd+sBIPF2+
                                                                                                                                                                                                                                      MD5:88CCC6435CDC09A2145F0DD0A8FA232F
                                                                                                                                                                                                                                      SHA1:DCD71B672B82F22E957B5D930AB68CC37175C365
                                                                                                                                                                                                                                      SHA-256:8F9ACE05E225A0048FD55E63819421C25E24B28755DE8A0136F7DF0070392085
                                                                                                                                                                                                                                      SHA-512:0531E308BC7B7DD945F6DC9D405149ECCF897E10831ED9E7F15FA3BB4ACB2E44867E810A14E1FA917395C6F414A3903D2AE0B8ECD3275CC0922063BAFAA68DC8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...6.......T...6...H.......T...)...4.......7...............>.......T.......T...)...9...H...4.......'...>...G....error.include.external.loaded.package.........3...%...4.......>...T...4...4...........>...A...N...G....requireFromLogic.pcall.ipairs.\logic\.....MiscUtils.providers_selector.base_provider.ss_logic.oem_business_logic.type_tag_utils........W%...4.......7...>.......$...4...7...%...'...>...4...7...%...>...4...7...7.......%...$.......>...7.......T.5.4...7...8...7...>...'.......T.-.Q.+.....7...%...%...>...4...7.......7...%...........$...>...4...4...........>.......T...4...7.......7.......>...4...7...7...........>...........T...4...7...8...7...>.......T...T...4...7.......7...%...>...G....loadSSProvidersCode end.FindNextFile.err.requireFromLogic.pcall.Loading script: .info.log...luc.gsub.cFileName.string.handle.*.luc.FindFirstFile.Win32.core.WIN32_FIND_DATA[1].new.void*.cast.ffi.GetInstallPath.utility.\logic\providers\.m.......1...5...1...5...1...5...4...>...4...>.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\contentsecuritypolicywasm.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1827
                                                                                                                                                                                                                                      Entropy (8bit):5.50882085826588
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:yJNPFxT8++kjzUK7cqPcgzWeE46+sEF66DZaJt9:yJNPbThjMIpH+6o
                                                                                                                                                                                                                                      MD5:7837E7BE31FBA4EE891D8BBDF1FA0878
                                                                                                                                                                                                                                      SHA1:61A3F8DE591524961A7EF6C187EA0EDFD3C1350C
                                                                                                                                                                                                                                      SHA-256:DAC4CB9A7A07EFF7E5C2A84D814C4EE3AEC5E453182A480ED8D1612813A923D8
                                                                                                                                                                                                                                      SHA-512:57B35FC9E24ECD0C9DFA85357BB61B527D30AEE4E18F01BB0ABE57419F28D0DB0FC6D6503EF5AD12C5CC2C6FFA4E787E4C8A6C360893515E98907330942585A2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........+...7.......7...%.......$...>...+...4.......>...6...H........tonumber2Inside get_counter_setting and the colour is .info.m_loggerd.......4.......7...).......'...>.......4.......7...)...........@....SetOptionInt.GetOption.settings.........@+...7.......7...%...>...+...7...>...,...+.......T...+...7.......T...+...7.......T...+...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7.......T...+...+...7...>.......T...+.......>.......T...+...7.......7...%.......$...>...)...H...)...H...........zThe counter did not increment successfully when processing Content_Security_Policy_Wasm. The counter setting name is .PREVENT_WASM^Event does not carry all required components when processing Content_Security_Policy_Wasm.err!Content_Security_Policy_Wasm._event_name.colour.policy.browser.get_telemetry_eventBInside handle_telemetry_event of Content_Security_Policy_Wasm.info.m_logger.........+...7.......7...%...>...+...+...>.......T...+...7.......7...%...>...)...H...G.........uBro

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\dailycounters.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2904
                                                                                                                                                                                                                                      Entropy (8bit):5.869971234636319
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:6TSowCerlmoeRHcOMRKikeF1NBMz+Y46bCtN0Zp/0wK2cyOh26QMyfd9a3WA8vzU:6TSowCe5JQ8bK2y+ACteXtP8rifdnV2
                                                                                                                                                                                                                                      MD5:ED4990BF201E840461874DC7F9AAA5DF
                                                                                                                                                                                                                                      SHA1:0D59E725289A757BBA461AFFD7530D07D7ADEF9B
                                                                                                                                                                                                                                      SHA-256:13FC577F71053A6D4A61A903631F91007478EDF12DF1C8B0701D480723BE515A
                                                                                                                                                                                                                                      SHA-512:2A7336E4E96165A4451523B22726C10C8BA79154D5A2D16DD7A1B77C915CE80E7FC4338F5F17883FDB62834C7997699ECAAB6C5EA699267DFB23678697D7618B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7.......7...%...>...4.......7...)...+...'...>.......4.......7...)...+.......@......SetOption.GetOption.settings-Inside increment_toast_check_event_count.info.log.core.........^)...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...7.......T...)...7.......T...4...7...>.......4.......7...........%...7...%...4...7...7...>...$.......>.......4.......7...........%...7...%...4...7...7...>...$.......>...)...H......SetOption.lower.string._.GetOption.settings.tonumber.default_no_value.in_context.prefixEOEM Daily counters handler called with an invalid configuration..DailyCounters.get_telemetry_configUOEM Daily Counters handler telemetry event called with an invalid configuration..err.m_logger.triggerType.browser.get_telemetry_event..... .)...+.......7...%...>...+...7...>...)...)...'...)...%...2...%...;...%...;.......T...7.......T...7..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\dailyping.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3688
                                                                                                                                                                                                                                      Entropy (8bit):5.616011666245989
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:L5eZm6AV06e0wduOGhmEXunBaZH8oQNnAjmzi9:L6kVreLuDXaBayoQNnAjmzm
                                                                                                                                                                                                                                      MD5:87062F22452B1E0155997E41236B420B
                                                                                                                                                                                                                                      SHA1:8F9A8A9DBE16C21B4C5C60A56EB1CE23FA5B29F4
                                                                                                                                                                                                                                      SHA-256:E3144674221DA92CC51E3A789D49F3D950E2D3FCD8C5F34FEEB22CB3FAB08B2D
                                                                                                                                                                                                                                      SHA-512:4660B071969EF5E1E71C240A9BA7BF2C446E7072E55B41EAD2BB003A8AE8E14CF89FAA0E19C8C0ACFE6FC48633B9AE8D1F0EDE7BE708A8CC0294D4227CE89E13
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........M+...7...>...+...7...>.......T...+...7.......7...%.......%...7...$...>...)...H...4.......T...+...7.......7...%...>...)...H...7...4...>...7.......T...7...7.......T...7...7...>...3...7...+...7...............>...7.......>...+...9.......T...+...7.......7...%.......$...>...T...+...7.......7...%.......$...>...H....... succeeded to handle event: .info.Failed to handle event: .send_on_ping.new....update_dimension_configs.dimensions.dimension_overrides.set_dimension_config;A global dimension configuration has not been defined..g_dimension_config.handler. Handler: 4Send on ping handler does not exist for event: .err.m_logger.get_telemetry_event.get_dimension_processor.........%...4...+...>...D. .....T...7.......T...+...7...7...7...>...7.......T...7.......T...+...7.......7...%.......%...4...7...>...$...>...4...7...>.......B...N.......T...+...7.......>...G........set_extra_data.tostringG) has requested to have the following added to the event payload: .Event handler (.warn.m_logger.ex

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\domainnavigatedcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3246
                                                                                                                                                                                                                                      Entropy (8bit):5.864178484830781
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:+Wip64s69KADsgLgYjnL6k5ZaO7a4sxPi2iFiz/MPh/cNcZCDW7Fe3:++69RngsnraOaihW/7+ZCQe3
                                                                                                                                                                                                                                      MD5:D6BACC9242CF5267115C728BD87D814B
                                                                                                                                                                                                                                      SHA1:10EE92C3E8F5B116278BEDBF09BFE3D6C1CAE303
                                                                                                                                                                                                                                      SHA-256:2697DDAD0DE91B6E593F605B0BA3B8271EA0CF520438F6BBF18A6E910D8F7EE7
                                                                                                                                                                                                                                      SHA-512:AE03E81FD842644BA800093C69F4816E6A16B042544D635B3D711005FEEE2C55E4E816AEF0720AD3FFA9B9FD1E1B17B23F196E23BFE548E856D3E7CA7AE371DE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..n.......4.......>...D...4...7.......7...>.......T...7...H...B...N...)...H....domain.urlMatch.match.string.pairs`.......2...'...4.......>...D.......7...9...B...N...4...7.......>...H....sort.table.domain.pairs.........)...H...........|+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...4.......7...)...%...)...>.......T...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...4...7...>.......7.......T...4...7...>.......7.......T...7...,...+...7...+...>.......T...)...H...4...7.......%.......%...+...7...$...>...+...7.......7.......>...4.......7...............>.......4.......7...............>...)...H............SetOption._.lower.string.domains.tonumber.default_no_value.toboolean.in_context.prefixGOEM Domain Navigated handler called with an invalid configuration..DomainNavigated.get_telemetry_config.domain_navigated_disabled.GetOption.settingsGSearch Term handler w

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\downloadscan.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1781
                                                                                                                                                                                                                                      Entropy (8bit):5.711889242195641
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:nDu+dLOuEfj7Jm7EINGleqj6fZ+zAIuKbpo:DdevleK6URG
                                                                                                                                                                                                                                      MD5:B178B1782A75078CE4E5C8E740A408E6
                                                                                                                                                                                                                                      SHA1:0DA06BC82E3BA285C0D7F36D9F26324F89CDED71
                                                                                                                                                                                                                                      SHA-256:8FAB909CE6BBD2A07416E105B323C914ED398D1C50DAEBC167FDDDE9FC384C60
                                                                                                                                                                                                                                      SHA-512:C28EA20E4632A2D285604F0AF58D04961B147FB9C3F0C9EC1E9E35684C3F42A502CF163B83361A12F1ABFE7D49B3210316F84171AFABE3F8D85ED7D9CBEFC91B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..X.......4.......7...)...%...)...@...&*DownloadScanSendProcessTelemetry.GetOption.settingsU.......4.......7...)...%...)...@...#*DownloadScanSendFileTelemetry.GetOption.settings........;%...)...7.......T...%...T.!.7.......T...7.......T...%...4.......7...%...>.......T...T...7.......T...7.......T...4.......7...%...>.......T.......H...T...)...H...4.......7...).......'...>.......4.......7...)...........>.......T.......H....SetOptionInt.GetOption.settings.msad.files.safe.AcceptRisk.msad.files.blocked.PublishMessage.wssEventSender.*CounterDownloadsBlocked.Blocked.interaction_type.DownloadBlock.*CounterDownloadsScanned.DownloadScan.name..........V+...7...>.......T...+...7.......7...%...>...)...H...+.......>.......T...+...7.......7...%...>...4...7...7...%...%...'...4...7...7...7...>.......T.......7...>.......T...+...7.......7...%...>...)...H.......7...%...>...7.......T.......T...)...H...7.......T...+...>.......T...%...:...7.......T...+...>.......T...%...:...+...7.......>...+...7...@........

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\formlogindetect.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2822
                                                                                                                                                                                                                                      Entropy (8bit):5.664300724525617
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:u5xsqnN264AneiuRRRFNyv9IcduhjfvKgdtt3yB84RwKnAJjKnI/gLCD3YjZdq:1nCei8Rdv9HGWBvqdq
                                                                                                                                                                                                                                      MD5:4E01B775E77B17C199565087B7994874
                                                                                                                                                                                                                                      SHA1:BBF65A6C54CAC5727AEB520142A9B563AA0038EB
                                                                                                                                                                                                                                      SHA-256:386C7152CC77435BEC96F1BB0C17164405A00FBBCFBE6AA9B20ABEB628FACE85
                                                                                                                                                                                                                                      SHA-512:DF0E1CB7E51151A3324747EE0AE07EE0DA45EE6493AB0064BC23F4BD80879D245A9B97DE90463222ACF27F8307C1FA0338DBDF3AD79FF9476CA42ECCD1A812FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..q.......%.......7.......>.......T.......7...%...%...>.......T...%...H.....^www%..gsub.match.%w+://([%w.-]+)%.(%w+)........f+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...4.......7...)...%...)...>.......4.......7...)...%...)...>...........T...7.......T.......T...7.......T...+...7...>...3...:...7...:...7...:...+...7.......>...+...7...>...7.......>...+...7...>...)...H...T.......T...7.......T.......T...7.......T...)...H...T...+...7.......7...%...>...)...H...G.......8Login Detect handler type is neigher form or login..transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event....name.FormLoginDetect._event_name.FormLoginDetect.count.1.login.form.login_count_disabled.form_detect_disabled.GetOption.settingsOForm (login) Detect handler was supplied a malformed event for processing..err.m_logger.type.browser.url.name.get_telemetry_event........G+...7.......7...%...>...+...7...>.......T...7.......T...7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\heronerrorslog.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2664
                                                                                                                                                                                                                                      Entropy (8bit):5.695928721290874
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:styJNMl6IH3vjFIVAGPHX7yb1AgjDRQVdXPWHFOjQryuqgA3pDJ8ZGpw:pNiL6VOBAaedua0kLW
                                                                                                                                                                                                                                      MD5:2BCD2D2F9FA910E881506AFC5469160E
                                                                                                                                                                                                                                      SHA1:69560585DB074FC8CA18DEBF7FEC33464E7E591C
                                                                                                                                                                                                                                      SHA-256:1229EBE3E0B0AE1745EFE45B9BC607B8A1F28495AD076082E14DFCB42F0D0437
                                                                                                                                                                                                                                      SHA-512:B3ABE72D0989E5EBA2E64551D4D29F2ED587C9246F19891D8B29AA0147910A789DF195E98078040B9524B8FB286CE552E9E9205FE26998960D6B5E382C87CD20
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........#...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...,...)...7.......T...7.......T...)...%...7.......T...7...4.......7...)...+...)...>.......T...+...7.......7...%...>...)...H...4.......7.......+.......>.......T.......T...%...T.......%...$...%...7.......T...7.......T...%...7...%...$...%...7.......T...7.......T...%...7...%...$...%...7.......T...7.......T...%...7...%...$...%...7.......T...7.......T...7...%...7.......T...7.......T...7...%...7.......T...7.......T...%...7...%...$...%.......%.......%.......%.......%.......%.......$.......%. .....%.!.$...4.......7.".....+.......>...)...H..........SetOption.}.{.,"metadata":.,"line_number":.,"error_code":.,"error_type":.,"function_name":."file_name":.".default.null.,.[-HeronErrorsLog heron telemetry disabled..info.GetOption.settings.default_no_value..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedapplications.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1261
                                                                                                                                                                                                                                      Entropy (8bit):5.585387162844009
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:lbSBcSmSHYSjd05LqJ2Z9uKwKciAj/yuBMlFelDzfs5yrm:lmB1mtSj+5ewLuKwKHAj/yu2KDw+m
                                                                                                                                                                                                                                      MD5:1ECD21031C9FF626CAE42210EF745F3E
                                                                                                                                                                                                                                      SHA1:ABA45AC52D871C5A3C33E80D149D690CE999CCD0
                                                                                                                                                                                                                                      SHA-256:32852DDD29780C51F1C250457B3EDEE562124B646742E762421E2292036A3692
                                                                                                                                                                                                                                      SHA-512:A4B1719FD15AE03F152868AD2FC3DFC3A753AC33822DF43EDFA36F2F120FDED57C6D605464864D98C60DCB1F21E548D2CC82EC838F0CEF05C01C0E23930C8BF5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........)...H...........U+...7.......7...%...>...4.......7...)...+...'...>...4.......7...)...+...'...>.......T...+...7.......7...%...>...)...H.......T...+...7.......7...%...>...)...H...4.......7...>.......T...+...7.......7...%...>...)...H...+...7.......7...%.......$...>...3...:...:...+...7.......>...+...7...>...7.......>...4.......7...)...+.......>...+...7...@..........transmit_telemetry_event.SetOptionInt.set_event.get_dimension_processor.set_telemetry_event.applications.version....name.InstalledApplications._event_name.InstalledApplications applications json payload: .Nil payload so not sending.GetInstalledApplications.telemetry*Ver_to_send < ver_sent so not sending*Ver_to_send = ver_sent so not sending.GetOption.settings@Entering InstalledApplications event handler's send_on_ping.info.m_logger.........4...7...................>...%...%...1...:...1...:...0...H.....send_on_ping..handle_telemetry_event Installed_Apps_Version_Sent#Installed_Apps_Version_To_Send.new.SendOnPing.......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\installedextensions.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1351
                                                                                                                                                                                                                                      Entropy (8bit):5.687840852441756
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:6gCFaWr5tUHeBMssgRoo6xQ6FF9K6FXovjhsxNa3VEGlEBADzfWg5zc:6ZJ5tUHeBMFgRooRqKhvjexNa3DWODVm
                                                                                                                                                                                                                                      MD5:D459CC9F2A71DC62A606F2C61B29F71A
                                                                                                                                                                                                                                      SHA1:20D3E8BA1B56A17089D03E2D86176DFE3DBBB81F
                                                                                                                                                                                                                                      SHA-256:90CC2519AC2CF9551A354CCEAD4C1620F9A8D2C3026422FE786E9C747A1E5CFF
                                                                                                                                                                                                                                      SHA-512:8A28BB05BEE75A079B4376404733D48EE0A93EBC9A33C509BD74D7B847E30407B3E218A57744F8D4D0097CBCBD95EB7F221032C51453270C0B90B58D5CB80D44
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........)...H...........\+...7.......7...%...>...4.......7...)...+...'...>...4...+...>...D.H.4.......7...)...+.......$...'...>.......T...+...7.......7...%.......>...T.5.4.......7.......>.......T...+...7.......7...%.......>...T.&.+...7.......7...%.......%.......$...>...3...:...:...:...+...7.......>...+...7...>...7.......>...+...7...>.......T...4.......7...)...+.......$.......>...B...N...G............SetOptionInt.transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event.extensions.version.browser....name.InstalledExtensions._event_name.InstalledExtensions. is *extensions json payload for browser: ANil installed extensions payload so not sending for browser .get_extensions_info.browserSettings8Ver_to_send <= ver_sent so not sending for browser .pairs.GetOption.settings>Entering InstalledExtensions event handler's send_on_ping.info.m_logger.........4...7...................>...%...%...3...1...:...1...:...0...H.....send_on_ping..handle_telemetry_event....ED...CH..'I

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\ipc_stats_handler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1519
                                                                                                                                                                                                                                      Entropy (8bit):5.6326825408411745
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:Ecz9BaKBaoOCYQaQbNU35vI8liwKw1pkivrq8sokVzLbDjI5rbi:E+9fc05N+/IwKwbRjq5xnDkVu
                                                                                                                                                                                                                                      MD5:CCACAE190A927D3F44056D2B18342E63
                                                                                                                                                                                                                                      SHA1:CE627E604DE33E7C49A5D2BEC765CD9477B3C8C2
                                                                                                                                                                                                                                      SHA-256:700804BA5B218D2BBBAB06450ACEE9E2A44B5EE60C5424F37BB0DA5812F67040
                                                                                                                                                                                                                                      SHA-512:5E63F0B94021536CB288AE54C89C388E0292C27744F19F9E40259D5952B3AC43DCDF9FD1992CC8E492B95C05E641935CD3FCB7BFB9D38F4247F7E2257D1080C7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..q.......4.......>...2...'...4...7.......%.......%...$...>...T...9.......A...N...H....]+.[^.gmatch.string.tostring.S.......+.......7...%...>...)...H.....-ipc_stats_handler.handle_telemetry_event.info........]+...7.......7...%...>...4...4.......7...>...=...+...7.......7...%.......$...>...+...%.......>...4.......>...D.7.+...%...4.......>...=...8.......T...8.......T.+.4...8...>...'.......T.%.3...8...:...:...+...7.......>...+...7...>...7.......>...+...7.......7...%...7...%...4...7...>...$...>...+...7...>.......T...+...7.......7...%...>...B...N...+...7.......7...%...>...)...H.......'ipc_stats_handler.send_on_ping end5ipc_stats_handler.send_on_ping event sent failed.transmit_telemetry_event. = 4ipc_stats_handler.send_on_ping sending counter .set_event.get_dimension_processor.set_telemetry_event.count.stats_type....name.IPCStat._event_name.ipc_stat.tonumber.:.pairs.;.counter string: .get_ipc_stats.utility.tostring)ipc_stats_handler.send_on_ping begin.info.m_logger.............7...%...>...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\logicscripterror.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1426
                                                                                                                                                                                                                                      Entropy (8bit):5.4875054960112735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:DgLpKv7uvs1ADRQVYlPMFcSF8n3QnvIRRsInTWEpqaEsJ1RLHnr3okZML9KiDZ/z:qgDuvWADRlP+8AvYR3SEEaEsvRDr3NMf
                                                                                                                                                                                                                                      MD5:62ABEAB8883A7B2A5F0C090DE534A944
                                                                                                                                                                                                                                      SHA1:0C088FEB82FE893636790B9B6B5A953AFA513BF4
                                                                                                                                                                                                                                      SHA-256:63D2C0056251ECD7BBD325B422423B84E06D95F8A7B7F5CEF34949ADAF4370BE
                                                                                                                                                                                                                                      SHA-512:6BF800510D3BA256C3FEE7388132C819D505C1E79183529AA981A61C84A6358DC004490219A00069CD79BDACF22D4C9F07C24763FE6F999B5CB967B6E913A43C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..R.......+.......7...%...>...)...H.....,LogicScriptError.handle_telemetry_event.info........]+...7.......7...%...>...3...4...4.......7...)...%...'...>...=...:...4.......7...)...%...%...>...:...4.......7...)...%...%...>...:...7.......T...7.......T...+...7.......7...%...>...)...H...+...7.......>...+...7...>...7.......>...+...7...>.......T...+...7.......7...%...>...4.......7...)...%...%...>.......T...4.......7...)...%...%...>...H...+...7.......7...%...>...)...H.....&LogicScriptError.send_on_ping end.SetOption-LogicScriptError.send_on_ping event sent.transmit_telemetry_event.set_event.get_dimension_processor.set_telemetry_event+LogicScriptError.send_on_ping no error.endPoint.LogicErrorEndpoint.errorMessage..LogicErrorMessage.errorCode.LogicErrorCode.GetOption.settings.tostring....name.LogicScriptError._event_name.Logic_script_error(LogicScriptError.send_on_ping begin.info.m_logger.............7...%...>...4...7...................>...1...:...1...:.......7...%...>...0...H....LogicScriptEr

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\lowsearchusertargeting.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3226
                                                                                                                                                                                                                                      Entropy (8bit):5.62953265004622
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:DMi+oQZwff8/02fDme6drrOlqln7hiiHDksa4V+jmPV06B7L9s370703aFD2bXsg:DFBUghhTgs7+21LGw70e6Tsg
                                                                                                                                                                                                                                      MD5:4E60D5D78A073E711097D64F97A1C42D
                                                                                                                                                                                                                                      SHA1:0F58862E7B15F3D36F20ED8940E32CD159AD2F4F
                                                                                                                                                                                                                                      SHA-256:135576AE651B38DA9E08AE97485F29D513C60F6A95C6EE04F0DF95FD569A26BB
                                                                                                                                                                                                                                      SHA-512:0F40982A049B8385A76E558F77C61B0D89E3860570BB06A636AA511E3DE530506729ED0EDC5FE660AFDF49B9ED0DC374BDA2ADAAF2BCA71B9B027EF74FDF3A94
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........2...4...7.......7...%...>...%...4...4.......7...)...%...'...>...=...4...4.......7...)...%...'...>...=...4...7.......7...%.......%.......%.......$...>.......T...4...7.......7...%...>...G...4.......7...)...%...)...>...4.......7...)...%...)...>.......T...%...T.......T...%...4...7.......7...%...4.......>...%...4.......>...%.......$...>.......T...4.......7...)...%...'...>...4...7.......7...%...4.......>...$...>.......T...4.......7...)...%...'...>...4...7.......7...%...4.......>...$...>...4...4.......7...)...%...'...>...=...4...7.......7...%.......$...>...4...4.......7...)...%...)...>...=.......T...G...4.......>...4...7.......7...%...4.......>...$...>...4...4...7...%. .....>...=...4...7.......7...%.!.....$...>...3.".:.#.:.$.:.%.:.&.:.'.4...7.......7...%.(.>...+...7.).....>...4...7.......7...%.*.>...+...7.+.>...7.,.....>...+...7.-.>...4...7.......7...%...>.......4...7.......7...%./.....$...>...4.......7.0.)...%.......>...4...7.......7...%.1.>...G.....9send_low_search_user_targettin

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\metriccounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1431
                                                                                                                                                                                                                                      Entropy (8bit):5.576082704207265
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:XAu49LcHIDasShcfGtK6Z+zFvYMshhr2Nmkctm2MtKBVLjzfz5MhFw:XR0coDal4jzFwnhAN1n2xbnXi6
                                                                                                                                                                                                                                      MD5:1803D963CCE89137968EEDA5C65A58FA
                                                                                                                                                                                                                                      SHA1:6B75B7396F0E1C7718BFA08E7ADC15ED037986E1
                                                                                                                                                                                                                                      SHA-256:9A0096A2315CDE3C1ABDCBC230D8EA359364DE0ECC2C61A9189D0D51C5F89FBB
                                                                                                                                                                                                                                      SHA-512:4FDFEFC7574514432B06B93D2F89AE051E4CA80907170BD198F2BE1D89994D244EBC56E3F88D961D28EA9F93D4A4367E9DEDD67A4427AC8419CC3B4BABAED93C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........=+...7...>...)...'.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7.......T...)...7.......T...4...7...>.......4.......7.......7.......>.......7.......T...7.......T...7...4.......7.......7.......@......SetOption.max_value.GetOption.settings.tonumber.default_no_value.in_context>OEM counter handler called with an invalid configuration..err.m_logger.setting_name.metric_id.get_telemetry_config.........\+...7...>...)...)...'...).......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7.......T...)...7.......T...7.......T...)...7.......T...4...7...>.......7.......T...7.......T...)...4.......7.......7.......>...'.......T.......T...7.......T...7.......T...7...7...:...:.......T.......T...4.......7.......7.......@...T...)...H...G......SetOption.metric_value.max_value.GetOption.settings.reset_count.tonumber.default_no_value.append_zero.in_context>OEM counter handler called with an invalid configuratio

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\navigatedtoday.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3916
                                                                                                                                                                                                                                      Entropy (8bit):5.560009855000876
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:V7Fzh4zrzeEVeWsoMaWHh4pMNV8g6ra+oQcHvh9CWNM:V7Ft4Tp5soMaWH4W/6++oZCW6
                                                                                                                                                                                                                                      MD5:41BFFA6A3F2BC3FB05AA569797779870
                                                                                                                                                                                                                                      SHA1:C3A4B9ECF0100D1AF016A5F003CD82FC64EB1DF5
                                                                                                                                                                                                                                      SHA-256:C2CA9E0C3CE1662A3F6B441910889E1982969DA8BF47C3B6D45BD3D35BD123FF
                                                                                                                                                                                                                                      SHA-512:30EC4B72F02EC171A65D7D7018F3B9D7907BE63FAE0962410055BAB3D9A71ED3AD3AD933FE7291CE9060E98A4BBE1DEFEEAB7111A459312409FCEA2D99A75A82
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..c.......4.......7...)...+...'...>.......4.......7...)...+.......@......SetOption.GetOption.settings.>.......4...7...4...7...%...>...=.......H....!*t.date.time.os..Y...........T.......T...4.......7...)...+.......$...'...@...'...H......GetOption.settings.a...........T.......T.......T...4.......7...)...+.......$.......@...)...H......SetOption.settings.Y...........T.......T...4.......7...)...+.......$...'...@...'...H......GetOption.settings.a...........T.......T.......T...4.......7...)...+.......$.......@...)...H......SetOption.settings...........4...7.......7...%...>.......T.......T...+...7.......7...%...>...)...H...4.......7...'...>...+.......>.......T.&.+.......+...>...=...3...+...:...+...:...:...:...+...7.......>...+...7...>...7.......>...+...>...4.......7...)...+...)...>.......T...+...7...@...)...H...+...>...+...........T...+.......>...+.......'...>...+...........>...3...+...:...+...:...:...:.......:...+...7.......>...+...7...>...7.......>...+...>...4.......7...)...+...)...>.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\newtabcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2751
                                                                                                                                                                                                                                      Entropy (8bit):5.825883292025569
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:bIZdNL8zr0HDmRta30IaWa0ZaNVk5zm0V4m9XjH2pxVwAjzpnbW3Mi:wNL8/s+/W1aI1nDczsMi
                                                                                                                                                                                                                                      MD5:91D9BF9B76E3E1446C6139A4F7914670
                                                                                                                                                                                                                                      SHA1:420A63140B7CAD991F3396CB6A96C5D0653F022A
                                                                                                                                                                                                                                      SHA-256:0D5E1A4C009AE7E5E85B26EF27B6207CEDB016BB25B86C6FE2DB0E4D242FE73C
                                                                                                                                                                                                                                      SHA-512:CB14F1ED4F6279548B2653BD94D47C1268A1D967D4EEE768C822E9455B5F7254442ACE197226F41E6202A60ED92E10213A089EE04FC68F7135E54D0D4BAC5D00
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ............+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...4...7...>.......7.......T...4...7...>.......4...7.......%...7...%...7...%...%...$...>...4...7.......>...4.......7...............>...4...7...>.......T...4.......7...........4...7...>...=...4...7.......%...7...%...7...%...%...$...>.......4...7.......>.......4.......7...............>...........4.......7...............>...)...H......Impressions.SetOption.GetOption.settings.MaximumNumberOfShortcuts._.lower.string.tonumber.default_no_value.toboolean.in_context.prefixEOEM NewTab counter handler called with an invalid configuration..NewTabCounter.get_telemetry_configUOEM NewTab Counter handler telemetry event called with an invalid configuration..err.shortcutCount.action_type.browser.name.get_telemetry_event3Entering NewTab Counter Han

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\pushnotification.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2899
                                                                                                                                                                                                                                      Entropy (8bit):5.646080120584331
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:jve3AKqKVwvdUJEZ6KVgRLhb/BSif4PyVZTeSvCPGMGuah7uJnUtXSzjIsPOusuA:jvVKqKVwvdUA6SCtppflZTeICPGMdnyL
                                                                                                                                                                                                                                      MD5:573D64FBB7F270F4B5A1E1277516AA2F
                                                                                                                                                                                                                                      SHA1:DD798F9AFFF2363CE565149CAE32258243B85DF7
                                                                                                                                                                                                                                      SHA-256:316473E968B9FF26B0BFE86B3CF503DBEE39833409C8FDDB354CF5BE1B33067B
                                                                                                                                                                                                                                      SHA-512:6A267A2DC8DB2A29196C5E591617079D91AEC1D52DE92760D86D141590947989B5686234C1D6273079FF146D534B2ACAD26398917752A84A92AD70C2656A9961
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........$4.......7...)...+...'...>...4.......7...)...+...'...>.......T...+...7.......7...%...>...)...H.......T...+...7.......7...%...>...)...H...)...H.........;PushNotification ver_to_send < ver_sent so not sending;PushNotification ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......4.......7...)...+...'...>...4.......7...)...+.......>...G........SetOptionInt.GetOption.settings.........%...4.......>...T.......%...4.......>...%...$...A...N.......T.......7...'...'...>...........%...$...H....].sub.",.tostring.".ipairs.[........('...2...4.......>...T.......7...%...>.......7.......>.......7...%...>.......7...'.......>...........T...4...7...........>.......A...N...+.......>...........F......insert.table..:.sub.//.find.ipairs.t.......3...:...:...:...H....count.data.event_action....browser.ch.name.PushNotification._event_name.PushNotification.........+...................>...7.......>...7...>...7.......>...7...@......transmit_telemetry_event.set_event.get_dimensio

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchreset.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3205
                                                                                                                                                                                                                                      Entropy (8bit):5.495930379332892
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:idvdKkKVwvd724pHIkjKlDtx0nImPP6VNPNLxF43fD:idvdKkK+vte7x0mHS3fD
                                                                                                                                                                                                                                      MD5:4E3E5E606D48706AAB31B07661BE8BDE
                                                                                                                                                                                                                                      SHA1:7DEA8DDBB9052E7B82FC2EF83E83832431AFD503
                                                                                                                                                                                                                                      SHA-256:821CBF064AAB1FF9A54584AD0F2321262DD682523CDFCDC35D5E3A646D06AABE
                                                                                                                                                                                                                                      SHA-512:734B447508D07EBEADEB2A22477C8722C93F29196401044CA2526E8BA321C30555D1C09AE49EAD3BE9C752A467674D63ADD44D18F4DB8F3A33B731229D09BEA0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...7...4...7...%...>...=...4.......7...)...+...'...>...'.......T...'...H.......H......GetOption.settings.!*t.date.time.os........$4.......7...)...+...'...>...4.......7...)...+...'...>.......T...+...7.......7...%...>...)...H.......T...+...7.......7...%...>...)...H...)...H.........<Running processes ver_to_send < ver_sent so not sending<Running procceses ver_to_send = ver_sent so not sending.info.m_logger.GetOption.settingsg.......4.......7...)...+...'...>...4.......7...)...+.......>...G........SetOptionInt.GetOption.settings..........+...7.......7...%...>...4.......7...)...+...)...>.......T...)...H...+...7...>...,...+...7.......T...4...7...4...7...%...>...=...4.......7...)...+.......>...4.......7...)...+...'...>...)...H...4.......7...)...+...'...>.......T.L.+...7.......T...+...7.......T...+...7.......T.@.+...>...'.......T...+...7.......7...%...>...)...H...+...:...+...>.......T...4.......7...>.......T...+...7.......7...%.......$...>...+...:...+...>...+...7...+...>...+...7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchsuggestcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2562
                                                                                                                                                                                                                                      Entropy (8bit):5.81255614935544
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:0QIZdNV7ED4Ku9TaHg+0+g1Lk+1UgU62M4thC8P4i2LeY0zptDUz:yNxE+8UAfVw8PfCMX4
                                                                                                                                                                                                                                      MD5:D133700B73756BE041A54FC551E99852
                                                                                                                                                                                                                                      SHA1:091061D05C1F5760E351F6B7169A0F616C3A919F
                                                                                                                                                                                                                                      SHA-256:F4C6641AEFFCA3E55828CD1DBC02589ABD8822861499D69BB3E1D72B9040011B
                                                                                                                                                                                                                                      SHA-512:D9EB63643E767266860178F22657EB73E3C23F2867EDF4B97B2F5A09FCABEC4011C80C3C3B221799AE8090EE27539F40F5A363D78A64469294F8D7DAAFC7BBF9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........e+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...4...7...>.......7.......T...4...7...>.......4...7.......%...7...%...7...%...7...$...>...4.......7...............>.......4.......7...............>...)...H......SetOption.GetOption.settings._.lower.string.tonumber.default_no_value.toboolean.in_context.prefixLOEM SearchSuggest counter handler called with an invalid configuration..SearchSuggestCounter.get_telemetry_config\OEM SearchSuggest Counter handler telemetry event called with an invalid configuration..err.search_type.interaction_type.browser.name.get_telemetry_event:Entering SearchSuggest Counter Handle Telemetry Event.info.m_logger.......$...+...7.......7...%...>...+...7...>...)...)...'...)...%...3...3...3.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\searchterm.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4683
                                                                                                                                                                                                                                      Entropy (8bit):5.687149466760127
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ufqXdybwOxIZ86gN0rwhPC9p+Oo5abb8i+d5/i3WBdOLmKYiFxbhua+jGPU:uf6yqZ8vWrwhPwp+Oo5abb5+dVi3WBdd
                                                                                                                                                                                                                                      MD5:22ADDB5E5205AE3BE2A622D59C9AA9D2
                                                                                                                                                                                                                                      SHA1:F795537BD8D1FD6AF0C0E78A7743C9D6ADA47044
                                                                                                                                                                                                                                      SHA-256:824FDD146E0E4603D8CEADCB41626ED4717EB388ADE3230665AF8B3287B51762
                                                                                                                                                                                                                                      SHA-512:C9739DC0EA6D26551934CDD0173E7E75C7B4C41D046414438838399B9C001B3BBB68C8FFFD5AF13306BB12B07FCCE30FFAF32BC0554908490AD87747EBC7450B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..8.......4...7...4.......'...>...?....tonumber.char.string+...........7...%...+...@......%%(%x%x).gsubc.......4.......>...D...4...7.......7...>.......T...H...B...N...)...H....urlMatch.match.string.pairs........04...7...........>...5...5...4...7.......4.......>...4...7.......%...>...5...5...4.......T...4...7.......'...4.......>.......+.......>.......4...7.......%...%...>.......4...7.......>.......H......lower. .+.gsub.first2.last2.&.sub.first.last.find.string.2.......+.......+...6...7...@........firstIndicator........F%...4.......>...T.>.)...4...7...>...T...)...4.......>...T...4...7.......%.......%...$...>.......T...)...T...)...T...A...N.......T...)...T...A...N.......T...4...7...>...T...4...7.......%.......%...$...>.......T...)...T...A...N.......T.......T...7...T...7...%.......$...A...N...H.... .category.exclusion.%f[^%w_].%f[%w_].match.string.inclusion.ipairs.........)...H.............+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...+...7.......T...+...7.......7.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\securesearchhit.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7378
                                                                                                                                                                                                                                      Entropy (8bit):5.664152353356324
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:GUKS4WUs2PH2oQIZEi6e7P51JLpkAWq63i7QGRx19PHqQqhWPhr3DLhGujdKU1K9:G/c0V4DIj9PHqQqhurDGldQNv0ht
                                                                                                                                                                                                                                      MD5:774856AED23D19ECF2701623C985030F
                                                                                                                                                                                                                                      SHA1:466A64208332040F199BCA40B58E6C412F27D1A1
                                                                                                                                                                                                                                      SHA-256:086AA5E8765DFB83546013F9CD7D1CDA9BD06A5CB76E93A5BCA637E3CE6F6813
                                                                                                                                                                                                                                      SHA-512:73AB0A13A91B4E1E7FF2A270DC2E5228FF98B0B3234816446C909A515A2CAC37570574181F09745F3F02E13DEE10BADC59C2D4FBCDFB1DE557F0ABE58F1BC8DE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4...4.......7...).......'...>...=...4...7.......7.......%...4.......>...$...>.......4.......7...)...........>...G....SetOption.tostring. - count: .info.log.core.GetOption.settings.tonumber.........$4...7.......7...%.......$...>...7...7.......'.......T...Q...........T...4...7.......7...%.......%.......%...7...$...>...3...:...:...7...:...H.......day., day: ., month: /Secure search hit add_month result, year: .month.year-Secure search hit add_month, num_month: .info.log.core..........!4...7.......7...%...>...4...7.......>...4...7.......>...4...7...........>...4...7.......7...%.......%.......%.......$...>.......H...., difference:., target_time: /Secure search hit days_until, start_time: .difftime.time.os!Secure search hit days_until.info.log.core...........~4...4.......7...)...%...'...>...=...4...7.......7...%...>.......T.f.4...7...%.......>...+.......'...>...+.......'...>...4...7...+...........>...=...4...7...+...........>...=...4...7.......7...%...>...4...7...>...4...7.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\securesearchtoast.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2805
                                                                                                                                                                                                                                      Entropy (8bit):5.683492139368564
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:o2zasKNnl1C71ZKCT3RHDPS0+7RhPzM2qUXfR2WkKDcvL/54mT/:VsnC/5JDbsM8JUScvLKmz
                                                                                                                                                                                                                                      MD5:F1E0947079914BB979FAF076F6E194A5
                                                                                                                                                                                                                                      SHA1:F652C986D24424A8BFC3688659B19BEE20DF1275
                                                                                                                                                                                                                                      SHA-256:F27CB060398801A7AED1C51F4A292F9E475C5A850968850717ECF5CC307DFA87
                                                                                                                                                                                                                                      SHA-512:3057B36E93F24C19B55E3D2CB0B84AF5A7986B1FE1EF763C08B7F2A58EE82AC3886537DA5A7AC4505CDCFD051699822CB4A6D641AF8B2155D340C10428367891
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ........<...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7.......T...7...5...T...%...5...7.......T...7.......T...7...5...T...%...5...7.......T...4.......7...)...+...7...$...7...>...T...7.......T...7.......T...7.......T...4.......7...)...+...7...$...%...>...:...4...7...>...+...7.......7...%...4.......>...$...>...4.......7...)...%...)...>.......T.D.4.......7...)...%...'...>...'...%.......T.#.4...7...........>...4.......7...)...%. .'...>...+...7.......7...%.!.4.......>...%.".4.......>...$...>.......T...+...7.......7...%.#.>...%.$.4.......T...%.%.....$...5...T...4...%.&.%.%.....$...5...+...7.......7...%.'.4...$...>...%...7.......T...4.......7...)...%.(.'...>.......T.!.4...7.......>...'.......T...4.......>.......4.......7...)...%.(.'...>...T...4.......7...)...%.(.....>...4.......7...)...%...'...>...3.).7...:...7...:...7...:...7...:...4...:...:.*.4...:...+...7.+.....>...+...7.,.>...7.-.....>...+

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\sendimmediately.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                                      Entropy (8bit):5.357971409953405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:5RG2ARJIU3vLFChK54wjGlbL5sug8JAbyKegnPSMZVwbubzAxERSMMVmhn:UJIu54YGlbL535JJKevMrZcCS1Mhn
                                                                                                                                                                                                                                      MD5:EC29F05BEC55FC8F0109015E8F33B1B9
                                                                                                                                                                                                                                      SHA1:67B1BF4AC1ACA98E5B8335BCAE9E262A7FF41E58
                                                                                                                                                                                                                                      SHA-256:5A5C0AE1993CDB169BE2B903EA365FF2A81D56394FF830563D27AADD4F9F0A1E
                                                                                                                                                                                                                                      SHA-512:77D4DDF8A72FFCF191A8E8974E0C6AAFBB661053252B4B3DF8BCEE11AF16D4BEBA92E62719C74B6430F8384622DD451D23B48457848CFF510418CD2A7BF56A17
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........+...7...@......transmit_telemetry_event\.......4...7...................>...1...:...0...H.....handle_telemetry_event.new.EventHandlern.......4...%...>...2...5...4...1...:...4...0...H.....new.SendImmediately"telemetry.events.EventHandler.require...//33E5668C5893EB623D97103CB0001D189EF9ED399EED739EA7CA92FBB9D26A0535B73D123D5A5FBFBA725BA35A8CF2BD92B954680DF147FD9C997BEA04EEEB0C++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\smareputationcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2718
                                                                                                                                                                                                                                      Entropy (8bit):5.824799027727529
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:469kkIlqX6Am/cnZ93tDTHKNabXmUr4kgn5bwACFrrUzlu7vkr061kdii2Bcaiuj:vIwxTZDmUr4BbIrQUbI0G7Xj
                                                                                                                                                                                                                                      MD5:16D635BF7C50C58F64829A49249B324A
                                                                                                                                                                                                                                      SHA1:8EF7738AFDC50B9A899A8B8889B1368D4F0F2893
                                                                                                                                                                                                                                      SHA-256:0A7356A3571F7FB62CB11ECF95586DE5B64DB6E61B898E9349A2D7CFD8CAAC03
                                                                                                                                                                                                                                      SHA-512:05747E2C8AB7E5E67091F170E8D36657971D7F8CEB3082285FC3CB7E4A9E482A1DB9B4DEC0E1F1DBD6099E252876C20C4D58EE82437D1CA47A768CA36E90379D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........g+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...7.......T...)...7.......T...4...7...>.......4...7.......%.......%...7...%...7...$...>...4.......7...............>...7.......4.......7...............>...)...H......SetOption.GetOption.settings._.lower.string.tonumber.default_no_value.in_context.prefixMOEM SMA Reputation counter handler called with an invalid configuration..default.SMAReputationCounter.get_telemetry_config]OEM SMA Reputation Counter handler telemetry event called with an invalid configuration..err.count.color.site.browser.get_telemetry_event;Entering SMA Reputation Counter Handle Telemetry Event.info.m_logger.... .*...+...7.......7...%...>...+...7...>...)...)...'...)...%...2...%...;...%...;...%...;...2...%...;...2...3...;...3...;...3...;...3...;...3...;.......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wabadgenotificationcounter.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2453
                                                                                                                                                                                                                                      Entropy (8bit):5.789207937522634
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:S64SQpie56rnaOx2UIpF4RwKWqloi2dNqkzpLDwE:YSS+aOx2UIp9ePa5r
                                                                                                                                                                                                                                      MD5:36244CA66AE568D6D1C3C4956234D791
                                                                                                                                                                                                                                      SHA1:CC7EEB744FF8A34253E4E263A00033BB8103F5EB
                                                                                                                                                                                                                                      SHA-256:CB0CCA7CE09A469E7753464E1AF7D278C0000C98AF7DC1D2DC0F085E50E95F78
                                                                                                                                                                                                                                      SHA-512:FB3D59A6C535F3AA79219AB75E1307FF76CAD5B39167EFDA060E4DF3CD364FF3F6E53985C8AE71D81AAB0BABCFC5AD6CC0D111C9A74534D8EC5027B40D388CDD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........j+...7.......7...%...>...+...7...>.......T...7.......T...7.......T...7.......T...7.......T...+...7.......T...+...7.......7...%...>...)...H...+...7...>...)...'...%.......T...+...7.......T...+...7.......7...%...>...)...H...7.......T...7...7.......T...7.......T...)...7.......T...4...7...>.......4...7.......%...7...%...7...$...>...4.......7...............>...4...7.......4...7...>...=.......4.......7...............>...)...H......SetOption.max.math.GetOption.settings._.lower.string.tonumber.default_no_value.in_context.prefixROEM WABadgeNotification counter handler called with an invalid configuration..WABadgeNotificationCounter.get_telemetry_configbOEM WABadgeNotification Counter handler telemetry event called with an invalid configuration..err.count.feature.browser.name.get_telemetry_event@Entering WABadgeNotification Counter Handle Telemetry Event.info.m_logger...... ...+...7.......7...%...>...+...7...>...)...)...'...)...%...3...3.......T...+...7.......T...+...7.......7...%...

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wssanalytics.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):734
                                                                                                                                                                                                                                      Entropy (8bit):5.5165794082773285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:cujOctSOElnx6OUTbW0oHQp3AnupBlyzRu+nGpIjHUVEbf0qqtGlbLB35JJKguPn:cujltHE5tFQFAnup/Z+nPU2bfGQB3Ug8
                                                                                                                                                                                                                                      MD5:6C767C5ED56782F3D2223F31D129B135
                                                                                                                                                                                                                                      SHA1:341952214A5FC4F01B1DB8D0B3ADE041569750E7
                                                                                                                                                                                                                                      SHA-256:28989709E122D4DF09E0527A5947D4A58BF59E55E59B4AB78CF637CA901C5D0D
                                                                                                                                                                                                                                      SHA-512:75B347B3E6CFBA8BEAD3678E0FDFC93BDF8F3E372AE5799279A83D2D85E23BFF6B4B7B18268AEA96BDACD40B9FFE7373C1213A0EDBB2AB645154BF2F6DF555CE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........#+...7...>...,...+.......T...+...7.......7...%...>...)...H...+...+...7...6.......T...+...7.......7...%...>...)...H...4.......7...+...7...@..........PublishMessage.wssEventSender>Invalid message passed to WSS Analytics telemetry handler.messageGEmpty telemetry information returned when processing WSS Analytics.err.m_logger.get_telemetry_event.........4...7...................>...3...1...:...0...H.....handle_telemetry_event....msad.files.safe..msad.sites.safe..new.EventHandlerk.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSAnalytics"telemetry.events.EventHandler.require...//D011A54B8B4F5B398B76F7DDEF9203DAF3C3938069B4B57EAE7C38CA682ED9878956CB20C7512C977900D4CD338C83C7B508F48CC3D28C5E4EB751A92BFD55BA++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\handlers\wssanalyticsraw.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):582
                                                                                                                                                                                                                                      Entropy (8bit):5.547275635912966
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:SujOctSOcFH6WfEFzMclyzRu+nGpIjHIu54YGlbLOL5JJK5Il/pFYq3:SujltHcJczMAZ+nP55XQOLU5ItJ
                                                                                                                                                                                                                                      MD5:13002EB6632400808ED857748AFFDE65
                                                                                                                                                                                                                                      SHA1:BEBD41B4FE64FA859C96B9225E3CF921975884E8
                                                                                                                                                                                                                                      SHA-256:99EF85F2CC04C6FEC29BA8E0B655AF8E3658B7FBA5C3744603E3B6DE7E0A9BFA
                                                                                                                                                                                                                                      SHA-512:4D0CCDDBBA7E8BF9BAA9BA179CB29BE8DFE9AA11DB41AB9A81854142A85E1CF0D5D5AB9056F7D03C8838AFB41D981C05258BA53EF2117D3C34AB77906C9F2ACF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........+...7...>...,...+.......T...+...7.......7...%...>...)...H...4.......7...+...7...@........message.PublishMessageRaw.wssEventSenderGEmpty telemetry information returned when processing WSS Analytics.err.m_logger.get_telemetry_event\.......4...7...................>...1...:...0...H.....handle_telemetry_event.new.EventHandlern.......4...%...>...2...5...4...1...:...4...0...H.....new.WSSAnalyticsRaw"telemetry.events.EventHandler.require...//42A692BDDEB4DF023E30C7145CA43A9BDEC29C309C8A447457D46863669FB4B09C742AD5CE7668C674008E2308B0D4CA1F06F6CFDA37BB223E3C82851B361012++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\sendonping.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):384
                                                                                                                                                                                                                                      Entropy (8bit):5.430404609474277
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:5pgW3AoBU3vLFIfK0HL1ZGlbLzucjg8JAbyKDLq3oB1Gmvizg:5x3igLzGlbLzFj5JJKDqoVvizg
                                                                                                                                                                                                                                      MD5:72CFEF01361293D72B0721CE00967EC5
                                                                                                                                                                                                                                      SHA1:C2A020EC71E31A3C1CC08A2139EEBFDA0C08DD3B
                                                                                                                                                                                                                                      SHA-256:330A2FEF38C723F0A165E1B5A99A65CCC299E9503D0CEDE2D0D442BEE2F39315
                                                                                                                                                                                                                                      SHA-512:43E87CC5E4BF4E4CCF6EEAFD8F55FC3939475BE022D2CE4343A0AC44E19B6DABA622EFEBD3932424D89465E80CE3566665E221F5054633E0C33E14F319956FE4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..6.......4...%...@...!send_on_ping not implemented.errorR.......4...7...................>...1...:...0...H.....send_on_ping.new.EventHandleri.......4...%...>...2...5...4...1...:...4...0...H.....new.SendOnPing"telemetry.events.EventHandler.require...//368D17490374E2AA49AA361B33804A6933614417D941C519A31763D2C27382736142648E98BC5C08CC5DCEDB8E24B78A4F2FF7A6CE9DD22808AAA571A65EB95F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\telemetryconfig.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26571
                                                                                                                                                                                                                                      Entropy (8bit):5.543313327670376
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:n8WI2W2taBMZSpPKPjBRPRNSV2ioUYgiXxQqt:nnIwa6ZWcPR1iofXvt
                                                                                                                                                                                                                                      MD5:164A5D2E3AA0E30E763FB4BDB3DA33C6
                                                                                                                                                                                                                                      SHA1:07FCD38BB87E77DD1F95897163724DF4406372D4
                                                                                                                                                                                                                                      SHA-256:435465B9E74C3B2E4A9DA1449B9E88C445785CD882D9A11AFD009FF57FFBFABE
                                                                                                                                                                                                                                      SHA-512:452800D089F81A8B774CA55B6E66B720046172691A357A4530620E09E32B3D22F58CEE840BC456E25C3AA95C2264CCD70922F5F0535E08CCFAFBFFF28893C095
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..............3.(.3...3...3...:...3...3...3...:...3...:...3...:...3...:...3...:...:...:...2...3...;...:...:...3...3...:...3...3...3...:...3...:...3...:...3...:...3...:...:...:...2...3...;...:...:...3.!.3. .:...3.%.3.#.3.".:...3.$.:...:...:...2...3.&.;...:...:.'.3.).3.(.:...:.*.3.,.3.+.:...3.0.3...3.-.:...3./.:...:...:...2...3.1.;...:...:.2.3.4.3.3.:...2...3.5.;...:...:.6.3.8.3.7.:...3.>.3.:.3.9.:...3.;.:...3.<.:...3.=.:...:...:...2...3.?.;...:...:.@.3.B.3.A.:...2...3.C.;...:...:.D.3.F.3.E.:...3.L.3.H.3.G.:...3.I.:...3.J.:...3.K.:...:...:...2...3.M.;...:...:.N.3.P.3.O.:...2...3.Q.;...:...:.R.3.T.3.S.:...2...3.U.;...:...:.V.3.X.3.W.:...3._.3.Z.3.Y.:...3.[.:...3.\.:...3.].:...3.^.:...:...:...2...3.`.;...:...:.a.3.c.3.b.:...3.h.3.e.3.d.:...3.f.:...3.g.:...:...:...2...3.i.;...:...:.j.3.l.3.k.:...2...3.m.;...:...:.n.3.p.3.o.:...2...3.q.;...:...:.r.3.t.3.s.:...2...3.u.;...:...:.v.3.x.3.w.:...3.y.:.z.2...3.{.2...:.|.;...:.}.2...3.~.;...:...:...3...3...:...3...:.z.2...3...2...:.|.;...3...2..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\telemetryhandler.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2298
                                                                                                                                                                                                                                      Entropy (8bit):5.6492997529822375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:bGqjTnzJcvdtXQt1J2LYIlteIXwBf++wlFGAxBgKfMvjmRrSurJDrfih:XjBeTaT2LJRQcNxI45tmh
                                                                                                                                                                                                                                      MD5:72A5327B6FC2C0B367F68F681443F788
                                                                                                                                                                                                                                      SHA1:92C4FFD8E9480DE9372756D7676C27B0DCC2257F
                                                                                                                                                                                                                                      SHA-256:E952F0ABCA2B3098D176AE04FBF8DE1524A80B0B4DAA854E0AE4004E3E943906
                                                                                                                                                                                                                                      SHA-512:5A8D76AA8F137E185DD375EF653DC713D48600ABC9B757F978AA9DCB017644913E90802465B13113E683B57C18695C80ED7D7B0E49616CD0F18824154DE404E7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........64...7...6.......T...6...H.......7...%...>.......T.......7...%...>.......T...%.......$...4.......7.......%...>.......T.......T...)...9...H...4...7...'...>...%...4.......>...$...4.......7...'...7...7.......>...)...H....currentline.short_src.Log.utility.tostring%Failed to load package. Error: .getinfo.debug..include.external.mfw..^core%..^mfw%..find.loaded.package......%...4...7.......T...4.......T...4.......T...4.......T...4.......T...4...7...'...>...%...4.......7...'...7...7.......>...'...H.......T.......T...4...7.......7...%...>...'...H...4...7.......7...%.......$...>...4...7.......'...)...>.......T...4...7.......7...%.......%.......$...>...'...H.......T...7.......T...4...7.......7...%...>...'...H...4...7...7...6.......T...4...7.......7...%...7...$...>...'...H...7.......T...4...7.......7...%...7...$...>...'...H...4...%...7...$...>.......T...4...7.......7...%...7...%...7...$...>...'...H...4...7...4...7...4.......>...7. .....T...7. .7.!.....T...7.".7. .>...7...4...7.......

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_aws.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1852
                                                                                                                                                                                                                                      Entropy (8bit):5.737462174969363
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:6hYF6aMl6+UeyPnUgCSOpLhB8uhSZoIPxqiqq6x3rAxQcNa1kJanu4f:62FJMlZEfMFNhucSZ7xqvqUAQcN49j
                                                                                                                                                                                                                                      MD5:14D1CDEE08CC446176C243CB8576F81C
                                                                                                                                                                                                                                      SHA1:2419BD53EDCA003D1F47F07A4901511C287EEAC7
                                                                                                                                                                                                                                      SHA-256:669C0ACADF3EF6935F982DB7AD75A5F345A04F6A3450F1ECCFD617BA4BCAA240
                                                                                                                                                                                                                                      SHA-512:A2D568CDC76C4548E8D2FD82032C7B1810D081D73F61CC9D6C262D803A4BFFDC121470DCBE195FA0708FDC5828D628E2EE313E8B4160827FAEEE2B2C8A73F1A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..O.......)...4.......7...)...%...)...>.......H....*AWS_QA_Mode.GetOption.settings.........+...7...>.......T...+...7.......7...%...+...$...>...+...H...+...7.......7...%...+...$...>...+...H.........9Entered Transmit_AWS get_header_value and headers = <Entered Transmit_AWS get_header_value and QA headers = .info.m_logger.is_qa_mode......../+...7.......7...%...>...+...7...>.......T...+...7...>...+...7...>...+...7.......7...........+...%...%.......$...>...4.......7...........+...%...%.......>...T...+...7.......7...%...>...G.......=Transmission to AWS disabled by setting *TransmitAWSNew..TransmitTelemetryEvent.sender.web.PUT.get_endpoint_value.get_header_value should_transmit_to_endpoint.Entered Transmit_AWS transmit_to_endpoint.info.m_logger<.......+...7...>.......T...+...H...+...H..........is_qa_mode........+...H.....[.......4.......7...)...%...)...>.......T...)...H....transmit_aws_enabled.GetOption.settings........&4...7.......>...4...7.......>...7.......7...%...>...%...%...%...%...%.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_azure.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2110
                                                                                                                                                                                                                                      Entropy (8bit):5.786678555677259
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:G6BZRv6zYByYuRzfZvdSRgC2LhQgd6zJxGo6xFbSSFNanuq0HO:G6BXKY6tLhZdKJsoU5SSF+50HO
                                                                                                                                                                                                                                      MD5:50FF30739FA626C8A11D32D6AD88B6C9
                                                                                                                                                                                                                                      SHA1:7D08378873D1A4FC316AFB9579680F2B9FA910EE
                                                                                                                                                                                                                                      SHA-256:94890AA7C8D47DD29069A1D650B541A41BA4AB8923A5C785B9343662BF639680
                                                                                                                                                                                                                                      SHA-512:7EA95E919A4B6B4DE76E209568B6ABF89356354AED8CFCA7BB88B6264800A5D5C4E65C82E2538939E11AB7EBA6E607E74CA35BDDDD6CF4D38725FF758571A07E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........N+...7.......7...%...>...+...7...+...>...4...7...4...7...%...>...=...(.......+...7.......7...%.......$...>.......%.......$.......4...7...+...>...4...7.......>...4.......7...+...............>.......T...+...7.......7...%...>...%...+...7.......7...%.......$...>...%.......%...+...7.......>...%.......%...+...$...H..............&skn=.&se=.&sig=.SharedAccessSignature sr=.hash: .default_hash_will_not_work7HMAC Sha256 function did not return the right hash.err.HMACSha256.utility.len.string...ttl: .!*t.date.time.os.encode_uri4Entered create shared access token in lua azure.info.m_logger..I.........+...7.......7...%...>...+...7...>...%.......%...+...%...$...+...7.......7...%.......$...>...H........headers: ..servicebus.windows.net...Host: QContent-Type: application/atom+xml;type=entry;charset=utf-8..Authorization: .createSharedAccessToken*Entered get header value in lua azure.info.m_logger........,+...7.......7...%...>...+...7...>.......T...+...7...>...+...7.......7.......+...+...%..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmit_ga.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):582
                                                                                                                                                                                                                                      Entropy (8bit):5.553638324669049
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:POvlVSpiCiu7lXyws+ksvk0//GnkxiRM5DKCYGlbLJCqu67jKl1mq2IGZrrX2zTl:2v/SpiCiulxGkxxbYQJCf6KlQtI+PXk5
                                                                                                                                                                                                                                      MD5:85EF745C934578F960B79327D4468916
                                                                                                                                                                                                                                      SHA1:89562A7B12AFE593DCD2A2661B0BBB7BDBC1C7E3
                                                                                                                                                                                                                                      SHA-256:31E9394615C4C169D887FBD6A1E478B2033B733DF93F4718ED1134BD865D37CF
                                                                                                                                                                                                                                      SHA-512:C3C45B7F2B98FDC0ED42F1EC35725BDD7CB0E8D5A2D3835E02F219F7C0630A1639FD22D3CB3C0F7DCB9D939AC37084DC53DE6F3B5ECD8F4E6BBF302443FFD15A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7.......%...%...%...%...%...>...G.....web.POST./collect!https://google-analytics.com.TransmitTelemetryEvent.sender,.......%...H...!https://google-analytics.com........%...H.............4...7.......>...1...:...1...:...1...:...0...H.....get_header_value..get_endpoint_value..transmit_to_endpoint.new.EventTransmittern.......4...%...>...2...5...4...1...:...4...0...H.....new.Transmit_GA&telemetry.events.EventTransmitter.require...//536519D8CE0668D05BE48FFB230757F8B3FDDF0A09BE2D9BB27B9D0F9422A90EC6ACCC3EB90FDA61B8924741D75769915AEF520463126F435B25A6631378112D++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_aws.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):883
                                                                                                                                                                                                                                      Entropy (8bit):5.69181026562203
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:dsZmZidvHOpLh2uea1qRmhuh1rAZnz8QtLYW2b7Xy9X:dy7BHOpLhzHUUhuh1cZz8KL0XyN
                                                                                                                                                                                                                                      MD5:9C17EBD84CC411C20DC1951D7C57DC00
                                                                                                                                                                                                                                      SHA1:4AD0E616EB8F7A53550B176DE6E36DB60BF1572C
                                                                                                                                                                                                                                      SHA-256:22EB8A7D957E783644F134A868F185AAA7CD90F5792C02DA707498793181E3E6
                                                                                                                                                                                                                                      SHA-512:EAD3AD97D842CC2206469EF06822D740608EC2B0F59ED07E1D1DCA6C5D3B25A97B6531553AF7E67D4529496614140433798BA1F234EBB3CB8B51D8E934CBA714
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........6+...7.......7...%...>...+...7...>.......T.$.+...7...>...+...7...>...+...7...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7...............%...%...............>...T...+...7.......7...%...>...G.....=Transmission to AWS disabled by setting *TransmitAWSNew..web.PUT"TransmitTelemetryEventTimeout.sender.AWS_Telemetry_Flags.AWS_Telemetry_Timeout.GetOption.settings.get_resource_value.get_endpoint_value.get_header_value should_transmit_to_endpoint5Entered TransmitTimeout_AWS transmit_to_endpoint.info.m_loggerN.......4...7.......>...1...:...0...H.....transmit_to_endpoint.new.Transmit_AWS........4...%...>...2...5...4...1...:...4...0...H.....new.TransmitTimeout_AWS/telemetry.events.transmitters.Transmit_AWS.require...//FAED516BE8214F92D49704F4F93BA1B108FCD0471F8D6B3C8F6582FFB10F1D9BBF74DF896B5611F45728B520C4731C1DDBCF174CB3FCA9E6755BDCA6DEF7FBC4++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_azure.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):855
                                                                                                                                                                                                                                      Entropy (8bit):5.742342101058968
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:vpz8nblYe2LhXVLhueOgR87FGziuZ3/QjLYF7wR6iwHDSd:vpzwZ/2LhXVLsLgoFyjPwLOER6iwH2
                                                                                                                                                                                                                                      MD5:4C97DA14A1B40F757DA6EC4A83EF27E3
                                                                                                                                                                                                                                      SHA1:15D64CF59982CE6C4161A23AE0922E3D58CBDBAE
                                                                                                                                                                                                                                      SHA-256:F7D70035275AB8DF19FA6EDF03C6B897A3106DD323E9A672CC97C7F1A446D723
                                                                                                                                                                                                                                      SHA-512:0A00FD88BE9F1228069289A7397F6D6B10356925194B479D985A5246C2C5158D99EBE553F3584E7020DAB082A941317B371B3A3507DC8308580111B543BAD0C3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........*+...7...>.......T...+...7...>...4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7.......+...+...%...%...............>...T...+...7.......7...%...>...G........./Transmission to Azure disabled by setting..info.m_logger.web.POST"TransmitTelemetryEventTimeout.sender.Azure_Telemetry_Flags.Azure_Telemetry_Timeout.GetOption.settings.get_header_value should_transmit_to_endpoint.........4...7.......>...%...%...1...:...0...H.....transmit_to_endpoint7/wadp32h01/messages?timeout=60&api-version=2014-011https://cu1pehnswad01.servicebus.windows.net.new.Transmit_Azure.........4...%...>...2...5...4...1...:...4...0...H.....new.TransmitTimeout_Azure1telemetry.events.transmitters.Transmit_Azure.require...//057DF80EE2CEB7489D00D53451288C85AAE17228FF5EFE53CCA49ED44381485F3A8CFEC0F3A420275972D6BDF25C7A859DFA6EA8F1610C5B3B7B5FF3F3C32D7F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\transmitters\transmittimeout_ga.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):605
                                                                                                                                                                                                                                      Entropy (8bit):5.664722359546257
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:HUboCyiCsydSpiCDuQLqk3Rf3svkw7WM5xXC3GlbLNOPLYjKJN7nRu3AdBPF/aDP:HUbdxCvdSpiCDueqk3RGzxXC3QmLY2f8
                                                                                                                                                                                                                                      MD5:63CFEA198EAC94E7025AA60D9E91A22F
                                                                                                                                                                                                                                      SHA1:D81109AF78866349EA9AD27A328FBF0609F60020
                                                                                                                                                                                                                                      SHA-256:FE1A2933C425A227B1F5557C532B958372CDC77B3ECBE438EE067A6CDB891053
                                                                                                                                                                                                                                      SHA-512:B50F329014DC542D4A1BA12443482AD2623D2E4136DA1675E7F17814BE684185901A4B84707DB78E2C6CF34AF9DF94409029239E64908591F015FC773D1A3C12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ...........4.......7...)...%...'...>...4.......7...)...%...'...>...4.......7.......%...%...%...%...%...........>...G.....web.POST./collect!https://google-analytics.com"TransmitTelemetryEventTimeout.sender.GA_Telemetry_Flags.GA_Telemetry_Timeout.GetOption.settingsM.......4...7.......>...1...:...0...H.....transmit_to_endpoint.new.Transmit_GA}.......4...%...>...2...5...4...1...:...4...0...H.....new.TransmitTimeout_GA.telemetry.events.transmitters.Transmit_GA.require...//349C760E0BD570F93FFEEA516283F12599B8A20A351BAED97F8C89F9BBD30BAF2ED0934FC884B05DAC2A41460BBB16F8A960324716ECEED0CF63857F8019051F++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\events\version.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):235
                                                                                                                                                                                                                                      Entropy (8bit):5.173671816469483
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:8k4kikwIWmLQJX8n+OgUvoSTFQjujVHQ7Qjbbl/4:90kRLQJXcbvoSijuhqQ5w
                                                                                                                                                                                                                                      MD5:67BBE71D7C1B0CDAA22E689758ADA64B
                                                                                                                                                                                                                                      SHA1:B5EFC32DB7398A05EBE2D9E062454EB00FC8ACF5
                                                                                                                                                                                                                                      SHA-256:926FE5D79BC498B623C87E3D5F4989CE726698EFF8A706E65351EA5442640FE9
                                                                                                                                                                                                                                      SHA-512:3ECCA1E220252CB1CA1CF0337A9BD541206BE151C0B7E10205E87ED5BD1474655D59B893331E9F635E748430DC6B650D002F2ECFD216002AB706C32FC5F772B3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:--$FileVersion=[VERSION_MAJOR].[VERSION_MINOR].[SUBMINORVERSION].[BUILD_NUMBER]..return "4.1.1.846"....//E16BC5938C2160FE162C55C774B33337F1D9F10E3CD6B1AEA2BE03D0A361E63081CE526280574E22DAD6446B41C24CF92D3D6DB62BCAD2439E623BDFF289E2E6++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\download_scan_ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1024
                                                                                                                                                                                                                                      Entropy (8bit):5.050584509752817
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:4cZZCLtlDbUM6OUdREsAAZZSmQcMIc+PcM6icd7FZ/vwVGok7emp:pCtlDbUiUPEsA4Fg+UfFn/vuGok7Zp
                                                                                                                                                                                                                                      MD5:A719B421E6E9B381E963315E9425CE7D
                                                                                                                                                                                                                                      SHA1:C5CACA8BB8AD464420374A840A8A5530FEAFD121
                                                                                                                                                                                                                                      SHA-256:A6C547D05930CE36161297C6D65791942A827EC88B4F606C3D133670F64B123D
                                                                                                                                                                                                                                      SHA-512:7BFBAC20B97EC2C910C0E482C155A28268C796105DABB759CFDE5D1C9677C41CAFD3F19A7BF982A1C1976163E7C1BCCD7CE26E6CD2ECA8693CFB299F4E7088DA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var Download_Scan_UI = function(){.. this.elements = {};.. this.elements["name"] = "DownloadScanUI";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["count"] = "0";.. this.elements["_event_name"] = "Download_Scan_UI";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.count = function(val).. {.. this.elements["count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//60E0E5895DF2802F436E49868938ED067BF6EDC43A093723FD02D75E6C61779371403E057ED26BE90FAE559803C0E43265CB3CCAB4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgeonboarding.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1003
                                                                                                                                                                                                                                      Entropy (8bit):5.026543638333003
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:hwaLteVUM6QcTQMs/mQc9cwPcM6oaccJFZROl3UVHjxRP:3teVUk4sKuwUsDgnsOjxRP
                                                                                                                                                                                                                                      MD5:97306CAC82A9CC580D3154376D7BB438
                                                                                                                                                                                                                                      SHA1:F175A1920B0C570C25FF45BA1DD827E91B1BE8E2
                                                                                                                                                                                                                                      SHA-256:8357A4D6203FF8E15994914C1954814BDCB1BB71280C13B6DFA3899C54BAD403
                                                                                                                                                                                                                                      SHA-512:8356B9AEC30E764B933983352579CABC290FA446CF84204930AC6DBA20780C57D7A6E1B742315D74025BF01C3F6AEF5591FEB257EE06330AA0502A3E6D52EA95
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var EdgeOnboarding = function(){.. this.elements = {};.. this.elements["name"] = "EdgeOnboarding";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "ed";.. this.elements["type"] = "default";.. this.elements["_event_name"] = "EdgeOnboarding";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.type = function(val).. {.. this.elements["type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//1A1265D942AFFF00704DDA23CCD46D476D4B6B628D1CD7407ADDBF10D16FB8D941B29A5233F9E97144E07D64122380BA7E08C79FD543D682860F6F34CA1D5BB

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgeonboarding.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):686
                                                                                                                                                                                                                                      Entropy (8bit):5.374973400706401
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1I9F4kIrfzuwbkENLqau02e+vo5foIQub8o+2r4kGlbL/7tKFPUQAtlzWWE0Kydb:k4kujtNLqvJvEfoND2LQclMtl6WMydb
                                                                                                                                                                                                                                      MD5:BED192B6B087449AFC9ECCA843A22BB2
                                                                                                                                                                                                                                      SHA1:90DDC300B5CEC8FFD0C4033CD9527B2B64E36DBF
                                                                                                                                                                                                                                      SHA-256:C67859D9CA4283538E406C521D619AB3B6F953CACB8F3600476BD9B58F667045
                                                                                                                                                                                                                                      SHA-512:9720A66D7E496E3B20DE6A4A87A0422FB5ABF398FE61979B9A6A9AB8CE7BED7FC92E9ACEE8B03833774D610123D16770C5E43307CA209410D20C6700624FC361
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........,...+...H...............,...+...H...............,...+...H...............,...+...H................2...4...+...>...:...4...+...>...:...4...+...>...:...4...+...>...:...%...:...4...7.......7.......>...H............encode.json.core.EdgeOnboarding._event_name.type.browser.action_type.tostring.name.........2...%...%...%...%...1...:...1...:...1...:...1...:...1...:...0...H.....Serialize..type..browser..action_type..name.default.ed.UNKNOWN.EdgeOnboardingY.......4...%...>...2...5...4...1...:...4...0...H.....new.EdgeOnboarding.core.json.require...//871610505B9AA87B9F375018FB8DA4C024E9189AFC113AC217950D2665934875344709D214A3EF6C0F2C2A71DEBCBFA3009A045899E7DBD765ABAC71B7061664++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgesecuresearchonboarding.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1084
                                                                                                                                                                                                                                      Entropy (8bit):5.0614193441625455
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:hKLtQXQMM6QMUsZcucwPcM6XcaFZMI3FnBYa:GtQZkMUs6XwU4anMIH
                                                                                                                                                                                                                                      MD5:C6CEE776DD146BE4C545D70B7A2798C8
                                                                                                                                                                                                                                      SHA1:1E39C41EA0FD8CF69B4478984E91F72D1AFD5F8C
                                                                                                                                                                                                                                      SHA-256:81A6BD045F9B97EF5E3B9836C5ECB1DBCDE69F655239D8952029904664732C32
                                                                                                                                                                                                                                      SHA-512:28ACDF79A94CE25D15438E61A0ADF8B6ED584CB3C26EF4EA48083300995D5331A6291C683197216820A154BC678B2416C89BB783F62F345C7E2C1CAE92285C33
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var EdgeSecureSearchOnboarding = function(){.. this.elements = {};.. this.elements["category"] = "EdgeSecureSearchOnboarding";.. this.elements["action_type"] = "default";.. this.elements["browser"] = "ED";.. this.elements["impression_type"] = "UNKNOWN";.. this.elements["_event_name"] = "EdgeSecureSearchOnboarding";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.impression_type = function(val).. {.. this.elements["impression_type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//77C9D7BE55B7C68AE774E379DE35131A0CCAB075FD19D4

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\edgesecuresearchonboarding.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):752
                                                                                                                                                                                                                                      Entropy (8bit):5.454673440979267
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1I9F4kIrfzYbkENLqau842e+/OovtfoIQubGWoG5iF3fGlbLXa7tKKgJi5uylWCZ:k4kuEtNLq3IGMtfogB5WPQnK3uylXd
                                                                                                                                                                                                                                      MD5:5FD6F13643F89F7C3FAC58A1AF6BABB4
                                                                                                                                                                                                                                      SHA1:7D1CDC883C4031A57BCEDA700AFEE31EE9E05B96
                                                                                                                                                                                                                                      SHA-256:4FC8655C435DCB1779179AD10291721AAA5E029C16C1AFE2D017754271C25F4D
                                                                                                                                                                                                                                      SHA-512:8D411F87FB8316A87E8405D3F306B56C8591661307A324C49638E7CAA30BC03167A1EDFA38B054A3097EED39A52D779B510159758F2D1442C8515306E8636040
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........,...+...H...............,...+...H...............,...+...H...............,...+...H................2...4...+...>...:...4...+...>...:...4...+...>...:...4...+...>...:...%...:...4...7.......7.......>...H............encode.json.core.EdgeSecureSearchOnboarding._event_name.impression_type.browser.action_type.tostring.category.........2...%...%...%...%...1...:...1...:...1...:...1...:...1...:...0...H.....Serialize..impression_type..browser..action_type..category.UNKNOWN.ED.default.EdgeSecureSearchOnboardinge.......4...%...>...2...5...4...1...:...4...0...H.....new.EdgeSecureSearchOnboarding.core.json.require...//E52767A508E594AD98F30343FC901523DA959D9FD3A844A180CE2DD5A6325A06077D8247747825927722BB432CE7110ED892E6FF6CC4CBA2F7B04A5169DEC0BF++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\extensioninstallationtoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1068
                                                                                                                                                                                                                                      Entropy (8bit):5.052808573172875
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:L5hLt9DVUM6OUzvUsdwcucwPcM6iczfFZ9T5gA:L5Ft9DVUiU7UsdlXwUPLn9T+A
                                                                                                                                                                                                                                      MD5:0765409A8AD341D6CE72D8BE537666CF
                                                                                                                                                                                                                                      SHA1:513CAA974E35432DCDD60D475954784A1DF9CE7A
                                                                                                                                                                                                                                      SHA-256:B4014EF7ED67382F0286DA5C08CC0F9022774F58A38C81160423BA0BBFF2626E
                                                                                                                                                                                                                                      SHA-512:EB749597DB9CADD9930C81EB307DC34E15B9DE618426800827E62DE6EFA4112BB970F90333FFD1A41B2A04741F42CF4234072F8084C1E5E45A05254A88C1071F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var ExtensionInstallationToast = function(){.. this.elements = {};.. this.elements["category"] = "ExtensionInstallationToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["sequence"] = "UNKNOWN";.. this.elements["_event_name"] = "ExtensionInstallationToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.sequence = function(val).. {.. this.elements["sequence"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//E1D32ACC374EC29E5C991FD4475A334929DB54EEAC28C4751D415F8B6F39E7

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\fw_av_warning.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                                                                      Entropy (8bit):5.111728856148942
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:7WJwqwHwzyAdYETwM6RETwscWmQbwRo5AJbwzyAd1oBPbwM62ogFwfwdu/h8lZ:7LtQbUM6OUsDmQcMIc+PcM6cFZE/h4
                                                                                                                                                                                                                                      MD5:689B8A309AD16423F352A40C09351171
                                                                                                                                                                                                                                      SHA1:47AEC4849F3B73F784CE128E7B2B962D7F20531E
                                                                                                                                                                                                                                      SHA-256:8B4C5F4CAF3B7931E00FE82B80D16C7B3FDA5673AA0C560D2BC079437D3E238A
                                                                                                                                                                                                                                      SHA-512:5E3B75AA3412B93C6D8C10E74FBD07435B1D151A6E8F4CB73EF343D4A559744FCBCC6126C1D0549657FAB1EA239F3A7BEC8B31D0D8B00999EE8EF519A085A4E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var FW_AV_Warning = function(){.. this.elements = {};.. this.elements["name"] = "FWAVWarning";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "FW_AV_Warning";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//E4AA2ED61472348DBE6709F7820BE4969ACDD0237B9B19CA30DF3A3BC4DAD44442C31FE382094FE4FD11DC3BB01357643E6FB6CED13FCD5650BC7FE48900AB26++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\newtabextensionoffer.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                                                      Entropy (8bit):5.0671130834499625
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:RDhLtxVUM6OUDUs2cucwPcM6kcTFZ449xt+YnG9:/txVUiUDUsvXwUdTn4U2YnG9
                                                                                                                                                                                                                                      MD5:F929E7A7BB3C6C74BEF893EA9E6ED16A
                                                                                                                                                                                                                                      SHA1:70477A2B2FB18D4D189CF942DDAAAEA46F1CA95A
                                                                                                                                                                                                                                      SHA-256:1BC49F7323FAE1440BFAE351D8864C7C7FD5F838FDD397F04C478B6DE3B8A427
                                                                                                                                                                                                                                      SHA-512:91CBD722551B8B12ACA9A9197E9FFE601A28F8FD0F58D77293E905074F77C488962766FDB9D392E71E810164AEC8164292BE07FC05BE02485DA00058C0ED437C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var NewTabExtensionOffer = function(){.. this.elements = {};.. this.elements["category"] = "NewTabExtensionOffer";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["variation"] = "UNKNOWN";.. this.elements["_event_name"] = "NewTabExtensionOffer";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.variation = function(val).. {.. this.elements["variation"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//7205A5DA385D43C69C0E51E1F4AD09835C08774E22622DCA5EC744C9E663015E3B50083A07330

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\onboardingballoon.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1053
                                                                                                                                                                                                                                      Entropy (8bit):5.068098061360576
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:hfhLtEbUM6OUf1Us/mQcMIc+PcM6NTQcf9FZRSYR:XtEbUiUf1UsKg+Uxhf9nR9R
                                                                                                                                                                                                                                      MD5:3038E704D1DFCC8353F8A2F3F8ED7873
                                                                                                                                                                                                                                      SHA1:76DD82D492720E356F313F684458744C9CCBDE70
                                                                                                                                                                                                                                      SHA-256:71BB282EC8C4FDD004C4B26EB77EA80228151E7C3FEB9DD0D9E7388870E33B5C
                                                                                                                                                                                                                                      SHA-512:43D54EB3BA4CC3ED75E2F2F3F944DD735CF4D4D1860D629C1397189936730A3B36AE01CD437AE3AA25AAE587BCBC3E6BA1570A0A7A88A57A7B117E35EEF06726
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var OnboardingBalloon = function(){.. this.elements = {};.. this.elements["name"] = "OnboardingBalloon";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["balloonType"] = "UNKNOWN";.. this.elements["_event_name"] = "OnboardingBalloon";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.balloonType = function(val).. {.. this.elements["balloonType"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//611D7CDF646C39C27C2CBA370AC5B4B9C2D9C03D4CF7FDC16E1DD91489246A694AF08B1FAE3D0

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\optionsdialog.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):860
                                                                                                                                                                                                                                      Entropy (8bit):5.091802162139834
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:ROQWJwqwLlxojwY9QXDwM6RETwsRxo8DKrbwLuoSQbwY1oBPbwM62ogFwfwB8ewI:RvLt/K5M6OUs0cyQcTPcM6cFZYQPh
                                                                                                                                                                                                                                      MD5:0BE6090C4FD38470248C407DF155D86B
                                                                                                                                                                                                                                      SHA1:2C13BD71993474DD5D172C10639367086B446789
                                                                                                                                                                                                                                      SHA-256:534ED7EF0A1B01F36E86E8227D199C108B6C82C7305ACE5D13FEB833AFF7762A
                                                                                                                                                                                                                                      SHA-512:CEDE3F0E87C7837936E563AA26E64E9B453E820DE0A7F7E6D707D61B95F91D04FD881505864F3037C2B51AC0593B5A0067AC85B5916BC8C0D580CA31C79E6DDA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var OptionsDialog = function(){.. this.elements = {};.. this.elements["category"] = "OptionsDialog";.. this.elements["actionType"] = "Impression";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "OptionsDialog";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.actionType = function(val).. {.. this.elements["actionType"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//DD0278739A748F66589214D59E7F56CC0CDD2D0D7311A364ECF1C6840BEA19609194D495E92DD0D20D93B8133D51281E1E51D3E98BB402E045A483490D997C83++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\productupselltoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1701
                                                                                                                                                                                                                                      Entropy (8bit):4.913495880837677
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:WFt4VUiU7UtUqmUjrUsCXwUPwId1j7nZYZ:et4VUiU7UtUqmUjrU5X7PwId1jzZYZ
                                                                                                                                                                                                                                      MD5:EE600D44FDB644330CBAC5871E2DBB63
                                                                                                                                                                                                                                      SHA1:F77545445F5B4B98359C55B895C80BB8FF891243
                                                                                                                                                                                                                                      SHA-256:272107E518AA33DBDE034AB068D105C93ADC6983BE8F5A37DF32881812485838
                                                                                                                                                                                                                                      SHA-512:1A40D5B972B02A22CAD0DCD658055FDCC9FA0CB936BA4A4154A90956E730335A1DC120C6116EDFC796CCB87BF86AF04066211FDA5C2E0E4D887BD8BE914C914E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var ProductUpsellToast = function(){.. this.elements = {};.. this.elements["category"] = "ProductUpsellToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["sequence"] = "UNKNOWN";.. this.elements["product"] = "UNKNOWN";.. this.elements["variation"] = "UKNOWN";.. this.elements["trigger"] = "UNKNOWN";.. this.elements["url"] = "UNKNOWN";.. this.elements["_event_name"] = "ProductUpsellToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.sequence = function(val).. {.. this.elements["sequence"] = val.toString();.. return this;.. };.. this.product

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\protectionscore.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1033
                                                                                                                                                                                                                                      Entropy (8bit):4.96710548150026
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:eLtj9UM6hUcvjQMs4mQchcoPcM6jTccv5FZNjcrxa37:0tj9U64stSoUwgnNuxaL
                                                                                                                                                                                                                                      MD5:299BE8836225146243D6AA162E5A69ED
                                                                                                                                                                                                                                      SHA1:303F97977B2140EEE0464D38F2CDE374D30B79B1
                                                                                                                                                                                                                                      SHA-256:C9F96586E8721B848C7BEDF3864E5ED6B707CD86C1E3D6EDB28F7AAB17E02FC6
                                                                                                                                                                                                                                      SHA-512:ED51CF1F5453CD6F2D8E16A798D3D0D110474331DEC3CA92F96E8C3FFDE3F22B53B7CC6B42BEFDC96F4D24801C8458A25B16BA5826811BEC505A383BB2220B35
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var ProtectionScore = function(){.. this.elements = {};.. this.elements["name"] = "ProtectionScore";.. this.elements["event_action"] = "UNKNOWN";.. this.elements["browser"] = "ch";.. this.elements["toasts_count"] = "default";.. this.elements["_event_name"] = "ProtectionScore";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.event_action = function(val).. {.. this.elements["event_action"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.toasts_count = function(val).. {.. this.elements["toasts_count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//51E50DCDF14A65C19BB76E114BB029F79B1D6D040A8FE99C41FBE20297C17C8B985F3AA6F34A87B7E78AA3D7BA0BD953F

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\pscore.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):981
                                                                                                                                                                                                                                      Entropy (8bit):5.028917138411792
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:00LtQcM6jcQshmQc9cwPcM6oaccJFZx4k/6wXU:FtQcP/swuwUsDgnxDE
                                                                                                                                                                                                                                      MD5:A114B2C345B0B63A240DC99B518D567E
                                                                                                                                                                                                                                      SHA1:53FCDEB68C06B0FF66387D37339D6F862EAE9C98
                                                                                                                                                                                                                                      SHA-256:411F58F31AFA580BEC08CB20F82B04876F2394AEFFC0F2A175ED8D53468BE844
                                                                                                                                                                                                                                      SHA-512:0C066599EBE09427F94E67B8ECFBF473B1FE2855493B73A6E1A2CCB5F82A97F62C96FF30DF4495C1B71A60CEE6AC4716293E13661FF9D72EAAD230E6B954C5A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var PScore = function(){.. this.elements = {};.. this.elements["name"] = "PScore";.. this.elements["action_type"] = "UKNOWN";.. this.elements["browser"] = "UKNOWN";.. this.elements["type"] = "UKNOWN";.. this.elements["_event_name"] = "PScore";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.type = function(val).. {.. this.elements["type"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//26DB7EB01783CAA4C77510A33C58767738DB4625C8C32DDD8FC05C2E6B53F3FD37F5F7297117A1F9AE530033F2B8BABE2265785F6D99E96D155647A500AD7C91++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\secure_search_toast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1751
                                                                                                                                                                                                                                      Entropy (8bit):4.868212458153099
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:HFt9ZorU1Qi58eRls5XwUvgYmsQiAXX8O4niO7sT:lt9ZorU1N5PrAX7vgYmsNAHNaiH
                                                                                                                                                                                                                                      MD5:298D7707505C2190A8B79DD2B53FC2B2
                                                                                                                                                                                                                                      SHA1:E635B2DF123C2F458FFEFDA13E4C3EB4002EE16F
                                                                                                                                                                                                                                      SHA-256:928EFFF5B7DBA03975302F6598614B5DDCDC8CAE365DEB35FAF56814F54C196D
                                                                                                                                                                                                                                      SHA-512:6238FF305E60D9FB965E20025E0F1811248201BB89F31ED4A766B4F2D586F83C4862F2053D90B1E776C33050F595695EC0D046017DBBB11FF22B889A54AD0491
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var Secure_Search_Toast = function(){.. this.elements = {};.. this.elements["category"] = "SecureSearchToast";.. this.elements["action_type"] = "default";.. this.elements["browser"] = "default";.. this.elements["provider"] = "UNKNOWN";.. this.elements["toastType"] = "RegularToast";.. this.elements["metadata"] = "default";.. this.elements["response_time"] = "default";.. this.elements["toggle_count"] = "-1";.. this.elements["_event_name"] = "Secure_Search_Toast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.provider = function(val).. {.. this.elements["provider"] = val.toString();.. return this;.. };.

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\securesearchstatechange.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):714
                                                                                                                                                                                                                                      Entropy (8bit):5.318433537665562
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1I9F4kIrfzcbkENLqa+nAK+gUc6N+luPKQUXE5I3ZGlbLLGtz7tKc+SNxtfQlZ:k4kuwtNLqpAfPc6N+luPL5IpQGgc+YxK
                                                                                                                                                                                                                                      MD5:D65D70D31977856940AC9CE8BCE941B6
                                                                                                                                                                                                                                      SHA1:3D7575578483C600D8BCC73CD46DD71C84C8FA38
                                                                                                                                                                                                                                      SHA-256:B087B9C2B72D0BCDE233B93180AF9DEE294A2C433BCA98FD140931989C59A25E
                                                                                                                                                                                                                                      SHA-512:EF5962EB26A26D75E1A27F0E1D93D3C68276F2E6889BBEFCC19F777B3B1432525328E3409DA6AEFF0E345C5FC394E83F9B97B8278C74AC1AC2EBEBF45E03D613
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........,...+...H...............,...+...H...............,...+...H...............,...+...H................2...4...+...>...:...4...+...>...:...4...+...>...:...4...+...>...:...%...:...4...7.......7.......>...H............encode.json.core.SecureSearchStateChange._event_name.prevState.browser.newState.tostring.category.........2...%...%...%...%...1...:...1...:...1...:...1...:...1...:...0...H.....Serialize..prevState..browser..newState..category.UNKNOWN.SecureSearchStateChangeb.......4...%...>...2...5...4...1...:...4...0...H.....new.SecureSearchStateChange.core.json.require...//0E020A48C7874CCF1998FCCB37898F784E4CE6ED5E41BA9A50581EE0939F2873E58ECB0ED63E7804EF8C5BB354ADC7FF4381A4C6CB30409D3A1533C393298AF2++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\survey.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1690
                                                                                                                                                                                                                                      Entropy (8bit):4.892681272119856
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:ltgxDUQUWUVBUiUyJUiUs83NsxnudV7gyEUQnySpM0O:ltgxDUQUWUVBUiUgUiUf3NsxnudV7gU9
                                                                                                                                                                                                                                      MD5:34AD7E902A275E8DCD72EE6C85401BC5
                                                                                                                                                                                                                                      SHA1:54527B456B32F709EA81A189202E467F2E775A8F
                                                                                                                                                                                                                                      SHA-256:83054D8E3A5E88F9F4EC15D234B4E4D1427BB09B7A1AB321E542EEF0BF54EBFE
                                                                                                                                                                                                                                      SHA-512:78C60B08BEEB8A21C455F0C44437C725D329A3D018BB03ACA999AF4945E2FA3FDF90A5738CB45C2886C47C2A432CAAA1A8DF2B18B105EB3A99E6DC76EBEC151B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var Survey = function(){.. this.elements = {};.. this.elements["name"] = "Survey";.. this.elements["survey_type"] = "UNKNOWN";.. this.elements["selection"] = "UNKNOWN";.. this.elements["experience"] = "UNKNOWN";.. this.elements["showTimes"] = "UNKNOWN";.. this.elements["interaction"] = "UNKNOWN";.. this.elements["payload"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "Survey";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.survey_type = function(val).. {.. this.elements["survey_type"] = val.toString();.. return this;.. };.. this.selection = function(val).. {.. this.elements["selection"] = val.toString();.. return this;.. };.. this.experience = function(val).. {.. this.elements["experience"] = val.toString();.. return this;.. };.. this.showTimes = function(val).. {..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\survey_ui.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1355
                                                                                                                                                                                                                                      Entropy (8bit):4.927772775237035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:HYLtFiUM6OUxDUcPQMkQMsamQcM/cxPcM6qNXcxeccLQLrcKFZEpYW8hOb:GtFiUiUxDUSGsTLxUONsxnW5KnYGOb
                                                                                                                                                                                                                                      MD5:EC9DDE608D438E75F11F9ECD478842D2
                                                                                                                                                                                                                                      SHA1:A853CD2077E74AEE6516EF6D9C3A0F91F86D64DF
                                                                                                                                                                                                                                      SHA-256:F038EAAED0CA6208E4FB445EDAAC69BE68EA0657433B1A4C9BD1F4CA34AF816D
                                                                                                                                                                                                                                      SHA-512:774782EB60521B774AB4F6DA0FDB0AB1286AC10FB96406D3846CAF854E53DFE7FBA99FB939B920742A77AF924A834F051A25ABDF04DF48D5DB0A197118758158
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var Survey_UI = function(){.. this.elements = {};.. this.elements["name"] = "Survey_UI";.. this.elements["interaction"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["survey_type"] = "UNKNOWN";.. this.elements["selection"] = "default";.. this.elements["scenario"] = "default";.. this.elements["_event_name"] = "Survey_UI";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction = function(val).. {.. this.elements["interaction"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.survey_type = function(val).. {.. this.elements["survey_type"] = val.toString();.. return this;.. };.. this.selection = function(val).. {.. this.elements["selection"] = val.toString();.. return this;.. };..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastcheckcompleted.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1029
                                                                                                                                                                                                                                      Entropy (8bit):5.069769840529232
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:dLtUM6OUc7UdrUsMchPcM6mFQccLcd7FZY9yP:JtUiU+U9UsRhUyLFngC
                                                                                                                                                                                                                                      MD5:7BA23ACAC141217317E62D9302A8FA32
                                                                                                                                                                                                                                      SHA1:31E37BA64128C389A4B9CD6F0EB5B71170C2AF77
                                                                                                                                                                                                                                      SHA-256:6DB9526F470BA32649A794A467F72218EC731AE44648F9966923EA8AC64ECBA3
                                                                                                                                                                                                                                      SHA-512:1A177419D6D8BB2C69AA9D85F67FF5B852252970F624E0063A52389911A0BFC1406EF82DAE6EC1C7BC3868B72FFFBEBF681E0B33DECCB121412C19C3565FC364
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var ToastCheckCompleted = function(){.. this.elements = {};.. this.elements["category"] = "ToastCheck";.. this.elements["browser"] = "UNKNOWN";.. this.elements["triggerType"] = "UNKNOWN";.. this.elements["count"] = "UNKNOWN";.. this.elements["_event_name"] = "ToastCheckCompleted";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.triggerType = function(val).. {.. this.elements["triggerType"] = val.toString();.. return this;.. };.. this.count = function(val).. {.. this.elements["count"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//956C93B9984498F84018B6C0535619DB3616AC855C8EC5198A412595415AF989FD8C7DCFDF7454E9E0866E6E024687428E1DC

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastcheckcompleted.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):691
                                                                                                                                                                                                                                      Entropy (8bit):5.380196279098391
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1I9F4kIrfzlbkENLqaZW+tLVeSuPKQU55qwIZGlbL27tKAlAK2YbZhZ+AMUJBHr:k4kuVtNLqOtZhuPc5CQTaAK3ZhQAMUbL
                                                                                                                                                                                                                                      MD5:A4073F21156A519D3CBCAF2B29F48A8A
                                                                                                                                                                                                                                      SHA1:659A60456B18794E4660D5A4153BF33A711259B8
                                                                                                                                                                                                                                      SHA-256:F0CFC561A0412CFECF4709FD9AC7A7DC5B9F5CFFA464A00115A741BFC408541C
                                                                                                                                                                                                                                      SHA-512:A45752B9F05E709A854A67F08079FA8E731F59EBBF275CC0706A594E1C9D66BDF2F0C8FE3A32220B781B8AF94F1BF66A2EF798921938FAEF2363F58C0181AF09
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........,...+...H...............,...+...H...............,...+...H...............,...+...H................2...4...+...>...:...4...+...>...:...4...+...>...:...4...+...>...:...%...:...4...7.......7.......>...H............encode.json.core.ToastCheckCompleted._event_name.count.triggerType.browser.tostring.category.........2...%...%...%...%...1...:...1...:...1...:...1...:...1...:...0...H.....Serialize..count..triggerType..browser..category.UNKNOWN.ToastCheck^.......4...%...>...2...5...4...1...:...4...0...H.....new.ToastCheckCompleted.core.json.require...//64DEE79C63F2E5B5EC0E7443C76EE20F3CCA5D29028D81EB20A14349B675ED8AD96EE2B69E4C53E0152AFCBB193CD14DB0903750D3C3DB222A367A9A0D122835++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\toastchecktriggered.luc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):699
                                                                                                                                                                                                                                      Entropy (8bit):5.382405290536798
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:1I9F4kIrfzlbkENLqaZkUo+tLVeen353lRroqwIZGlbLaUi7tKycRY44KJpG:k4kuVtNLq9U9tZTn35QCQaUvnVG
                                                                                                                                                                                                                                      MD5:883B62C7DFE0B395DB60E89183AE80DA
                                                                                                                                                                                                                                      SHA1:75AB2090AB6E5CAC5BCEEE6E207732F5B0F400F5
                                                                                                                                                                                                                                      SHA-256:E2B892FF881E1F11DE9BFE707D5D0A5698CECAD3B6031BA9D8689AF49CC16194
                                                                                                                                                                                                                                      SHA-512:EAA0991C968FB77A0F62412A62174DFA92EDD1928443659FDD5FC95FC54B730299383D96E4512E969779B799556E22F8092D4350DE689CA6102F7DB055158309
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.LJ..........,...+...H...............,...+...H...............,...+...H...............,...+...H................2...4...+...>...:...4...+...>...:...4...+...>...:...4...+...>...:...%...:...4...7.......7.......>...H............encode.json.core.ToastCheckTriggered._event_name.count.triggerType.browser.tostring.category.........2...%...%...%...%...1...:...1...:...1...:...1...:...1...:...0...H.....Serialize..count..triggerType..browser..category.Started.UNKNOWN.ToastCheck^.......4...%...>...2...5...4...1...:...4...0...H.....new.ToastCheckTriggered.core.json.require...//C7D93882ACA7A0118FFB783DD95006C8E7F95B1A0C679A42338468CF9D08179D81F528A009B899622DD03FE1BB118315ADFFAD373B92D4DA104BEC25D23824A0++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\user_welcome.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):855
                                                                                                                                                                                                                                      Entropy (8bit):5.099655861180247
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:PbLtRUbUM6OUsfmQcMIc+PcM6cFZ0Xv/w:ftRUbUiUsqg+UQn0A
                                                                                                                                                                                                                                      MD5:9FAC92371FC7B935F7999ADA0AD24C38
                                                                                                                                                                                                                                      SHA1:06BEAA9471765AD23807D103045257CF9AA23055
                                                                                                                                                                                                                                      SHA-256:C522C4E77D44D7A2E0B7EFE99329F67FF482A5E656CE3AB2B6E73F0AAABBE0A7
                                                                                                                                                                                                                                      SHA-512:97F2FC511600F69899594F8376C6291B7CDFC383E70B9905F43EC52906BD02577FC87F8ED0E51C2542F935CF1EAD4EF5A2A1693D960F4D63CBC9B56C60E3C003
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var User_Welcome = function(){.. this.elements = {};.. this.elements["name"] = "UNKNOWN";.. this.elements["interaction_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "User_Welcome";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//A5508AB4CFD8683C1011F9E272EF08E51E58CA6F27D4D23B441E1CFB39B69BA653EE279E504C37270A0459240139CD8E5D81B2B32040AA286BF345C248FB5EBC++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\webboost_upsell.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):871
                                                                                                                                                                                                                                      Entropy (8bit):5.083940000280523
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:gTLtTFEL5M6OUsHFCmQcMIc+PcM6cFZ7uZcDXXW:gftT+L5iUsHFg+UQn6ZcD2
                                                                                                                                                                                                                                      MD5:FCF4AB088EF2AC175EFAF11ED233CBA3
                                                                                                                                                                                                                                      SHA1:4281BA9EAC52F5CAFE8E5996F8C8E8B47F5F4177
                                                                                                                                                                                                                                      SHA-256:4F61CC006659D49504DE6ADCE89D7C4569FCA43EFE3EE9160C36EF3B58139A05
                                                                                                                                                                                                                                      SHA-512:F5D2746D5AF2E27AFC3BF1A2F782FADE6FD37C67A55E380651D6ADAC2F888BBBD3F8DF2E7E47BB8CE241195E30494C023CFF80C56B43C4429C7B928E72BF3992
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var WebBoost_Upsell = function(){.. this.elements = {};.. this.elements["name"] = "WebBoostUpsell";.. this.elements["interaction_type"] = "Impression";.. this.elements["browser"] = "UNKNOWN";.. this.elements["_event_name"] = "WebBoost_Upsell";.. this.name = function(val).. {.. this.elements["name"] = val.toString();.. return this;.. };.. this.interaction_type = function(val).. {.. this.elements["interaction_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.Serialize = function().. {.. return JSON.stringify(this.elements);.. };..}..//6041E5307506BA2BAA15E35D8E5691D7C09C69EAC89CDD3657B79F6F31EF878010DA0B2DF9270308CEC73CD98CCB5676D3C5EA60FD5D73F45D41BE3F4D8380F3++

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\telemetry\serializers\wssatpassisttoast.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1867
                                                                                                                                                                                                                                      Entropy (8bit):4.887827198337418
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:pFtdVUiUOU71U0DUmUjrUsTXwUi37mId1j7n/PLssr:TtdVUiUOUxU0DUmUjrUaX7i3yId1jz3f
                                                                                                                                                                                                                                      MD5:38EC7A82E2230B6128122A359FF8CB7D
                                                                                                                                                                                                                                      SHA1:6BECB1B592715271EEF456279BACB8472EAF95C0
                                                                                                                                                                                                                                      SHA-256:4211E158572FB535E7ABA5C773C6498E1C50199AF452ECC234FD3A017432F0E6
                                                                                                                                                                                                                                      SHA-512:06935C5EB17AACA243ADBF2DCF0E1F8DCC88CE1FD63FE1ADF158F257F1EFDCFCDA154460FEF6A3720CC21869FD5987CABF58E211566BCC753AA14997502EC703
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:var WSSATPAssistToast = function(){.. this.elements = {};.. this.elements["category"] = "WSSATPAssistToast";.. this.elements["action_type"] = "UNKNOWN";.. this.elements["browser"] = "UNKNOWN";.. this.elements["counter"] = "UNKNOWN";.. this.elements["threshold"] = "UNKNOWN";.. this.elements["product"] = "UKNOWN";.. this.elements["variation"] = "UNKNOWN";.. this.elements["trigger"] = "UNKNOWN";.. this.elements["url"] = "UNKNOWN";.. this.elements["_event_name"] = "WSSATPAssistToast";.. this.category = function(val).. {.. this.elements["category"] = val.toString();.. return this;.. };.. this.action_type = function(val).. {.. this.elements["action_type"] = val.toString();.. return this;.. };.. this.browser = function(val).. {.. this.elements["browser"] = val.toString();.. return this;.. };.. this.counter = function(val).. {.. this.elements["counter"] = val.toString();..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\uihost.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):855520
                                                                                                                                                                                                                                      Entropy (8bit):6.3883568869490315
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:vqDRCc9QnUTmJDeQsPE7R/LeMN7G1UrqwIOIP+JqoZ6MpmN/qn/FC7qlL0b5i7Em:iDRyJGYFCOlL0A7EKiaEcwK+YyoX
                                                                                                                                                                                                                                      MD5:12AC81D29928BF8B46E49A97AA9863C8
                                                                                                                                                                                                                                      SHA1:5016F2ECDC1DDFFE7E259355A2583CA820731BB4
                                                                                                                                                                                                                                      SHA-256:5D8C9AE8B4EEF307319A15C5EC2CA530D2D4FA3C1C2FF6EA555C6D7ED6FC8C91
                                                                                                                                                                                                                                      SHA-512:2B94B01C1D0CE1549758AC1AF070B7ECFBD215E726B5B4A4438BD00835F5A5C58E88B9CCA4E65D38A5467026B630B7A1DB7CD3505EE290A39B283BEEB460A320
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........:..S[.IS[.IS[.I.3.HX[.I.3.H.[.I...HA[.I...HY[.I54.IQ[.I...H7[.I...HR[.I.3.H@[.I.3.HR[.I.3.H^[.IS[.I.[.I.5.HT[.I...HD[.I...IR[.I...HR[.IRichS[.I................PE..d....j1e.........."......(...t.......M.........@....................................t.....`..................................................]..........p............~..........@.......p.......................(.......8............@......`Y.......................text...L&.......(.................. ..`.rdata.......@...0...,..............@..@.data........p...x...\..............@....pdata..............................@..@.didat...............`..............@..._RDATA...............b..............@..@.rsrc...p............d..............@..@.reloc..@............h..............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\uimanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5450192
                                                                                                                                                                                                                                      Entropy (8bit):6.389009034557386
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:IOY5Fbjv7/ioAZ8GPlWPj8wrtHOtxLrNqQoFe3PGMcuOw7PvFGbf8jLk6q/YQnbm:S7PjvxEmHfXu4eT+pK0f2KENR0TBxWZ
                                                                                                                                                                                                                                      MD5:EFA7113287AACD4DA99E30D4B83F5058
                                                                                                                                                                                                                                      SHA1:7BA6E513B220FD7B2D1AD34BCF661DCBBB9A3989
                                                                                                                                                                                                                                      SHA-256:E5A46B5EE5213CB84875C71E00B89B403306414F3343BC871D58C53E1219FCF7
                                                                                                                                                                                                                                      SHA-512:193A2416FFDDDFA0C84759E3C3E7C82FB5330BB5B3D2446B912F91F30DB1203FB87B8C23A831FCBDC2DD44FF1A43E215EC586949712470E2712975E88BD95153
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......l7..(V.\(V.\(V.\s>.]%V.\z#.]9V.\z#.]"V.\N9.\*V.\z#.]OV.\s>.].V.\!.`\ V.\s>.].V.\.#.])V.\.#.])V.\s>.]5V.\s>.]*V.\.8.]hV.\.8.]iV.\(V.\&T.\(V.\/V.\.#.].V.\.#.])V.\.#.\)V.\.#.])V.\Rich(V.\........PE..d....j1e.........." ......<..........t5......................................PR.....d.S...`A.........................................]I.P....]I.T.....Q.P.... N..l...dQ.......Q.....0.E.p.....................E.(...0.A.8.............=.x....WI......................text.....<.......<................. ..`.rdata........=.......<.............@..@.data........I......tI.............@....pdata...l... N..n...bM.............@..@.didat..@.....Q.......P.............@..._RDATA........Q.......P.............@..@.rsrc...P.....Q.......P.............@..@.reloc........Q.......P.............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\uninstaller.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2508096
                                                                                                                                                                                                                                      Entropy (8bit):6.449144097360262
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:ADiY+1zMkEzRuZLkbZNOyDIyapdEIxeuZblk:AY4F+LkbZgyUlguZe
                                                                                                                                                                                                                                      MD5:4CB9C1010F9CB39B7685612187FE47B9
                                                                                                                                                                                                                                      SHA1:2D8A907B7F84D84420165EEA0658F564F99378EA
                                                                                                                                                                                                                                      SHA-256:AAAD928488C79E3905E2D148D6C83D612D556C137028208E2354EB65865AA503
                                                                                                                                                                                                                                      SHA-512:D443A7BB595C449537450A403DA40CF09E68857CC1F6AC5D7DB3B3DFB5FFF82F046E1BE4C3926161A63688AFE935B27C88818C1F1699BD5F023269D46550E9B4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........&..u..u..u..t..u..t...u..t..u..t..u..Pu..u..t...u..t...u..>u..u..t..u..t..uC.t..u..u..uC.t...u..u..u..t...u..Ru..u.:u..u..t..uRich..u........................PE..d...kh1e.........."......p...B.................@..............................&.....;.'...`............................................................p....p...9...F%.@.....%..+......p.......................(.......8...............@.......@....................text....o.......p.................. ..`.rdata...c.......d...t..............@..@.data....~..........................@....pdata...9...p...:..................@..@.didat..............."..............@..._RDATA...............&..............@..@.rsrc...p............(..............@..@.reloc...+....%..,....%.............@..B................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\updater.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2510216
                                                                                                                                                                                                                                      Entropy (8bit):6.4744073596718055
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:uHAIJbp1oLJ9gwXzNoK/u1UKVQ96FauwEx0FPryw:gq3mK/NDAAFz
                                                                                                                                                                                                                                      MD5:58F4650AC344EFBBD2F4D1EEE6076FC4
                                                                                                                                                                                                                                      SHA1:2ABA618BCCF485DFD0EBFC36B55E1C61A852E308
                                                                                                                                                                                                                                      SHA-256:97A902EEE7305BFC3549FFEC2C8EA8238BCA7484A0E7F39AA12968231457E50D
                                                                                                                                                                                                                                      SHA-512:80F8C6DDF822C36D91AC4D9644EFF1585062889E140AFBF8C0139BE8368951339BFE7D856BEED6A74C61A18994782AF7215E2E9D01CD9F006BD79C58FB194544
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........B.k...k...k.......k......=k.......k.......k.......k.......k..!....k.......k.......k.......k.......k..$....k...k...k.......k...k..kj..$....k..$....k...k...k..$....k..Rich.k..........................PE..d...Gh1e.........."......(...R.................@..............................%.....VH'...`................................................... .......#.8....@".,f...N%.......%..'.. ...p.......................(.......8............@..0..... ......................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data....(....!....... .............@....pdata..,f...@"..h....!.............@..@.didat........#......R#.............@..._RDATA........#......T#.............@..@.rsrc...8.....#......V#.............@..@.reloc...'....%..(...&%.............@..B........................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\wa-ui-uninstall.js

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10214
                                                                                                                                                                                                                                      Entropy (8bit):3.917914647053502
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:/QL4RLAq8F9BeGgTcNPRzNPx6RlrC052J:P1Ii2J
                                                                                                                                                                                                                                      MD5:544A777A890F18D1E538851A33EC1E53
                                                                                                                                                                                                                                      SHA1:46CCE2C4DD9D88B891D19A35E0600537A17B365B
                                                                                                                                                                                                                                      SHA-256:7540877A25FC5DEC269BE4880374FD033ED336F0169A7DDBB050105E1FC672EF
                                                                                                                                                                                                                                      SHA-512:4445E861AAA676419FEF4B116B9B919D19F0E12D96663685298C4B03CA68C2602283F0F8812CF3AC2BB42A0A15025ACAAD0FB68D676334227847983018EB10C2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:/* Uninstaller UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.UNINSTALL).get,.. _core = wa.Core,.. _window = _core.Window,.. _webAdvisor = _core.WebAdvisor,.. _productNameHtml = _webAdvisor.getProductNameHtml(),.. _data = _core.data;.... ui.Uninstaller = function () {.. var checkProgressInterval,.. checkUpdaterInterval,.. checkUpdaterNumRetries ,.. buttonOkId = "wa-uninstaller-button-ok",.. buttonCancelId = "wa-uninstaller-button-cancel",.. buttonCancelCss = "wa-button cancel",.. buttonOkCss = "wa-button ok",.. version = _webAdvisor.getVersion(),.. el = {.. $header: $("#wa-uninstaller-header"),.. $content: $("#wa-uninstaller-content"),.. $footer: $("#wa-uninstaller-footer")..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\wa-uninstall.css

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3354
                                                                                                                                                                                                                                      Entropy (8bit):4.822872455073507
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:UKQqFbbgRjujt6whhzIr3EXNkd9ZcRx1+zRMJ9NDG4lzDiQ:FxFb8Rjujt6wr8r3EXNkFcRx1+zRMJ9t
                                                                                                                                                                                                                                      MD5:45634CD8E91200BDB4B84836D7F3EDE1
                                                                                                                                                                                                                                      SHA1:299F91ADD3A2F7FC1BCF84B58A516BE6B4012AFC
                                                                                                                                                                                                                                      SHA-256:B79054E144C8D658E495FCEBAE0B51AF62585A28592C870B587EFF3216425971
                                                                                                                                                                                                                                      SHA-512:2B4C19BEFA49E5D529E5E54EB1123E019684B32D2F05581FFC6CE30529AEA942B929B5614FABC4DCF7B9005A255359E37034FE89F0B8681AD0D5F68A500FD657
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:body {.. background-color: #ffffff;.. overflow: hidden;..}....#wa-uninstaller {.. width: 600px;.. height: 473px;.. border: 1px solid #BAC6EA;..}....#wa-uninstaller-header {.. height: 48px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: 1px solid #BBC7E7;..}.... #wa-uninstaller-header > div {.. display: table-cell;.. }.... #wa-uninstaller-header .title {.. vertical-align: middle;.. }....#wa-uninstaller-header-close {.. float: right;.. position: relative;.. top: 12px;.. right: 12px;.. cursor: pointer;..}......#wa-uninstaller-content {.. margin: 24px 30px 0px 30px;.. color: #404040;.. font-size: 12px;.. height: 67%;..}....#wa-uninstaller-start h3 {.. font-size: 16px;.. font-weight: bold;.. color: #53565A;.. margin-bottom: 5px;..}..#wa-uninstaller-start h5 {.. font-size: 14px;.. font-weight: 400;.. color: #53565A;.. margin: 0px;..}....#wa-uninstaller-st

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\wa-uninstall.html

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1303
                                                                                                                                                                                                                                      Entropy (8bit):5.273683275763177
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:csY0TEL0GNVMz7jVMz7EVMz7VMz/VMzlLVMCdLG7OLG3LGt1LGztukMrHlDb:3XTEL0Sv265iCdLG6LG3LGt1LGzloHl
                                                                                                                                                                                                                                      MD5:A36240CFA6F2DA80C57CB5A3B208B5EA
                                                                                                                                                                                                                                      SHA1:1373A466E045662CAD700FDCB524C310794CBEA1
                                                                                                                                                                                                                                      SHA-256:504EEF52BFB7A3B623D338B204A69BF3B3D352F04007ABE239045528D09C2F05
                                                                                                                                                                                                                                      SHA-512:0487094E1F0138C489C4AA05E8783CA7B72C5C88C3470310C42DFCAD7D93367C77E589A93AE4C934C56651DB9BA9D7F17E7682222DEC1CABBAA323699B76EC4E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=9" />.. <link type="text/css" rel="stylesheet" href="wacore:mfw\\packages\\builtin\\wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-uninstall.css" />.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-uninstall-#loc#.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-utils.js"></script>.. <script type="text/javascript" src="wacore:mfw\\packages\\builtin\\wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-uninstall.js"></script>..</head>..<body>.. <div id="wa-uninstaller">.. <div id="wa-uninstaller-header"

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\wataskmanager.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3781976
                                                                                                                                                                                                                                      Entropy (8bit):6.464963495958648
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:ag5BZ7RbbSTy/nBLECoGV7khjMRv0qf9ed2uBmCFEg6ulgCqJNwpMJM7s+b4Me3f:/D9iW5cgCqTKMJM7s2w34wcH0
                                                                                                                                                                                                                                      MD5:A0B763E5B211E3A758883C6800F77B89
                                                                                                                                                                                                                                      SHA1:8A3650F1D920B43FB7E7F2F6662508BC1209BFE4
                                                                                                                                                                                                                                      SHA-256:798F895E9AE8B9334C772616420A5A785D541551449EF52CEA66D9ADDA013AB0
                                                                                                                                                                                                                                      SHA-512:7E4011923A6931062E7CB6BF31B3C194FAD9A93F303FA2DD1F0DF85C1B187F18EB7B8F60EA02E75111D05ADFFAF89C8BE5647BDBEB4310C5C0CDD73563620047
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......................................,.............Q.....Z.....................}......Q.......Z........Q..................Rich..........................PE..d....j1e.........." ......*.. ........%...................................... 9......:...`A..........................................3.T.....3.......8.`....`6..(...`8.XU....8..[..`h0.p....................i0.(.....-.8.............*.0.....3......................text...|.*.......*................. ..`.rdata........*.......*.............@..@.data.........3..(....3.............@....pdata...(...`6..*....5.............@..@.didat........8.......7.............@..._RDATA........8.......7.............@..@.rsrc...`.....8.......8.............@..@.reloc...[....8..\....8.............@..B................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\webadvisor.ico

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 11 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):99892
                                                                                                                                                                                                                                      Entropy (8bit):3.9749743269785345
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:JLBqG5eVRjB/jZRj0t4kgU1l50AIDP88+2Y:JLBh5eWgU1B8+2Y
                                                                                                                                                                                                                                      MD5:236FC5ABB597615A608DAB7BE98D5FBC
                                                                                                                                                                                                                                      SHA1:18D3D1CF56898B264A24DE24DC13E4B9B7EED768
                                                                                                                                                                                                                                      SHA-256:06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
                                                                                                                                                                                                                                      SHA-512:155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.chrome.extension.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):676
                                                                                                                                                                                                                                      Entropy (8bit):4.824937383394461
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:ShnHvOaKiUlLAjxOw+aJ/0u74odpE5vvi7B4BLpMZhNl/PKqlKuV:ShnPOaKioAjxEaN94MpEJq7SBlMZ79oi
                                                                                                                                                                                                                                      MD5:D4525EEF75A5ED31DD1463E94E63EE32
                                                                                                                                                                                                                                      SHA1:9D2B35EF3800BF1CD34F6AFE03EDF1B02F75B7EA
                                                                                                                                                                                                                                      SHA-256:E8BE10CE45725068D0B6F7B90C1F86C90B0F949B9FB4229CF9EE4A82DF9980E8
                                                                                                                                                                                                                                      SHA-512:E92548F4F2B49138BEFE5800DD459F0A9DB3062B32661D98BD9E393D2510E9B41822ABCA3FDF179A7EBCA6B8899E0634B668FDDD1D1A1E67D8A5876F11C85D18
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "Chrome Native Messaging API Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fheoggkfdfchfphceeifdbepaooicaho/",.. "chrome-extension://klekeajafkkpokaofllcadenjdckhinm/",.. "chrome-extension://enppghjcblldgigemljohkgpcompnjgh/",.. "chrome-extension://mfifoblohohmjoaiclakcbicbeklikgl/",.. "chrome-extension://kanjcmmieblbpbihaafnedamppkhfadn/",.. "chrome-extension://jhnkplodgdopckiblgedcpoidpgcdbfi/",.. "chrome-extension://bgdpakbfhblhpnbhhajplljnioenlpnk/",.. "chrome-extension://hkflippjghmgogabcfmijhamoimhapkh/".. ]..}..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):332
                                                                                                                                                                                                                                      Entropy (8bit):5.199984426997364
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:3FHWb4FPe8e/ihvqbRVnRUvFFwF1pl8q96DJqHmAf2U2LhGdFm/dwwuEYOi:1Hi7Gv6iK1re/3dwwBi
                                                                                                                                                                                                                                      MD5:ED06108D883C1FFED6910F55AC4A5A3D
                                                                                                                                                                                                                                      SHA1:7974E1658801A128A23C0B2737545F2AB5C5F3F2
                                                                                                                                                                                                                                      SHA-256:B659E0167E9CEBFB8A031F259D840577B3897ABF3E91C2ABBE3E8F947598FF47
                                                                                                                                                                                                                                      SHA-512:075F93DE9A8065B939BD947D23F2D3F1EA793AFA492CA030B0B24C4FB223F85846A37DF908ED5DD08987AFFA60AB3ECB6ACA512C777F05E9DD7849976868D6E8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{.. "name": "siteadvisor.mcafee.chrome.extension",.. "description": "Firefox Native Messaging Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_extensions": [.. "{4ED1F68A-5463-4931-9384-8FFF5ED91D92}",.. "{DFC8025B-FC38-42B1-9E3A-DFA474F33D93}",.. "{C1DB8E20-28BB-4222-8020-FB40187BA1A6}".. ].. }

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.chrome.extension.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):675
                                                                                                                                                                                                                                      Entropy (8bit):4.830153549273225
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:JaWhnHvOaKiUlLAjxOw+aJ/0u74odpE5vvi7B4BLpMZhNl/PKqlKuV:JaWhnPOaKioAjxEaN94MpEJq7SBlMZ7R
                                                                                                                                                                                                                                      MD5:B09DB140B1A6360DC1D7F6BCF9D85B22
                                                                                                                                                                                                                                      SHA1:09839EFA3B9055D51BFE566E9F5F8B7529B085D2
                                                                                                                                                                                                                                      SHA-256:395D1298C7E5A9D6A7F45A0A84F89A0652DE890F202812FE3EF0DA830F24A98C
                                                                                                                                                                                                                                      SHA-512:F1539E728D9F7DB8870CE58D2B4C49431DB288DD4D26D3C3D52374BB1B856001E8BF541650CF77813308060EDC57939E35E0B21D99EE18F0D2681FE052E91145
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "Chrome Native Messaging API Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://fheoggkfdfchfphceeifdbepaooicaho/",.. "chrome-extension://klekeajafkkpokaofllcadenjdckhinm/",.. "chrome-extension://enppghjcblldgigemljohkgpcompnjgh/",.. "chrome-extension://mfifoblohohmjoaiclakcbicbeklikgl/",.. "chrome-extension://kanjcmmieblbpbihaafnedamppkhfadn/",.. "chrome-extension://jhnkplodgdopckiblgedcpoidpgcdbfi/",.. "chrome-extension://bgdpakbfhblhpnbhhajplljnioenlpnk/",.. "chrome-extension://hkflippjghmgogabcfmijhamoimhapkh/".. ]..}..

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\webadvisor_v2.mcafee.firefox.extension.json

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):331
                                                                                                                                                                                                                                      Entropy (8bit):5.221057694206649
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:3FHWEas4FPe8e/ihvqbRVnRUvFFwF1pl8q96DJqHmAf2U2LhGdFm/dwwuEYOi:1HZaW7Gv6iK1re/3dwwBi
                                                                                                                                                                                                                                      MD5:49D8FD2B7CDD52D1CD2F2F3F019A597D
                                                                                                                                                                                                                                      SHA1:62548306CE140C5336570EB02D4AF566121CFC65
                                                                                                                                                                                                                                      SHA-256:B114F82CBCB910A1F282E823266801468571F3F2DB9802AFFD3C758F933CE9C2
                                                                                                                                                                                                                                      SHA-512:3F9FA7C2D56A3BA12690D1D2107FC12D66CC6294D0C1A5003221E4B7A6C6481197BFD05CDEFFDE09F2D2AEF55132CE8CBEB40953AD25A96BF40675907FE68B16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{.. "name": "webadvisor.mcafee.chrome.extension",.. "description": "Firefox Native Messaging Host",.. "path": "BrowserHost.exe",.. "type": "stdio",.. "allowed_extensions": [.. "{4ED1F68A-5463-4931-9384-8FFF5ED91D92}",.. "{DFC8025B-FC38-42B1-9E3A-DFA474F33D93}",.. "{C1DB8E20-28BB-4222-8020-FB40187BA1A6}".. ].. }

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\win32\downloadscan.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3217104
                                                                                                                                                                                                                                      Entropy (8bit):6.71002959579166
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:UhFvicTAda1cPumVW+l+LR2GG+A5Wl8OLO:wicTngUdqOL
                                                                                                                                                                                                                                      MD5:2DFA127725579A0D6B9D26FB7BC3DC48
                                                                                                                                                                                                                                      SHA1:5FEDE8EB777E613EB6B8216D0B8E0113A8F16634
                                                                                                                                                                                                                                      SHA-256:B28546F835FA47B5BDB80FB2B69F6EE87C6900097D42A19870308DC3BDF77363
                                                                                                                                                                                                                                      SHA-512:5C1896056411D627943EB70AA8FD4CDFEEA0B6161AEB2F2BFF4C9E7BD12834865A52D797B1570DF306EABE5CDABAFEE4A016B1A89745F8CCADF6B326587F4CCD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$............u`P.u`P.u`P..cQ.u`P..eQ.u`P..dQ.u`P..cQ.u`P.).P.u`P..eQ.u`P..dQ.u`P..eQ.u`P{.dQ.u`P..fQ.u`P\.dQ.u`P..aQ.u`P\.eQ.u`P.uaP.t`P..aQ.u`P..iQZu`P..`Q.u`P...P.u`P..bQ.u`PRich.u`P................PE..L...&j1e...........!......%..t...... .........&...............................0.......1...@A.........................B,......C,......P................/......`..0".. .*.p.....................*......$(.@.............&..... @,......................text.....%.......%................. ..`.rdata..._....&..`....%.............@..@.data...(....`,..d...P,.............@....didat..T....@........-.............@....rsrc........P........-.............@..@.reloc..0"...`...$....-.............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\win32\wssdep.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):663064
                                                                                                                                                                                                                                      Entropy (8bit):6.664650687353078
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:5VbtYOKv7ftQNF8XpUJP6GX8NEojGroS3sh/3JsIRmjM0is1nY:3bL4QojGIJLRmw07VY
                                                                                                                                                                                                                                      MD5:941D40D2F49DAD023D47BCCF575EC46B
                                                                                                                                                                                                                                      SHA1:F73692D6F717A38C9381A39F27E1E86EEEFF847E
                                                                                                                                                                                                                                      SHA-256:6F23B5DC99FEB65A17AB83F15BF5C368FE870E6A8F3610B0E2AAEB1B69E0484E
                                                                                                                                                                                                                                      SHA-512:4BF2BA18BBE7AE2BF817337C1112E200A9EA1AE10AEB61E71614BB348649E5A8635A4A5B22B63AF9D71FB4796F5A95CB34F458F8E30ACDCA13FB102F058F4A90
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......[..~.j.-.j.-.j.-D.|,.j.-D.z,.j.-.6.-.j.-y..-.j.-M.z,Gj.-M.{,.j.-M.|,.j.-..z,.j.-D.{,.j.-D.~,.j.-..~,.j.-..z,.j.-..z,.j.-.j~-:k.-..-.j.-.4{,.j.-.4z,.j.-..v,.j.-...,.j.-...-.j.-..},.j.-Rich.j.-................PE..L... ..c...........!......................... ......................................g.....@.........................`.......8........p..H........................^...A..p...................@C......pB..@............ ...............................text............................... ..`.rdata..f.... ......................@..@.data....Y.......@..................@....rsrc...H....p.......8..............@..@.reloc...^.......`...<..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\x64\downloadscan.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3745480
                                                                                                                                                                                                                                      Entropy (8bit):6.4661329255764635
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:KTM2/qUgXyWFBzj26uRD5Iva4cfyc3e5S3mHt2Vyt9q5P7fSriox5D1gjSOw6Plw:XxNEp7fSrxz1gjSOJrDQFErk
                                                                                                                                                                                                                                      MD5:872A7620CB24ED83B60B1E32C2A1BCC4
                                                                                                                                                                                                                                      SHA1:E9DEEC0EA9CC150DACF08F34F2ED521A14E0F9F7
                                                                                                                                                                                                                                      SHA-256:3A74E2E6CD457D20910AFB03DFEAF034ED172D83AA0441E9C852732D3F352991
                                                                                                                                                                                                                                      SHA-512:7860E4FA72EAE50A344A2C1B4E56AF37934E4D8F813AF213187D295E821B76EF9F2EB9AB67D78B52AF7A87521126CCFE947FB0075F8ED515BBEF0D10156063CA
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......A.s.............^.......^.......W.......W.......c.......W...w...^.......................^...............^...........G.................................................Rich............................PE..d....i1e.........." .....h*.........@.%.......................................8.......9...`A.........................................V3......W3......P8.......6.......7..R...`8..X....0.p.....................0.(...`.-.8.............*.x...PS3......................text...^g*......h*................. ..`.rdata........*......l*.............@..@.data.........3......f3.............@....pdata........6......N5.............@..@.didat.......08......h7.............@..._RDATA.......@8......j7.............@..@.rsrc........P8......l7.............@..@.reloc...X...`8..Z...z7.............@..B........................................................................................

                                                                                                                                                                                                                                      C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):823200
                                                                                                                                                                                                                                      Entropy (8bit):6.402746384497596
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:VSHEuSJFVw4CkQGh5YHWSGBjfPJwo2E9f0bQZQm:VSkhJFxCkQ8YHWPFPJwZE9f0bQZ1
                                                                                                                                                                                                                                      MD5:1E30845BEB801995E8E63550FDD646AF
                                                                                                                                                                                                                                      SHA1:A4D92F20421FAE1FD499AFC1E7567C261031DAE2
                                                                                                                                                                                                                                      SHA-256:05B19FA8537E3DDE3ECFC33951AE1D3B79C612548C95DC466E068160783B7C28
                                                                                                                                                                                                                                      SHA-512:44A861A505B498EECEC2A24395291081C231476AEBB890493F0ACEBFF0620989A323E3AE20649D40BB772B41118909CE1C856B03C490B381AF969F3346D3300B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........CVm."8>."8>."8>.J;?."8>.J=?."8>.M.>."8>.W=?."8>.W<?."8>.W;?."8>.W=?."8>.J<?."8>.J9?."8>.I9?."8>.W=?."8>:L=?."8>."9>.#8>{..>."8>1|<?."8>1|=?."8>.W1?."8>.W8?."8>.W.>."8>.W:?."8>Rich."8>........PE..d...[..c.........." ................................................................e,....`..........................................................P..H........x...........`...... ...p.......................(.......8............0..(............................text............................... ..`.rdata..0....0......................@..@.data...Tt...@...L..."..............@....pdata...x.......z...n..............@..@_RDATA.......@......................@..@.rsrc...H....P......................@..@.reloc.......`......................@..B........................................................................................................................................

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\OpenSans-Bold.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansBoldAscender - Open Sans Bo
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):224592
                                                                                                                                                                                                                                      Entropy (8bit):6.417825673886155
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:JmT6w+rgw9JcJmHeJvjzauutgCNktQFvmnoxXTS4uvpt:M+/9JcJlYqCNktA+SXfGpt
                                                                                                                                                                                                                                      MD5:50145685042B4DF07A1FD19957275B81
                                                                                                                                                                                                                                      SHA1:C1691E8168B2596AF8A00162BAC60DBE605E9E36
                                                                                                                                                                                                                                      SHA-256:5894A3649B213CF5B2D673B6E7A871815FD1D120FA68A463592F27DB14EAE323
                                                                                                                                                                                                                                      SHA-512:9C995725AADE5F126C727FAF1C4453344E37B590A14152D31D44DCA3C9328A54207BBC7C840695CB55BC1B559097B457888655E11199192CD5197C85AAB8B1B6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:...........0DSIG..t:..W....tGDEF.&....S.....GPOS.7.7..S....8GSUB.+=...T.....OS/2.u.........`cmap)./h........cvt .-..........fpgm.s.u........gasp......S.....glyf......%...K.head.......<...6hhea.).R...t...$hmtx$...........kernT+.~..qp...6loca..`+...T...Vmaxp.5......... name.f{"..'.....post.C.l..-...&+prep...k................:.9._.<..........B........J....................................y...............................X......./.\.......................3.......3.....f..................@. [...(....1ASC. . ...........X ........^..... ...................J.u.....+.-...X.5.?...R.!.....R...=.\.?...X.R.?...=.H.u.N.....J...y...N...N...#...d...H...7...H...B.H.u.R.?...X...X...X.....-.f.....`.....w.....{...d.....w.......B...h.P...............^.w.....^.w.H...h.^...).....3.......V.........1.....N.....3.B...J.....L...V.......\...\...\...).....B...q...q.}.....q.......B.....\.......\.......\.y./.B.....................7.'...h...'.R...X.....J.u.......R...q.....h.....j.......d.../...R...X...=...d.....m.\...X

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\OpenSans-Italic.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansItalicAscender - Open Sans
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):212896
                                                                                                                                                                                                                                      Entropy (8bit):6.4588022246365755
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:pd+7UZNLjEBNutgCNktQFvmnoxXTS4ugD9:jVpEqqCNktA+SXfVD9
                                                                                                                                                                                                                                      MD5:C7DCCE084C445260A266F92DB56F5517
                                                                                                                                                                                                                                      SHA1:F1692EAC564E95023E4DA341A1B89BAAE7A65155
                                                                                                                                                                                                                                      SHA-256:A54DC8488F8193BF30C3820CF6F261F911F9D328D699E1A1B8042641554CEC70
                                                                                                                                                                                                                                      SHA-512:0FE7EC4C8ECEAFE87FBBDB9780519FAFFB646A23579CE5A4F5170808284C1ED85B9AAFDAB18CC4DDCAA9A7E6E2559FA6ED984D986BA93D1BBF4BC0551D5661D0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:...........0DSIGZw.@..*,...tGDEF.&....&.....GPOS.7.7..&,...8GSUB.+=...&d....OS/2.M.=.......`cmap)./h........cvt ............fpgm~a..........gasp...#..%.....glyfPX.T..%.....head.G.c...<...6hhea. .....t...$hmtx............kernT+.~..C....6locaM......0...Vmaxp.C......... nameSt".........post.7.l......&+prepT......................_.<..........cH.......K........b.......................y...................................W......./.\.............k.........3.......3.....f..................@. [...(....1ASC... ...........X ........H..... .....................+.....+.?.h.H.X...\.B.....H.R.H.`.j...h.........7...+.....h.y.h./.h...h./.h...h.P.h...h...h.`.h.b...+.....h.y.h...h.y.j.....o.q.....V.....T.V...V...V.j...m.V.....#...u.V...V...T...T.......V.......V...'.....h...b.......'.......?...J.......J.j.#.5.'.D.o.?...b...;...b...b...b...........;...;.......9...9...;...;.}.b.......b.+.;.m.....Z...q...b...u.......;.........h.......h.s.........h...h...h...h...h.....;.o.............X.h.....7.........m...h..

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\OpenSans-Light.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 30 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open Sans LightRegularAscender - Ope
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):222412
                                                                                                                                                                                                                                      Entropy (8bit):6.431002788848856
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:b4kgACfHoUGMxLutgCNktQFvmnoxXTS4uUJt:z2fHowSqCNktA+SXfvJt
                                                                                                                                                                                                                                      MD5:1BF71BE111189E76987A4BB9B3115CB7
                                                                                                                                                                                                                                      SHA1:40442C189568184B6E6C27A25D69F14D91B65039
                                                                                                                                                                                                                                      SHA-256:CF5F5184C1441A1660AA52526328E9D5C2793E77B6D8D3A3AD654BDB07AB8424
                                                                                                                                                                                                                                      SHA-512:CB18B69E98A194AF5E3E3D982A75254F3A20BD94C68816A15F38870B9BE616CEF0C32033F253219CCA9146B2B419DD6DF28CC4CEEFF80D01F400AA0ED101E061
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:...........0DSIGHE....OX...tGDEF.&....K8....GPOS.7.7..KX...8GSUB.+=...K.....OS/2..Q.......`cmap)./h........cvt ............fpgm~a..........gasp...#..K(....glyf..zU..%...B.head.;....<...6hhea...$...t...$hmtx>.L ........kernT+.~..h....6loca=Z....l...Vmaxp.j......... name ........-post.C.l..$...&+prep..].......:..........f._.<..........B........K........b...........................................................X......./.\...5...........,.......3.......3.....f..................@. [...(....1ASC... ...........X ........?..... ...........................+.7.....u.q...{.....-.R.-.=.h.h...o...D...\...........s.......q...^...+...........m...y...o.......L...o...o...o.^.9...q.................j...............o.Z...H.................................\.o.1...........#.3.N...9.....R...........3...X.J.......=.b.......w...w.d.w.f.../.-...............................w.......w.......T...................7.......R...=.T.....H...o...............N.......+.T...!.....P...d...N.u.R...o...\...d.....m.....o

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\OpenSans-Regular.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 26 names, Macintosh, Digitized data copyright \251 2010-2011, Google Corporation.Open SansRegularAscender - Open Sans
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):217360
                                                                                                                                                                                                                                      Entropy (8bit):6.419276317380006
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6144:Y6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCl:n9FrIJJaqCNktA+SXfUCl
                                                                                                                                                                                                                                      MD5:629A55A7E793DA068DC580D184CC0E31
                                                                                                                                                                                                                                      SHA1:3564ED0B5363DF5CF277C16E0C6BEDC5A682217F
                                                                                                                                                                                                                                      SHA-256:E64E508B2AA2880F907E470C4550980EC4C0694D103A43F36150AC3F93189BEE
                                                                                                                                                                                                                                      SHA-512:6C24C71BEE7370939DF8085FA70F1298CFA9BE6D1B9567E2A12B9BB92872A45547CBABCF14A5D93A6D86CD77165EB262BA8530B988BF2C989FADB255C943DF9B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:...........0DSIG..D...;....tGDEF.&....7|....GPOS.7.7..7....8GSUB.+=...7.....OS/2.>.........`cmap)./h........cvt .M..........fpgm~a..........gasp...#..7l....glyft8.K..%.../.head.v....<...6hhea...s...t...$hmtx.5<.........kernT+.~..U@...6loca)......4...Vmaxp.C......... names......x....post.C.l...@..&+prepC...................!..__.<..........51.......LL.......b...........................{...............................V......./.\.......................3.......3.....f..................@. [...(....1ASC.@. ...........X ........H..... ...................#...5...+.3.......h...q.....^.R.^.=.j.V...h...?...T.!.........f.......d...^...+.......u...^...h...j.!...!.?...h...w...h.o...1.y...../.....}.....s...!.....}.......T.#.`.....'...9.......;.}.....;.}.....d.j.m...........h.......{.....R...........3.V.1.........s.^.......s...s.}.s.....b.'.............3.......q.........s.......s.D.....j.............9...1.'.......R...=.h.....H...h.....#.........?...{.....h...!.{...5...d...F...R...h...T...d.....m.....h

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\RobotoCondensed-Bold.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, 17 tables, 1st "GPOS", 27 names, Macintosh, Font data copyright Google 2012Roboto CondensedBoldGoogle:Roboto Condensed Bold:2013Roboto Conde
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):141796
                                                                                                                                                                                                                                      Entropy (8bit):6.564942499216475
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:mbSquVx4PRILqO/jXTGwiliI5Zju5TzLJEzEXGpNj/brFcaiqprTQgwYwO3QDqqs:mbT9IF7PIrUYohYQRG+tbM
                                                                                                                                                                                                                                      MD5:52F9B35F9F7CFA1BE2644BCBAC61A983
                                                                                                                                                                                                                                      SHA1:C348D9F1B95E103AC2D14D56682867368F385B1A
                                                                                                                                                                                                                                      SHA-256:28A1D37668B4CF94FFF5256E9639F175BAF4DD654EC84BA910485D38BEEFA6BD
                                                                                                                                                                                                                                      SHA-512:DE48B5E6751134C7FCAA8EE4C734E0F458E86FC59249EF19D9C45B7098EB7273C4119D5944332465080154A3D9C8ACDB1AA84CCCE011BBE5C7F32251ACDE6CAD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:............GPOS.........S.GSUB1..m..$....dLTSHoq.....@....OS/2...........`cmap}.....X...Xcvt .Y.=..!.....fpgm+.M.........gasp...........glyf>..b..*...}.head...q.......6hhea.......T...$hmtx.H.7.......Hloca(....!....&maxp.?.....x... name..4E........post...v......#.prep...... l...G........r2.._.<...................7........{.................b........................................._.................................3.......3.....f..................P. [... ....Goog. .....b.....b.+ ...O....:... . ...................Z.3...,...O.L.Z...;...4.y.m.x.&.9.....6.../...x...|.......P.......<...5...5...R...P...7...S...K.......Y...0...x...j.....O.(.n...p.n.@.J...n...n...n...Q...n...}...5.q.n...n...i...n...K...n...Q...o.U.C.......^.i.......g...d.....<...j...........&.....u.I...9...\...4...6...E.......6...T...i.......\...i...]...W...:...\...6...\.x.".......U.................s.A.J.,.....J.*.a.Y...}...Y...\...J.:.....l.[.T.......R...b...7...s...R.......u...W..._...O...d.Y.x...8.6.....S...f.+.h...<...c

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\RobotoCondensed-Regular.ttf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, 17 tables, 1st "GPOS", 27 names, Macintosh, Font data copyright Google 2012Roboto CondensedRegularGoogle:Roboto Condensed Regular:2013Roboto
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):140396
                                                                                                                                                                                                                                      Entropy (8bit):6.588782717230592
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:LXd+rtH61MsgXbu4vDVjOvG0uvsb4hoNo6bdkuqYfh3h4/o+K5/j0VNXFYG2ZtCh:LXd+Bygrhvse0uZWJjNpG+tbM
                                                                                                                                                                                                                                      MD5:0E1821FDF320FDDC0E1C2B272C422068
                                                                                                                                                                                                                                      SHA1:C722696501A8663D64208D754E4DB8165D3936F6
                                                                                                                                                                                                                                      SHA-256:4A7C36DF4318FEE50A8159C3A0EBDE4572ABAB65447AE4A651C2FE87212302B5
                                                                                                                                                                                                                                      SHA-512:948ADB943BFAE5807E0E88A23364D8E706A8BDFE8C4D00592A95CDD34081A64A8D44C4BA6E33A65874AC8A7117927C3DE2B995FDC57C2746AEDD7161DF727293
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:............GPOS.......4..S.GSUB1..m.......dLTSH...w...@....OS/2...........`cmap..j4...X...rcvt ...B..!....2fpgm3.O.........gasp.......(....glyf......*P..w.head...h.......6hhea...o...T...$hmtx.~.........Hloca2....."(...&maxp.?.@...x... name.....(....post...v...@..#.prepF..k.. ....j............_.<...................8........g.................b...........X............................._...............H.................3.......3.....f..................P. [... ....Goog.@.....b.....b.+ ...O....:... . ...................M.S.-.9...].F.a...C.?.R.Z.u.^...&. ...C...5.V.I...........`.......N...K...8...u...k...B...Y...N.......[...=.......r.Y...c.I.q...b...<.^...............f...........;.k.................[.l.....].....?.N...#...u._.....).X.0.L.....O...............5.....O.P...T...t...K...N...R.o./...N...q...........u.......t...r...L...t...N.y.t.{.@.t. ...p.|."...).|.#.|...a.L.R.7.....R.....l.......a...M...Z.......{.C.W.......X...k.Y.Q...s...W.o.}...z...Z...e...\.g.p.......>.......d...\.&.m.Y.U.&..

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\proximanova-bold.otf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:OpenType font data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):112532
                                                                                                                                                                                                                                      Entropy (8bit):6.914743636282392
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:9adb0bDpWsk4Dof6rVMPokpi4lPxGcmdZkmiaRThAwTGyWFXWG7hqp:ib0xWn4Ef6rVMPZitnd4aRJTGy6XWWk
                                                                                                                                                                                                                                      MD5:0018751AC22541E269F7C8E0DF8385F6
                                                                                                                                                                                                                                      SHA1:541E47F0B29737B74C2758B1F040783485DE2A6D
                                                                                                                                                                                                                                      SHA-256:9F4D35BD7CA167C7659A872BDAE6FDE11C306B07EB5C758BAE762F7258B39071
                                                                                                                                                                                                                                      SHA-512:6B6465848CDC0FB24FF2B1953E71B17C19E5E4224857DF761222224778B4659443E8CE21BEA15C76ABFBCD9E371E607A0C1A94ADDBE761C2F07C1648971406C8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:OTTO.......`BASEe!]...-....FCFF ............DSIGUWU....l...(GDEFkvl....(....GPOS.gJ.../D..VRGSUB...o........OS/2.......P...`cmapy..q........head...........6hhea.D.....$...$hmtx.#v-...t....maxp.~P....H....name.S..........post........... ............_.<..........!.......!.........7...........................T...................}..P..~.....2.........X...K...X...^...!............ ...............mlss. .............. .............. .....*...........7.............7...........C...........G...........b.........<.s.....................-...........................................................).,...........U...........e...........y.....................................................................n.............q.....................6..........."...........x........... .a.........Z...........0.......................6.%.........6.%.........R.[......... ...........(...........*...........6...........*.U.........*...........2..............Copyright (c) Mark Simonson, 2005. All rights reserved.Pro

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\proximanova-light.otf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:OpenType font data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):109800
                                                                                                                                                                                                                                      Entropy (8bit):6.930965600483403
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:ku0xdFTu4d506FUgH4hO4EPszuokgMPQfyKQkPXWWRS:ku0xdFTu4dOLhO4EPsJkFQfxhXWWRS
                                                                                                                                                                                                                                      MD5:B7913E898D3CDDF10A49AD0DC3F615B8
                                                                                                                                                                                                                                      SHA1:560917B699FE57632D13CF8EF2778F3833748343
                                                                                                                                                                                                                                      SHA-256:1E90E49B182C8B5876EE6805FF3CD2E39A23FDA79DF33D2E8B57020D6F208334
                                                                                                                                                                                                                                      SHA-512:BAEE3E6114FB8B4F946CD85FAC7BAE19E1CC681820C6C5824092AD955E70CE7253AE471AAA28AD97412E67D4A9C741137BF3FF27233BD94B6D3A654F72ADEE16
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:OTTO.......`BASEe!]........FCFF k.r.........DSIGUWU........(GDEFkvl.... ....GPOS5.>>.. <..Z.GSUB...o..z.....OS/2.......P...`cmapy..q........head.U.B.......6hhea.......$...$hmtx>)..........maxp.~P....H....name.........../post........... ............_.<..........!.......!.......W.7...........................U.W.................}..P..~.......,.......X...K...X...^...!............ ...............mlss.@.............. .............. .....,...........7.............7...........I...........P...........7.........<.l.....................-...........................................................).&...........O..........._...........s.....................................................................n...........$.k.....................8...........$.k.........x...........".M.........Z.o.........0.......................6...........6...........R.I................................. ...........(...........*...........6./.........*.e.........*...........2..............Copyright (c) Mark Simonson, 2005.

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\Fonts\proximanova-regular.otf.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:OpenType font data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):109812
                                                                                                                                                                                                                                      Entropy (8bit):6.934026734078094
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:1B00x3/lCcVKNttpkRdrZs+ElPxBHMbUSiuj+UKQkPXWWm:f00xvlC/9MVspPxegkYhXWWm
                                                                                                                                                                                                                                      MD5:9372D1CC640DF70D36B24914ADF57110
                                                                                                                                                                                                                                      SHA1:374508B24EA24906F25655DE27E854E69CDA2935
                                                                                                                                                                                                                                      SHA-256:31DABA103891ABF8B4D0537661117A8689C9EE5D91EE264F74E64EF1BB37A61C
                                                                                                                                                                                                                                      SHA-512:8100E80E7C7A6283A348FB0C2F9339600DCA96F8DB21E49C3C875CA6C0129D87452CA0D678904E40F65404F5C78B37A82718DEF85EFC085D5F2C9D0FF94182D4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:OTTO.......`BASEe!]........FCFF .`..........DSIGUWU........(GDEFkvl.........GPOS..S".. 0..Z.GSUB...o..z.....OS/2.X.....P...`cmapy..q........head.i.4.......6hhea.%.....$...$hmtx`.._........maxp.~P....H....name...}........post........... ..........._.<..........!.......!.......p.7...........................T.p.................}..P..~...............X...K...X...^...!............ ...............mlss.@.............. .............. .....*...........7.............7...........C...........J...........7.........<.h.....................-...........................................................).$...........M...........]...........q.....................................................................n.............i.....................<.............i.........x...........&.C.........Z.i.........0.......................6...........6...........R.C......... ...........(...........*...........6...........*.=.........*.g.........2..............Copyright (c) Mark Simonson, 2005. All rights reserved.Pro

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):555659
                                                                                                                                                                                                                                      Entropy (8bit):7.999646181497576
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:TzPWS8pkoyQC3RZAh5PJvC2TQjMNJ9KHAwS0VHtkpyC/uuAs8:29pkDR2h5PNC4ogwxHe5W
                                                                                                                                                                                                                                      MD5:0BD42763975DC54AD5EFDCD321C750CB
                                                                                                                                                                                                                                      SHA1:24202455A58C7CED31240A90603C6489728BBFCE
                                                                                                                                                                                                                                      SHA-256:4845A0D7B287399933536C12AD5549FA4F4D49F42500C7311DC2C3C108480A7C
                                                                                                                                                                                                                                      SHA-512:9204678DDEF894657C0F6BD5451294E104FFDEA90DAE12FC3F642547DEBB80435B0CC9D08680F50482BC1236DAF5AE1CD79C322EADCDE7765E9E251231753E79
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]....a.;..=........y...>D.M..7.......4S.........l.+1.1..l]|N...7...fx.).N.D.5.F.w......'..Af.>[.u\v........t..E..&.6.u...0...,.V@aI..w.......N`.........N"....c.ZLO.Q.3.>/.g.Xy9.a>..u.SY....c.(...3).j.w..U..G=.vX..C.;v...0.88.._3.......0)dZ.*..f..x....A#vWF4I.'.....Gk..!.......5.;..q.Dl.MJ..?.....^..;Ds<e...........)&+.."..N....y.....C.".)....C.C.w.Y3. ,.%1Z.J... .wi..S....I.vt\w.:....oN.K.e.\.........~...V)7....Z'.....}..-.,..).i..K..fp../.e.E.........@.~v....#..5...I6$.UJ.T...*z.....tv...R...TN.(....q.M...F../G.o....R...(~.....y(....GT.{............qT*.^..6k.{. .F...U..{K1.....>...t.f.^F..x.L.........o.p.#o?.M..6..c5...x.<.u.B&.V.7...Qd$..I.{.6......cD..K..Z-.....A6..v..m.e<....p...a....L.8.A...S....P..].~}=.:T/XX....DcC_%...'.s.:...2.:...?.I..)....Ak...9...9..o5&..K[...`.T:r..5Ubm..u0$.M\A.\....G&..l..,j..g'.2.~.....af...6]xZ..{..B...9.f6.3E....o..O..W./7.+.`7...Q.).R....d..:......b....0..y.y..-..uis.!..J@By.v?..0.....1.aQ..'.$%&'.+...t

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\gaming_mode\dnddetection.dat.ver.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:Jn:J
                                                                                                                                                                                                                                      MD5:9BF31C7FF062936A96D3C8BD1F8F2FF3
                                                                                                                                                                                                                                      SHA1:F1ABD670358E036C31296E66B3B66C382AC00812
                                                                                                                                                                                                                                      SHA-256:E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
                                                                                                                                                                                                                                      SHA-512:9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:15

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\gaming_mode\dndrules.dat.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1250
                                                                                                                                                                                                                                      Entropy (8bit):7.812941980767714
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:pd4QxebwBgKNIg5gZpfQ2z7IoK792gH7wiu9jLGLXAAaY:AAebwaKNd5gZpt8wtSXAw
                                                                                                                                                                                                                                      MD5:1527C1FD5DA898C3BDB68B8A105937A4
                                                                                                                                                                                                                                      SHA1:D0F9FD4A698F91F54F78DD2043C1349A7E4AE7F3
                                                                                                                                                                                                                                      SHA-256:C269C9E66B2ACDACE62E8AB631F39C24801C4644193BB3934A8DEA3C43F669DF
                                                                                                                                                                                                                                      SHA-512:D574498392A55B47DC81276D63A33E9870232E77F60AC0D78C9BD29E3D419D015A19241E86A7963191643F6C0D0FD2DB613CA5290D559C3801358A60FD5CD27B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]....&....=.=@P...m^<.`..`..>g)'_...!.......3/.....E^."*.9?!..D....b..P....v.:h.hG..Ik....WT.F....b.1.....7...h........$.E..... = ..a...#.:.....[.fo:.oN..3Hv.o...]{...mz&."..n...S.S......K@...C...dPyi*.|....UP..aQ..U&7O.z6_)...7.B.v.V.i....M(.....0F...1..#Oj..GN....r.."...B......H6:Sn.k...#.....S...g.$....F.+`..o`.c:.3... ..CN.D..@.gr7.\....$....h.Ko6....`....$....Da^$...)..d.M.......l.......E..O....i.."..=2.....V|.#C#.......3........n.........?...eD...2.....9..D..P#..K...o.!....-....E..OC..........V-d..b..Z.}C..%...+.$..i........Tg..8......%..#M.6.k......8.b.)....D......b...$n.V<3.o.19...iD..GS&.*....Q..... 6...jJ...2c..(.\...U57&!..MM..P.{c.b.R..%d....%k.....F.5....6.w.0<.1'$q..H.Z'...Z..2....<..,.n...........[..E.....o..H.S.F..DW2g[*..3n....e.j....r6.....#gZ..&.7..S5..?...sS..xp]..j..M>....h./(...S...q....L.....g8.'\h...Z......C.i5...Y.EI.......U...*U.J...I.>......2.a..1'K4d>C...w..Ie....f..i;.A...[].....p..[..C.5..V..+.E0....3..

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\gaming_mode\dndrules.dat.ver.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:U:U
                                                                                                                                                                                                                                      MD5:C4CA4238A0B923820DCC509A6F75849B
                                                                                                                                                                                                                                      SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                                                                                                                                                                                                      SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                                                                                                                                                                                                      SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:1

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\overseer_unattend.xml.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3817
                                                                                                                                                                                                                                      Entropy (8bit):5.078428687646691
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:c4i3+ngroYR1YEz+ngFoYR1YEL+ngBoYR1YEtW+Vagp6bp+VagT6bp+Vag/6bX:JiuKoYTY/8oYTYJIoYTY4J16s36sL6b
                                                                                                                                                                                                                                      MD5:1A90BC8644262CD79E806A222F38E95E
                                                                                                                                                                                                                                      SHA1:0B9DC24A50654A32E0D5974F9F4370BAC30A90F1
                                                                                                                                                                                                                                      SHA-256:1210AEC78A7A836E56E94ACCF4EEA74D5C0F26C2DBB25AE4D6023886ED3C9D64
                                                                                                                                                                                                                                      SHA-512:4F67699DC93EE7DF09C4657A9FFFBEB1F34AC615EEA55D169AC03F7F58C50640C968F4215EDE9DC59B5660166A9E2392FE10B8F2F68F6B067E9631C94C805941
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">.. <settings pass="specialize"> .. <component name="Microsoft-Windows-Deployment" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86">.. <RunSynchronous> .. <RunSynchronousCommand wcm:action="add">.. <Order>1</Order>.. <Path>cmd /c del /F %SYSTEMDRIVE%\Recovery\AutoApply\unattend.xml</Path>.. </RunSynchronousCommand>... <RunSynchronousCommand wcm:action="add">.. <Order>2</Order>.. <Path>cmd /c del /F %SYSTEMDRIVE%\Recovery\AutoApply\CustomizationFiles\Overseer.exe</Path>.. </RunSynchronousCommand>.. </RunSynchronous>.. </component>.. <component name="Microsoft-Windows-Deployment" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">.. <RunSynchronous> .. <RunSynchronousCo

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\profile.wprp.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6932
                                                                                                                                                                                                                                      Entropy (8bit):4.644506586723748
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CAZrQTrleU+wfwywewzZwvZwDwhwIwTw9Zw/ZwVw39wk1iQJ7JTJGJOJ7J9JJJ71:DZrCebtwBe
                                                                                                                                                                                                                                      MD5:AD6BB231D6CA341D585CAA0881BBC680
                                                                                                                                                                                                                                      SHA1:249D7ED96BD7368985770FC91243FFC27A6787E8
                                                                                                                                                                                                                                      SHA-256:362C8627A8CDE159DC2B52D1C3315C4499DAFC8A5A6781ACB373307453584785
                                                                                                                                                                                                                                      SHA-512:70C0943D74381C9B00B59CF28297211905A983C3C5B0203D71D9F28A1367C01D821F329AEE1FEF6D2B04F2AD6552E32D5C7F7EB8EC053691D2D1F6B21940694E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8" standalone='yes'?>..<WindowsPerformanceRecorder Version="1.0" Author="EcoSystem Performance Platform" Team="EcoSystem Performance Platform" Comments="Test" Company="Microsoft Corporation" Copyright="Microsoft Corporation" Tag="BuiltIn">.. <Profiles>.... System Collectors -->.. <SystemCollector Id="SystemCollector_WPRIELaunchInFile" Base="SystemCollector_WPRSystemCollectorInFile" Name="NT Kernel Logger" Realtime="false"> -->.. <SystemCollector Id="SystemCollector_WPRIELaunchInFile" Base="SystemCollector_WPRSystemCollectorInFile" Name="NT Kernel Logger" Realtime="false">.. <BufferSize Value="1024"/>.. <Buffers Value="2048"/>.. </SystemCollector>.. <SystemProvider Id="SystemProviders_Chosen" Base="SystemProvider_Base">.. <Keywords Operation="Add">.. <Keyword Value="CSwitch"/> .. <Keyword Value="DiskIO"/>.. <Keyword Va

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\settings-23.10.8563.1247.ori.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9848
                                                                                                                                                                                                                                      Entropy (8bit):3.7096465667274034
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:queMmM1rgIBHbJrVMKTCXMKeMXbhu3MBs2MSaefaxi2MzmnGxcMI1Lr5xauMkCyp:qBMmE9HbdOdz/mzniykqUTuOl/Vbl8LZ
                                                                                                                                                                                                                                      MD5:D6D47F2FC4249066CF91A53C7B920259
                                                                                                                                                                                                                                      SHA1:12FD18A223A52963E0365362CF1E350355D9C8E3
                                                                                                                                                                                                                                      SHA-256:1A42BC373998C605DFA8D4DF5E2705E1C209326ED578BC67EBE0F3DEDD2A2951
                                                                                                                                                                                                                                      SHA-512:19CDFE62D19BF5073F28D6693412585843C113D85B4A3E01460FCEFE76AA1C85A1E908E8D89016EB804A4A875A9ED5F99499B254E673074E393981482C21D209
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......[.S.c.a.n.n.e.r.].....T.a.s.k.1.=.{.E.C.4.E.C.E.D.A.-.3.E.3.B.-.4.0.2.7.-.A.B.F.E.-.2.9.A.5.1.2.2.D.6.4.D.6.}.....T.a.s.k.2.=.{.7.C.4.9.6.6.F.0.-.D.5.0.2.-.4.1.2.D.-.A.6.3.6.-.A.C.C.C.3.9.A.2.4.B.B.2.}.....T.a.s.k.3.=.{.A.9.6.8.2.2.4.9.-.0.8.E.7.-.4.B.B.F.-.B.8.7.0.-.E.F.B.C.6.3.A.A.2.8.8.8.}.....T.a.s.k.4.=.{.C.6.1.5.6.7.3.5.-.F.7.A.2.-.4.3.8.7.-.9.4.A.7.-.0.4.7.9.0.0.4.A.7.3.1.0.}.....T.a.s.k.5.=.{.2.2.4.3.A.0.5.6.-.8.4.B.3.-.4.3.2.7.-.8.E.4.6.-.5.F.E.4.1.F.7.2.E.E.9.1.}.....T.a.s.k.6.=.{.C.B.6.A.E.6.F.8.-.D.9.A.8.-.4.7.9.4.-.B.2.B.F.-.5.3.A.8.4.0.5.8.C.5.8.F.}.....T.a.s.k.7.=.{.C.C.1.3.C.A.7.D.-.2.2.9.B.-.4.D.0.A.-.8.D.2.7.-.E.2.6.1.2.9.C.D.D.F.1.0.}.....T.a.s.k.8.=.{.9.3.8.7.6.F.2.4.-.B.4.F.5.-.4.D.B.C.-.9.7.B.9.-.7.6.2.C.D.8.0.6.6.7.1.9.}.....T.a.s.k.9.=.{.D.9.3.E.F.8.1.A.-.B.9.2.F.-.2.7.F.E.-.A.F.5.4.-.9.2.7.8.E.A.8.B.F.9.1.0.}.....T.a.s.k.1.0.=.{.F.D.C.8.4.4.B.C.-.6.2.C.E.-.4.A.5.8.-.A.2.8.B.-.7.7.A.A.7.0.2.7.4.0.6.2.}.....T.a.s.k.1.1.=.{.1.9.E.A.8.B.F.0.-.A.1.2.F.-.1.A.F.

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Antivirus\snx_gconfig.xml.ipending.70faf5db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15320
                                                                                                                                                                                                                                      Entropy (8bit):3.6253361142370943
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:xofxKonT6KovaNMSKYBl+p4KonLKKokTtKo7KxKo0IVEKoYjk:afBnEvpSKs5n8kTF7y0IVyY4
                                                                                                                                                                                                                                      MD5:DB89473157A2109D2CC065B9C62ACD27
                                                                                                                                                                                                                                      SHA1:D903A0ED7C5AA5A686C883A597894657A8C0BEB9
                                                                                                                                                                                                                                      SHA-256:2B8D115E38B1AC4EA4FE0EA24006E4E2D7E6429F469B4FF0F1EA45FEE4E7E8D6
                                                                                                                                                                                                                                      SHA-512:41486F90632E52127358B7A6046B347D47FFBDD62970ED67980B56C247F68ECE4D7D0250E19C28C7045AB3D4C9D7DB40E1AEAF2A4AB33D6AE4B591F05EBE3D3B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.S.n.x.C.o.n.f.i.g. .t.y.p.e.=.".C.o.n.f.i.g.u.r.a.t.i.o.n.". .v.e.r.s.i.o.n.=.".3.".>..... . . . .<.K.e.r.n.e.l.>..... . . . . . . . .<.A.v.a.s.t.>..... . . . . . . . . . . . .<.S.o.u.r.c.e.D.i.r.e.c.t.o.r.y. .n.a.m.e.=."."./.>..... . . . . . . . . . . . .<.T.a.r.g.e.t.D.i.r.e.c.t.o.r.y. .n.a.m.e.=.".\.a.v.a.s.t.!. .s.a.n.d.b.o.x.". .f.l.a.g.s.=.".f.P.e.r.V.o.l.u.m.e."./.>..... . . . . . . . . . . . .<.T.e.m.p.l.a.t.e.s.>..... . . . . . . . . . . . . . . . .<.P.r.o.c.e.s.s.N.a.m.e.E.n.t.r.y. .f.l.a.g.s.=.".f.L.a.s.t.F.i.l.e.n.a.m.e.P.a.r.t.". .n.a.m.e.=.".f.i.r.e.f.o.x...e.x.e.".>..... . . . . . . . . . . . . . . . . . . . .<.E.x.c.l.u.d.e. .n.a.m.e.=.".%.A.p.p.D.a.t.a.%.\.M.o.z.i.l.l.a.\.F.i.r.e.f.o.x.\.P.r.o.f.i.l.e.s.\.*.\.b.o.o.k.m.a.r.k.*.". .i.d.=.".{.9.8.C.D.E.9.4.C.-.5.B.A.7.-.4.0.1.d.-.9.2.C.2.-.9.0.D.B.B.4.2.F.9.A.3.F.}."./.>..... . . . . . . . . . . . . . . . . . . . .<.E.x.c.l.u.d.e. .n.a.

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Icarus\avg-av\icarus.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):166
                                                                                                                                                                                                                                      Entropy (8bit):4.990202766082142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:tv+p5RVZCoVENjpbrikf6EI8FWv0dIQLoqDv3RIBLICWvv:tmp53FVumkiEI8FW0IDqDvRIBL1W3
                                                                                                                                                                                                                                      MD5:C043A3BEB23CC43CB3E9ACAE2AD9D8B4
                                                                                                                                                                                                                                      SHA1:F8A300A14643D9D2EF708839D882FA8FAE274F73
                                                                                                                                                                                                                                      SHA-256:3DF024F72A0BCDD90A7C140591E224492481EB7F32A940BFB9AF1CDB6472AF9E
                                                                                                                                                                                                                                      SHA-512:E5BAA81E296B7F06360ED20D9484A137CA49C0505D2C94947B978B09B277F13184E540098E21DAAD0A72D8DDD831A57D6AC0E67C0AA860D87A051B55C3C9FFF2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:...[avg-av]..company-install-path=C:\Program Files\AVG..company-reg-key=SOFTWARE\AVG..product-dir=Antivirus..product-reg-key=Antivirus..program-data-dir=Antivirus..

                                                                                                                                                                                                                                      C:\ProgramData\AVG\Icarus\settings\proxy.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):214
                                                                                                                                                                                                                                      Entropy (8bit):3.4031996566857923
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:Q9oPdKwoW+lGUlYlUlulnvm4HflKmaGHfltNv:QCFKwPaI/VJNKKHNX
                                                                                                                                                                                                                                      MD5:D6DE6577F75A4499FE64BE2006979AE5
                                                                                                                                                                                                                                      SHA1:0C83A2008FA28A97EB4B01D98AEAB90A2E4C8E69
                                                                                                                                                                                                                                      SHA-256:87D882D37F63429088955A59B126F0D44FA728CE60142478004381A3604C9EA9
                                                                                                                                                                                                                                      SHA-512:CB4B42C07AA2DA7857106C92BC6860A29D8A92F00E34F0DF54F68C17945982BC01475C83B1A1079543404BB49342FC7CDC41D2AC32D71332439CEB27B5AD1C0C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......[.P.r.o.x.y.S.e.t.t.i.n.g.s.].....A.u.t.h.o.r.i.z.a.t.i.o.n.=.0.....F.a.l.l.b.a.c.k.=.1.....P.o.r.t.=.8.0.8.0.....P.r.o.x.y.N.a.m.e.=.....P.r.o.x.y.T.y.p.e.=.0.....U.s.e.r.N.a.m.e.=.....U.s.e.r.P.a.s.s.=.....

                                                                                                                                                                                                                                      C:\ProgramData\McAfee\MCLOGS\AnalyticsManager\AnalyticsManager\AnalyticsManager000.log

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\McAfee\WebAdvisor\servicehost.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2558
                                                                                                                                                                                                                                      Entropy (8bit):3.726800708799772
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:NOjhb0k/TOjhb0kYTOjhbuTOjhagOjhxp6OjhxRnTXOjhxJ10dfF+OjhxJ1FdfFJ:2d0dd02wECHhnTArmPrnUamSD
                                                                                                                                                                                                                                      MD5:EB721D4D7DDDA8FA71059027567C7836
                                                                                                                                                                                                                                      SHA1:B4E7D48D1B2D904F5581CBB79BA8E9A96BC5D6EE
                                                                                                                                                                                                                                      SHA-256:EADFA52B2A87867DCF4014156DDDECBB810C2486C20AD2FD107C12533D84DFDE
                                                                                                                                                                                                                                      SHA-512:CA2FF8FBCE0EB6961F250C5C28C340A35E353C674CAE00BDB22ED754F03716BA06D7EC3CE7A56E1F7142CD589283EF44DFABB23A55DC20AC8017EC4998FAD501
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..1.0./.2.7./.2.0.2.3. .0.2.:.3.6.:.3.8. .P.M.$. .-.-. .(.N.o.r.m.a.l.).$. .[.S.e.r.v.i.c.e.H.o.s.t...e.x.e.].$. .U.n.a.b.l.e. .t.o. .o.p.e.n. .r.e.g.i.s.t.r.y. .k.e.y.:. .'.H.K.L.M.\.S.O.F.T.W.A.R.E.\.M.c.A.f.e.e.\.M.c.C.l.i.e.n.t.A.n.a.l.y.t.i.c.s.'. .(.n.o.t. .o.b.f.u.s.c.a.t.e.d.).....1.0./.2.7./.2.0.2.3. .0.2.:.3.6.:.3.8. .P.M.$. .-.-. .(.N.o.r.m.a.l.).$. .[.S.e.r.v.i.c.e.H.o.s.t...e.x.e.].$. .U.n.a.b.l.e. .t.o. .o.p.e.n. .r.e.g.i.s.t.r.y. .k.e.y.:. .'.H.K.L.M.\.S.O.F.T.W.A.R.E.\.M.c.A.f.e.e.\.M.c.C.l.i.e.n.t.A.n.a.l.y.t.i.c.s.'. .(.o.b.f.u.s.c.a.t.e.d.).....1.0./.2.7./.2.0.2.3. .0.2.:.3.6.:.3.8. .P.M.$. .-.-. .(.N.o.r.m.a.l.).$. .[.S.e.r.v.i.c.e.H.o.s.t...e.x.e.].$. .S.u.c.c.e.s.s.f.u.l.l.y. .c.r.e.a.t.e.d. .a.n.d. .i.n.i.t.i.a.l.i.z.e.d. .J.s.R.T.S.c.r.i.p.t.H.o.s.t.....1.0./.2.7./.2.0.2.3. .0.2.:.3.6.:.3.8. .P.M.$. .-.-. .(.N.o.r.m.a.l.).$. .[.S.e.r.v.i.c.e.H.o.s.t...e.x.e.].$. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.L.o.a.d.e.d. .J.s.R.T.A.P.I.S.c.r.i.p.t.H.o.s.t. .e.n.g.i.n.

                                                                                                                                                                                                                                      C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_0004005D0035001D00060032005D0013.txt

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):188
                                                                                                                                                                                                                                      Entropy (8bit):5.014699854062639
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:Q+tWWSgdf0WJXd6krjLRkFReOAbduSQQRVLFkK/S3I+tWWSgdfsx+j6joEVpiXwu:rtp/dvZd6k/LRMO4SJLFTS3Dtp/dI+wu
                                                                                                                                                                                                                                      MD5:01C86D80DE58906FAF0F9A2CFD753B3D
                                                                                                                                                                                                                                      SHA1:CDD6E8C65732AA3C66D0E6BE2B74CAF21602BB3E
                                                                                                                                                                                                                                      SHA-256:1A86D3D1D94237D081D52FACCA7A4BEEC75F95673F386E4ECA0169CAA9251185
                                                                                                                                                                                                                                      SHA-512:199DB3009AD2E7202332FB6A3F3F119679EC8A0A18995F4125A3474A60604E7CA77D5D46552219F2D15E541E137D07AFDB2F028DA7366FD992E8057916FD407C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[ERR][20231027 15:58:01.380][ProcessUtils.cpp@185]: Failed to open process with id 7540. Error 0..[ERR][20231027 15:58:11.790][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                      File Type:Extensible storage user DataBase, version 0x620, checksum 0x65d70a04, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1310720
                                                                                                                                                                                                                                      Entropy (8bit):0.7556070658921229
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
                                                                                                                                                                                                                                      MD5:DCB532E56F350138368451FB0E7A9057
                                                                                                                                                                                                                                      SHA1:DE7387ECCA72B9B72EB9B2CBE456B098DCEDB3A1
                                                                                                                                                                                                                                      SHA-256:913CCB50A7D6E0901AC8241CF963187C18C5A19FA68E3203EAE1CB81CCDEBF21
                                                                                                                                                                                                                                      SHA-512:995099C84E0D2CFDD8E1560400DCE9372F69C98D1BD9FE11041814F73A9D5A9E4CBE3438F311016D49F15DAFB1EFCCD605B51776757200862FFBCDA35CC2B49D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:e...... .......7.......X\...;...{......................0.e......!...{?.-#...{..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{.....................................-#...{....................+-#...{...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                      File Type:Certificate, Version=3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1398
                                                                                                                                                                                                                                      Entropy (8bit):7.676048742462893
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
                                                                                                                                                                                                                                      MD5:E94FB54871208C00DF70F708AC47085B
                                                                                                                                                                                                                                      SHA1:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
                                                                                                                                                                                                                                      SHA-256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
                                                                                                                                                                                                                                      SHA-512:2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:0..r0..Z.......vS..uFH....JH:N.0...*.H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0...*.H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

                                                                                                                                                                                                                                      C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):264
                                                                                                                                                                                                                                      Entropy (8bit):3.1097887147766574
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:kKZDKcK2GhipWhliK8al0GQcmqe3KQjMIo1l2L/:B+72GIWzyZ3qe3KQjxoK
                                                                                                                                                                                                                                      MD5:31159EC4E95B6E075BEA3605F690B3E4
                                                                                                                                                                                                                                      SHA1:50B31D40797A3F9083EC5FAEE10C4C8ACC09890E
                                                                                                                                                                                                                                      SHA-256:B4C0955B210220650BC073CDDADE04DCBF707103DC46C02EFD10305077990615
                                                                                                                                                                                                                                      SHA-512:F72EA17447F542EAB962A2DA024C4D20AED268AD6B910B31755F55134B667310A36456A369A505E623D4F89E5E3DBDA923FF30850A708B47673EB6A73EB7E425
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:p...... ....v...+w=!....(....................................................... .................(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.3.3.e.5.-.5.7.6."...

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1216
                                                                                                                                                                                                                                      Entropy (8bit):3.857211175325878
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:V98uCe+julfOGlwOwNE0sZZlolsiV+aWLlxQZsfU2+sf9FZ6D6oWS2WiTRsVIn:V98uzJfXlJwNE02lolsi4VLlxQZsxB6O
                                                                                                                                                                                                                                      MD5:CE47779BCB4C960EEF5EBF9C3A17C8C3
                                                                                                                                                                                                                                      SHA1:5AB447063B20ED76FF700B01F69C6E08B5FAEBA9
                                                                                                                                                                                                                                      SHA-256:679E2466D9A59026B53BBF755B245338C00CE1C54B8C0AD3BF42686C769473E9
                                                                                                                                                                                                                                      SHA-512:D865B83005FF9A42B96FDC38B2EAC84FB82E1FA0B1F44474150EC757CCA6FE357814A49E2A0E674BDBDF07070F73628FA090351FD010DE02AE01E23E6D11BB9F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.i./.I./.i.m.N.K.E.e.O.q.F.n.Q.Q.g.O.T.W.w.Q.A.A.A.A.C.A.A.A.A.A.A.A.Q.Z.g.A.A.A.A.E.A.A.C.A.A.A.A.B.k.Q.K.Z.V.5.U.x.o.D.f.q./.A.c.7.M.n.b.t.o.X.H.g.1.l.0.W.N.j.G.g.1.Y.T.u.+.p.P.g.6.B.Q.A.A.A.A.A.O.g.A.A.A.A.A.I.A.A.C.A.A.A.A.A.L.g.W.m.O.J.M.y.U.g.E.B.s.x.C.0.x.C.D.N.z.N.W.H.f.s.2.q.y.I.7.Q.C.O.9.V.u.f.G.T.f.h.f.A.A.A.A.A.t.I.f.y.R.d.D.Q.8.J.p.x.U.h.u.h.f.3.3.Q.+.2.7.q.+.N.D.A.6.E.4.B.K.f.I.R.W.H.K.V.+.X.m.W.0.0.0.e.Q.Z.t.K.t.b.o.w.K.Z.m.7.x.6.s.4.0.s.Y.Z.Q.u.f.7.n.g.b.F.a.D.U.3.l.K.s.R.X.9.V.s.C.V.C.N.+.I.J.0.D.X.i.I.h.P.v.h.o.X.8.I.v.G.E.8.T.p.U.0.7.k.2.A.n.q.4.I.S.W.x.m.f.l.w.j.w.N.P.x.t.1.P.P.V.W.j.7.h.R.e.P.Z.0.s.s.D.Z.R.7.R.L.L.C.7.H.T.8.3.D.V.c.C.4./.5.t.x.Q.H.3.+.G.W.d.n.Q.d.Q.G.T.+.+.Q.N./.8.W.x.3.J.D.L.u.W.7.b.m.j.N.o.Q.v.n.T.3.C.b.G.V.Y.S.C.S.M.4.X.a.q.2.G.b.Z.5.P.B.f.G.G.F.Y.I.p.C.3.K.A.K.9.e.E.V.l.G.A.H.1.m.A.2.U.k.8.U.d.Z.K.x.8.4.F.i.S.8.Z.6.N.M.G.A.8.l.P.M.7.3.t.2.O.4.Q.w.i.j.c.Q.j.M.q.v.o.7.1.u.u.a.0.L.R.

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                                                      Entropy (8bit):2.8221237814804043
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:All5yKljhhXBQUsnWLM8lz:AllI+22w8h
                                                                                                                                                                                                                                      MD5:B566C4612D6586B4CA46FB36D6CDF8B9
                                                                                                                                                                                                                                      SHA1:957533BE8F2C533C943B81E370CA3FB824962385
                                                                                                                                                                                                                                      SHA-256:A581F5A4F18B22804D9C0010E8754430B52EB71257E596641BE01F1C49D366B9
                                                                                                                                                                                                                                      SHA-512:5C3165634B8C1FE9253EB91F5BD98402AE3AE86D14457981893EE8A20A00ED2F6340452A5254648CA6C7E16D8E50D3872E07667722C722B2613BFF959AC714B0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:F.B.A.B.6.2.9.0.6.A.8.F.D.D.0.0.1.A.3.5.B.A.4.9.A.8.8.3.4.3.C.D.

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):72
                                                                                                                                                                                                                                      Entropy (8bit):2.9095570773448958
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:blVH8HMR8l1HSnDlomlDlSlVFiD:zcHMe1ynDxl5SV2
                                                                                                                                                                                                                                      MD5:6578121E1AE449C3C3443A966B92444C
                                                                                                                                                                                                                                      SHA1:EC68290B53F345BB6ADF425F4A131856C55999A4
                                                                                                                                                                                                                                      SHA-256:1FF8EBBE8B6CA9959A06341FC6B0157AA4F8F6C4A94A67749E0149439B207F9B
                                                                                                                                                                                                                                      SHA-512:D31E78966730AA5FD8B58A7503A7B1369D02FC2A7FDE48DA1A2EDCFF3AF6F3AD9F78A86C4392ED6A2EF125A9F9E3BABF03E6A5803064B589FE65C257306E7462
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:0.8.6.a.1.8.8.6.-.9.1.3.4.-.4.e.5.8.-.b.8.7.a.-.0.0.2.a.f.7.e.d.3.b.3.4.

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3387
                                                                                                                                                                                                                                      Entropy (8bit):5.131468574490925
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:WRSUwflGpBRubS3EHCq9qqI0fkMean0e6zKjPt84hP4kzVrFFKtFuaFuqfN3Yo0c:mSUdykEiqxfkMea5aCPvFuNdN3Y8YS
                                                                                                                                                                                                                                      MD5:D49CF6BD468FF2D6B4FC05F64FBA2486
                                                                                                                                                                                                                                      SHA1:B44AAD27ACF900FDFE38C5EC76619CD5BDE98302
                                                                                                                                                                                                                                      SHA-256:94F6D49BD71AC68A18CBAFE222A8EFBF17D199CA6F68DACBCA524A0C077FCFBA
                                                                                                                                                                                                                                      SHA-512:23BD30C0D503FED54A04D98D657C3B923C9485044E5C2A70BAB667DCC843CED4589D74CCEFED4C0F9571FC17FE668A5CC238995556AE6D129C911CF1D3543216
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:2023-10-27-14-35-55 ----------------------------------------------------------------------------------------------------..2023-10-27-14-35-55 Installer: TeamViewer..2023-10-27-14-35-55 Version: 15.37.3 (JMP-91.4)..2023-10-27-14-35-55 Install mode: Admin..2023-10-27-14-35-55 Account type: Admin, UAC supported:1, Elevation:2..2023-10-27-14-35-55 Time: 2023-10-27-14-35-55..2023-10-27-14-35-55 OS-Version: 10.0.19045(64-bit) SP:0, Type:1..2023-10-27-14-35-55 OS-Info: Server:0 Home server:0..2023-10-27-14-35-55 User-SID: S-1-5-21-2246122658-3693405117-2476756634-1003..2023-10-27-14-35-55 Log level: 100 (default)..2023-10-27-14-35-55 ----------------------------------------------------------------------------------------------------..2023-10-27-14-35-55 ..2023-10-27-14-35-56 TVInitRollback(): create scheduled task for restore..2023-10-27-14-35-57 Create backup directory:<C:\Users\user\AppData\Local\Temp\TeamViewer\TVInstallTemp>..2023-1

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\Downloads\teamviewer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42543224
                                                                                                                                                                                                                                      Entropy (8bit):7.997942604118609
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:b5bTkNde3NvoxYDk49MvgsV7FzV83hUcvPYRYntnwHu/olv1qR:bGedowMRFzV8xZvP+YntnwHiR
                                                                                                                                                                                                                                      MD5:2E185F8A6622BC3062254F6F195ACC81
                                                                                                                                                                                                                                      SHA1:B99F246AFB7749FDE563CBD37F217FE5D2A80585
                                                                                                                                                                                                                                      SHA-256:F46F2978F32714C142B92569173FC68B2DC1374D988F6F041F7EAE0190C5BF9E
                                                                                                                                                                                                                                      SHA-512:CF9C58DD76E40C132BB7ACC057026AD41282639CBF27EBF27C7296C52C9AAB64AED08663CE82A31A9DB6035BE6F23CCB0EA021C228556E7B94BF15A27585A3E9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P..*_...P...P..OP..*_...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................'.....@..........................................P..@...........@...8/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\TeamViewer\install.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):78
                                                                                                                                                                                                                                      Entropy (8bit):4.299916880895009
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:HWRBXUrDikRLWvSGXR1mQWRKRL4RLJ:H8XUWkRL+TWgL4RLJ
                                                                                                                                                                                                                                      MD5:A3C26DD25FC88922E9297E2A9D04AC53
                                                                                                                                                                                                                                      SHA1:807B0CA16C4080B6CE7AE8B09E7DCCE7E52D5C19
                                                                                                                                                                                                                                      SHA-256:1C5231379C3025A42D51F956F649C445EBC550F9AD9B9F5CC4AE5E627EF456B3
                                                                                                                                                                                                                                      SHA-512:1D36EE7B43D82B72000520C0B0C37585576363FCD506AEAB362C544000B0BF9702A357E118B2AE3499D8F8C9A7529F56169CC14E5281A5246AE9EFD342C4FA59
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[Installer]..DefaultInstallation=1..UnattendedAccess=0..CustomInstallation=0..

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\TeamViewer\tvinfo.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\Downloads\teamviewer.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):40
                                                                                                                                                                                                                                      Entropy (8bit):4.443942707918269
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:HWRFRLMKxAI9kdNv:H4RLMqAI2rv
                                                                                                                                                                                                                                      MD5:D0C487348258D7A04A27840DF375D184
                                                                                                                                                                                                                                      SHA1:A1049F6B7654A88693A3BDA5693BE021A772443B
                                                                                                                                                                                                                                      SHA-256:09DFB5AEDD358B2679EC84DD366A015024C4360CCDBDB5FCD5FECD8B508ADFF5
                                                                                                                                                                                                                                      SHA-512:409C77BF2F65BBF61A853A95D1389D40A173051B93799E47BA73D358697EC21DA1B53D072C60D3F7FF4ADCEA2D3DBFCBB15A588940952620482319096C886C35
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[Installation]..INSTEXE=teamviewer.exe..

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\teamviewer_Px-yDq1.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3206136
                                                                                                                                                                                                                                      Entropy (8bit):6.336058344982459
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:TEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TYZ:n92bz2Eb6pd7B6bAGx7s333TC
                                                                                                                                                                                                                                      MD5:C2A9A21C0C0BD341958033EA11684FEA
                                                                                                                                                                                                                                      SHA1:D8F4808668013A5FE42D058C88766CE95245C8C3
                                                                                                                                                                                                                                      SHA-256:CE5E277874CF3E662A7835D964F9FB3AAFC1F44DB502B2640F08D1A508F8EAA4
                                                                                                                                                                                                                                      SHA-512:63BD5CBC2ABCEDED8719399DB11C32FBB7EB214355DD1825E778830B352D4945EBD476DC4E08730B15B0BA82C161DEDDF01439ECF5649F2BFA99519BCD289AEF
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...(..`.................:,.........`F,......P,...@...........................1.....2!1...@......@....................-......p-.29....-...............0..-....................................-......................y-.......-......................text.....,.......,................. ..`.itext...(... ,..*....,............. ..`.data........P,......>,.............@....bss.....y....,..........................idata..29...p-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6144
                                                                                                                                                                                                                                      Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                                                                                                      MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                      SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                      SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                      SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\is-MAUM5.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2457016
                                                                                                                                                                                                                                      Entropy (8bit):7.708667186018291
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:6qe3f6aje0NQq5rISAGF6KDaaAexGENRbUgPVlDlp:TSiUNNC7exGa/xlbLP/hp
                                                                                                                                                                                                                                      MD5:EE66976DF0A5C903F5A718ABF3E8AC85
                                                                                                                                                                                                                                      SHA1:318A2ECA8E968701A07F3865D6023B3933E5C30F
                                                                                                                                                                                                                                      SHA-256:0A9F97CF2F9CA211C6986EF572C852B48098D3C6C28020229334AC788339A32D
                                                                                                                                                                                                                                      SHA-512:FB756836AE30F0480ED98F32B409A81B3E0CEDA2A93267A1729497791F9CE7993BF7F72719949AB1130D442F390882CA24CD968BA6A64E47693D089BD529ABBB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...n.._.................P...........^.......p....@.................................R.%...@......@...................@....... ..6....p...H...........O%..-...................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\Helper.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2058752
                                                                                                                                                                                                                                      Entropy (8bit):6.610135572277166
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:FtDCT6XR9MsiubS8JDv6BzxllWR08G2rBqPnkvZ4yEuuk:FQW/DiubdJL6BzxlY08G2rBqPnkJ
                                                                                                                                                                                                                                      MD5:4EB0347E66FA465F602E52C03E5C0B4B
                                                                                                                                                                                                                                      SHA1:FDFEDB72614D10766565B7F12AB87F1FDCA3EA81
                                                                                                                                                                                                                                      SHA-256:C73E53CBB7B98FEAFE27CC7DE8FDAD51DF438E2235E91891461C5123888F73CC
                                                                                                                                                                                                                                      SHA-512:4C909A451059628119F92B2F0C8BCD67B31F63B57D5339B6CE8FD930BE5C9BAF261339FDD9DA820321BE497DF8889CE7594B7BFAADBAA43C694156651BF6C1FD
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........-..~..~..~.....~.....~....~......~.....~....~..~..~.....~.....~......~q....~q....~q.w~..~..~..~q....~Rich..~........................PE..L......b...........!.....d...J............................................................@......................... ..........T........A..........................4...p...............................@............................................text....c.......d.................. ..`.rdata..&I.......J...h..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6144
                                                                                                                                                                                                                                      Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                                                                                                      MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                      SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                      SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                      SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\botva2.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):37888
                                                                                                                                                                                                                                      Entropy (8bit):6.216405702855349
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
                                                                                                                                                                                                                                      MD5:67965A5957A61867D661F05AE1F4773E
                                                                                                                                                                                                                                      SHA1:F14C0A4F154DC685BB7C65B2D804A02A0FB2360D
                                                                                                                                                                                                                                      SHA-256:450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
                                                                                                                                                                                                                                      SHA-512:C6942818B9026DC5DB2D62999D32CF99FE7289F79A28B8345AF17ACF9D13B2229A5E917A48FF1F6D59715BDBCB00C1625E0302ABCFE10CA7E0475762E0A3F41B
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................r........................@.................................................................................................................................................................................................CODE.....p.......r.................. ..`DATA.................v..............@...BSS..................x...................idata...............x..............@....edata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\error.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2422
                                                                                                                                                                                                                                      Entropy (8bit):7.8500590324389306
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:wDrppUOBdVMdsJUOip+ePaJaZLiAxgjN1OEZTR:cprdVMaJUH+ePaJaZLiAxs1HZTR
                                                                                                                                                                                                                                      MD5:EA1797CF79BEA7C5D9946434EDAF980E
                                                                                                                                                                                                                                      SHA1:C340043CB4C147E31C79E94DDD699341AC303E4C
                                                                                                                                                                                                                                      SHA-256:9E1DB37C2E72427064DB09F39C1908053DCCCB7385312D63D2F6E80BA8820AED
                                                                                                                                                                                                                                      SHA-512:2955BD434F149150AEF0F3F87F9AFE5CEC08E60FE665F163E22539AFE00193B9D6F6DE3F511F3B6E80C7F39692EB3EE3BE878B96CA03B5F0EC2E03A425064B99
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....pHYs..........+.....(IDATx..mlS.........$.$q.`+B(...mHPM.*C)mi.U0.....l#...c.....D..V.(l.P..JUHE...e../.K...qmb...s.!N.H.$..$.x..9.....9..s.s..1...w....<.|.....a....0..:.. D....8.......W.^__.n]..v....h-...G.....c+..KA...2$...Z!I.6[].........j...Z....}.b...b..{:..5*.P,....J.... 1..../.....;..........+%8...c...........{VkuRcc...2..cW....`.... ...q.H..W...{.3.V..\.5...B...\f&.......,W.P....F.y.0.P....*.v.4..4...&$.|.c...#M9.@<....6.....?....4.0M8....L.:....R...[..../..|....Q.....L.....n..hM"..f2..Oxc>.$..z......<...2...^M..N..@....@gn..]]G........u.nnn.......s..z..*.(Hp:.?..}C@.X,....bx....$.O.!4.s.I..B|.0.6..O(1qj...}=....1.W:....L...f.n.^o.g...J.A..f....X.....?.rI+(..f..-.>.....32..|....?..^.J...f....g...?....!.1..}Bo.....X..}.....G ...\ ...tk_x.../..1...0+.....G.....9s.d....@..T...T.S.o.@.......w~>..`.......#.........`rr.@...........p.@..2..f.....@B..*.0...rY.6.--.b6...C..}..x{.6...t:..8.|....x........

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\finish.png

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2160
                                                                                                                                                                                                                                      Entropy (8bit):7.849847219042475
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:bdrpIH1BhPIAkArKhCZsnU0qUDngKHhcB+9MxD5jxi27m:h1210f3I3FUDnLcBhhnm
                                                                                                                                                                                                                                      MD5:7AFAF9E0E99FD80FA1023A77524F5587
                                                                                                                                                                                                                                      SHA1:E20C9C27691810B388C73D2CA3E67E109C2B69B6
                                                                                                                                                                                                                                      SHA-256:760B70612BB9BD967C2D15A5133A50CCCE8C0BD46A6464D76875298DCC45DEA0
                                                                                                                                                                                                                                      SHA-512:A090626E7B7F67FB5AA207AAE0CF65C3A27E1B85E22C9728EEE7475BD9BB7375CA93BAAECC662473F9A427B4F505D55F2C61BA36BDA460E4E6947FE22EEDB044
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....pHYs..........+....."IDATx..kl.......aw..Y.e......E...@.2.v..&V)RQ>ZqD"a,..".J+..D%..H.....U.P.JI]..w.v-..E.Dc....A...x.;.{.....]{.;.;.|9......}..s.Rh.u..?..y..Tr..B.T@x...p..........;.d...Q..Z...s.../....#1:..+.tp.f....B...D!....V...MB.EF........*.a......~..~.Cx...C.AJ....oT.GM!@Q....-\.C..FC..!Jh..l.>OR...(.}L...=...U........1..eO.]_hi. .g.2....b[...y.ru.....(.W.BW...N.A.J.Y.....M.J..N.!e#...#...;....L...3.Z.........K...#...........y...V?._.u(i.J....6......p+.....z.r",....z..m..../.p......z......w.a..1D..*|..R.1...N.A...a..d.D..Gj..q...nQ...@.t...a..VD;'DL....).....C...W..='b=..`4|....9F..F./.-9....wH..'Sg.T{.cv.i......'[...b....'[.......CH.'m.|.!9.g.'....~.a.G.q.3..L..K(..`.......)a.I-....}....0..U...XF.y.J..h.>.....L4.....oU...... ..'.#5.9......lf...h\]h......B....6.|.H.v....+..u.?....P|!.~=.2%E..7..o........o.jo!...W=9.Ou$.u.%G.Uu.....~..>..R>.O.'snQu..r..L..x.-#....>.VU....Jj7.....l......Q...-*....;.. ..

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-2ST2J.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):48743
                                                                                                                                                                                                                                      Entropy (8bit):7.952703392311964
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
                                                                                                                                                                                                                                      MD5:4CFFF8DC30D353CD3D215FD3A5DBAC24
                                                                                                                                                                                                                                      SHA1:0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
                                                                                                                                                                                                                                      SHA-256:0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
                                                                                                                                                                                                                                      SHA-512:9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..|.....{l\tO.|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.|.......?..#......2vO....F......@.|..w7].|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`|..?.....?...{..~~........).........`$.......tG....|.n.2..........[..._....e.}.=..<........h.7|?Kg....+

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-49I9G.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):43363312
                                                                                                                                                                                                                                      Entropy (8bit):7.993304973703554
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:n5bTkNde3NvoxYDk49MvgsV7FzV83hUcvPYRYntnwHu/olv1qb:nGedowMRFzV8xZvP+YntnwHib
                                                                                                                                                                                                                                      MD5:D9CC2F111B059473F9AAEA203B42104F
                                                                                                                                                                                                                                      SHA1:30E47AC0CFB7C1FCE7290ECE71BF6994DDCD9935
                                                                                                                                                                                                                                      SHA-256:BAE251109038D2F25EC7EC74BE869A47E9493135D2D5AF37848C5C3EA2F41550
                                                                                                                                                                                                                                      SHA-512:88D153C8A29A2F09C49ABAD0DE354D7ED84ECAA821870FB99795970FCCA9C04E7D5A573AD7238F8C3DA533626A46C64C2BD14150821A0C58264EB055A8B5278D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F..v...F...@...F.Rich..F.........................PE..L....z.W.................^...........0.......p....@..........................`............@.................................(t...........e...........|..8/...........................................................p...............................text...[\.......^.................. ..`.rdata..F....p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc....e.......f...z..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-4TCT3.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):125405
                                                                                                                                                                                                                                      Entropy (8bit):7.996684823256823
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                                                                                                      MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                                                                                                      SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                                                                                                      SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                                                                                                      SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-H8I3C.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):117272
                                                                                                                                                                                                                                      Entropy (8bit):7.9928375793958635
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:3072:9xwxeZJTsemawwm/0agvP01rZ44iZ89C6B8bf11TMd/:D+Osem/jQP0lKTWgd9Md/
                                                                                                                                                                                                                                      MD5:5EF5291810C454A35F76D976105F37CC
                                                                                                                                                                                                                                      SHA1:8CE0CC65AE1786CEF1C545D40D081EDA13239FA6
                                                                                                                                                                                                                                      SHA-256:03E69E8C87732C625DF2F628AC63BD145268F9DEA9C5F3DD3670B1CF349A995C
                                                                                                                                                                                                                                      SHA-512:3BEC461BB3CBBBDB3C05171FCC5AB7E648B2B60D7B811261662F14D35C3836148B14CDA1A3F2BE127C89CC732DE8CF1644D2E55E049EEEB2DA8E397C58CC919E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....IDATx.....eGq'.W..fFa....#.0I.]c.d.......5...v.........v..q...M4`..$...."ym.6..HD.. ..i$........o......3..7......:.s.....DZ.......!.4....S.....5...i..M.M..0{8).,...X_Q..s...w;.$mk..M...<........F<jxL-..^..(pNm...Z4u.p.9..}.T=...6.....C:..R........Q...{....ca..D.O.g.....kp....f]x.8L.M.YS....?KN.4...x....1..H.4(v...)..6..rS.....Q.....ZZX^9c.0.........!D..G.....Z.4.....h..L...`0..(....^.....;...MC.......g........H..k...M;.EY......~S.t..0.?T.k..i:.@y5.C..HGn]..F...w.]~......f..x...e..P....r.....)...].#U....8.....N....k.:m...:(&.....2.6..f.Ty@.HT.=\._.{.....Lu......x...g<....}.O...{...(6hh../.......t.......r... iPx.k...&&;...b...;.gJ..x..3`.e.@........>..$..czY1...".......]Z,...s.....c....2;...........fTd)U.qLS`T<.E1.n..j..,...1.U.i...q......&....L@.{E.....ur..(_KY...sT.D.......'..,... ..cP..KPo.1.H...a.%..S.......D..1..z.....IeV.........a...{Oh..'g...~..X=.7....}j

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-KH153.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6959
                                                                                                                                                                                                                                      Entropy (8bit):7.966758799391185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:R6FT6i3p+0+QHKJ69cSzGMGTV9Uyppg1MxM:oFOTQHKJXyaTVKype1M2
                                                                                                                                                                                                                                      MD5:30100EA3F4315E291F2F639655E85AC1
                                                                                                                                                                                                                                      SHA1:1794FF0D7B796AFED055FB1B5A8B1936CF3E906F
                                                                                                                                                                                                                                      SHA-256:6A44BF6BA64D5414D56A7CE9BB97864C97030872A7C0A56B2AE47F73D15F79F6
                                                                                                                                                                                                                                      SHA-512:FF5CE19BFB1DFA267C770761DB2BEC4136A079A725D9EC8BCCA039555FC25BF38E7C9619DD7067517B4ED3F4C5E1916F4E776E12A638D81E4553259AF06127E1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..yt.E...%...d'...a....3.,..?...?.1.3..0..{..,.!>d[.oY.Or..!.!a` ..p........$...V.e..X..c_u.Z..es$.}.S]U]U....K...Fc.X4..D.c~!r...}4u.^.~...I.F.}.o......;.Rm.M.!....X,..DYD.....Ny...:*.n....'...|.D.G+.7"...>.{D.E....)o.....@.v.....3Wn..hGJ.}2.....bS..5...B(.\..w``6....e..b.....$..[...AII..T|4...'.x....._.6......}x.HI..p..\.p}....?..UL*...H....D.6.@(.W.....r....,R....HP........=.......o^..."..# .z.....t.....D.q7..T..W:..mJ.((.?q.._..{.K.'I.4...Tq.%.9.....2.vRf..$?.w......N..........(a7%....vSX.}.X..uQ...H.....GB..h.P...[ii!.]T.Q?..yJ.M.yg...f....%..MF3.vQ<.Y......%....}.v.6?M..z....P.9.{.u...]#.o......P... OC..Hi.%.g.T.r)p..I.g..).G..D.)".-...p...3...*Y...d..,Ty/.#7>.......|...g.h...3..........|F..../.6>..&.FM..a.8.L.... ....U.$....$.EX......G.K...Z.(..z.?.3.......<...aq..%...@.A1=.....z...........W....za..`.l]U&....w.HX.].(

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\is-OQEJC.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):511969
                                                                                                                                                                                                                                      Entropy (8bit):7.996152621854539
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:bVvrkApG/uBdvBLPzHb4HZDed4fze+xe3/x3y:btkeXv1z74HJtfzeNPx3y
                                                                                                                                                                                                                                      MD5:CD9C77BC5840AF008799985F397FE1C3
                                                                                                                                                                                                                                      SHA1:9B526687A23B737CC9468570FA17378109E94071
                                                                                                                                                                                                                                      SHA-256:26D7704B540DF18E2BCCD224DF677061FFB9F03CAB5B3C191055A84BF43A9085
                                                                                                                                                                                                                                      SHA-512:DE82BD3CBFB66A2EA0CC79E19407B569355AC43BF37EECF15C9EC0693DF31EE480EE0BE8E7E11CC3136C2DF9E7EF775BF9918FE478967EEE14304343042A7872
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:PK.........Y.V*..@I...h.......saBSI.exe..\......6i.%PJ..4.i.h....U.b...kZ...-*.C.+U.pF.`..\....TT.i.J[.ie.......9.Ne..S....w...\(..>..........{....J/7..x..W_q\;G....lq.7s...\.W...J_...o......-W.h...n.\m..:.7.o..\|...7W^wZb..<...-..../..I..7.W.9...@.Ov......W?.>...../....!,WW.'...~......>.F.........}.....}...vC......^.W..e....!.[..<....c5..M..T..nR....\w..U...O..g.....<....'.N.o.....CH..'...o..$...>....H..f..4p.....K.....C.,..c.....}5.3.E..V}]M5.,=.....+e...<mK...Ws.kS'.....}2......w?:.'q.....p..i.7 It.*....zC..[.\...mHle.H.[...............U...M\..u.q..uz....r.j8.'...M...-..m...EU.[......-..b]f3:n.@.p3R8.z.F..Y...../...X...C.p...Z=:..C ......b.X...T"<...@..|1.......j..p<...0...,..p|..C....O.a=.......X...Z.I.........aa..^...Zp"a.U.u......|......A._.[.d.(,#..`.....;.a'V...Z...i .0.x...`.Z,...;.Xx:..A..|...b.]X........n.a8..X....ba...D8... .......p'..j.R".... ......p?..ja...... ..~;.....0T._...I <.[Z?.D.....<...(..a.....>8.^l...

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):29187936
                                                                                                                                                                                                                                      Entropy (8bit):7.992611077292814
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:zzhigC1vaewCYh7AHeNNwbs3N+B8ODqKX4DiYpRw1o5uC:JrC1vMhFDw4OZDqKXUtzw8h
                                                                                                                                                                                                                                      MD5:58EB889F91B5133D5DB88612CA6E5887
                                                                                                                                                                                                                                      SHA1:13AE62947B7E8804227552A32647BB169F6567B6
                                                                                                                                                                                                                                      SHA-256:2170578D619B2CA143DB3E58BB367ACC64D691AB875FF449A40466B5CF4F40C6
                                                                                                                                                                                                                                      SHA-512:2BB69FA7AA07BA23449F21CF6B71AC3E7C27BE0DA5EED88EB589566FFA968D4CE99B41975CF10910BB48CFD64BFDE4A3AF2F35B0CC6D22D6CFB174176C19E26E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w...w...w.......w.......w.......w.......w.......w.......w..4....w.......w...w...w..l....w..l.o..w..l....w..Rich.w..........................PE..d....gbd..........".................D..........@.....................................o....`.....................................................(...........p..L2...X..`...............p.......................(.......8.......................`....................text............................... ..`.rdata..vz.......|..................@..@.data...t1...0......................@....pdata..L2...p...4...6..............@..@_RDATA...............j..............@..@.rsrc..............l..............@..@.reloc...............L..............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1162856
                                                                                                                                                                                                                                      Entropy (8bit):6.592896831755123
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:xoBm5Cq04JaEboVGtDNmCHUJX+va3BR1j0TbcsuefReNbHgYdGcp6S58p0Q894xp:Bo2oVGtDJvva3BR1jxCfReNbHgYdGcQv
                                                                                                                                                                                                                                      MD5:BB7CF61C4E671FF05649BDA83B85FA3D
                                                                                                                                                                                                                                      SHA1:DB3FDEAF7132448D2A31A5899832A20973677F19
                                                                                                                                                                                                                                      SHA-256:9D04462E854EF49BCD6059767248A635912CE0F593521A7CC8AF938E6A027534
                                                                                                                                                                                                                                      SHA-512:63798024E1E22975D1BE1E8BFF828040D046D63DF29F07D6161C868526D5F08451E44B5FA60BFB0C22CF7880ABC03AAEDAFA2C5C844C3AEFF640E6FAC9586AAB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...............................:.................p................................;......e......D............e......;......;.r....;......Rich...................PE..L...]..d.....................d....................@..................................(....@.............................................p...............h.......8.......p...............................@...............(....... ....................text...L........................... ..`.rdata..............................@..@.data...$........~..................@....didat...............R..............@....rsrc...p............T..............@..@.reloc..8............X..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):234936
                                                                                                                                                                                                                                      Entropy (8bit):6.580764795165994
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:y2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh3K0Ko:y0KgGwHqwOOELha+sm2D2+UhngNdK4d
                                                                                                                                                                                                                                      MD5:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                                                                                                      SHA1:6CA3FE45B3CCD41B25D02179B6529FAEDEF7884A
                                                                                                                                                                                                                                      SHA-256:2025C8C2ACC5537366E84809CB112589DDC9E16630A81C301D24C887E2D25F45
                                                                                                                                                                                                                                      SHA-512:2426E54F598E3A4A6D2242AB668CE593D8947F5DDB36ADED7356BE99134CBC2F37323E1D36DB95703A629EF712FAB65F1285D9F9433B1E1AF0123FD1773D0384
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L....m6d.........."..........\...... ........0....@.................................V.....@........................................................Hl..p)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3014144
                                                                                                                                                                                                                                      Entropy (8bit):6.39384693362043
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:fLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvu:dwSi0b67zeCzt0+yO3kS
                                                                                                                                                                                                                                      MD5:4AFC5E8740E48A3A9DEF088703BF320F
                                                                                                                                                                                                                                      SHA1:4D33C70DDE306F1B8FCBC5D29CEA7A7E8D765EB5
                                                                                                                                                                                                                                      SHA-256:88962C0640E0044A29ADBFFB91D71DABAB558FF1AF4E42EBC00B1CC4E90C0F4E
                                                                                                                                                                                                                                      SHA-512:F8538CBD53C10912D40E4D118AB91FDE52642DE5718CBCA9E2DE5D76DFDE13B6832122F64776D098415A320CE64CCA2DB7E6B48FD25C507782D35F714BA2FAA3
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nse7C54.tmp\System.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\Downloads\teamviewer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11264
                                                                                                                                                                                                                                      Entropy (8bit):5.770824470205811
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
                                                                                                                                                                                                                                      MD5:B8992E497D57001DDF100F9C397FCEF5
                                                                                                                                                                                                                                      SHA1:E26DDF101A2EC5027975D2909306457C6F61CFBD
                                                                                                                                                                                                                                      SHA-256:98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
                                                                                                                                                                                                                                      SHA-512:8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nse7C54.tmp\TvGetVersion.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\Downloads\teamviewer.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):212792
                                                                                                                                                                                                                                      Entropy (8bit):6.710515453438483
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:c+dWYjMt9+jA5DhM/YYsP+f7k1No5vw1YoX+hYsQy2zr9GQHV/6SxR:nWYj+9TDhMQYs6k3o+1XT3r9HVL
                                                                                                                                                                                                                                      MD5:88C2C2A3DEF9F002E24164212BB6884C
                                                                                                                                                                                                                                      SHA1:DAD09D3B81AC093C5DA7823060B292E4F9605F32
                                                                                                                                                                                                                                      SHA-256:DD714698383FC44DE094FF9A8F97709AA8F44A76D06A5DCF434913A1DEBD4C44
                                                                                                                                                                                                                                      SHA-512:FB31D81E0F3242DA337BA8B0159793DB35D248106F5069B44A5D103939F3CFF33FF44E1B57F3D41E500E78D479B6A98582602FCE157298D2576D4814CC34DED1
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........).b.H.1.H.1.H.1.>r1.H.1.0J1.H.1.H.1/H.1..G1.H.1..s1.H.1.k.1.H.1..r1.H.1..B1.H.1..C1.H.1..D1.H.1Rich.H.1........................PE..L...;.|c...........!.....2..........H........P......................................|5....@.........................`.......<........@..................8/...P.......................................................P...............................text...L1.......2.................. ..`.rdata..~....P.......6..............@..@.data....H..........................@....rsrc........@......................@..@.reloc.. '...P...(..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsi86F3.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):44280882
                                                                                                                                                                                                                                      Entropy (8bit):7.887767020203468
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:786432:uIxbkCYIcHz7Xpcrd+LySQX3Mh2FcVaoHWtFb08sQ8UyD7nCWTFxI:u0wCTqpMILyh3M0sWtFwpfmEzI
                                                                                                                                                                                                                                      MD5:9DBC2C05CDD7A91F5A8A481CC468A0BB
                                                                                                                                                                                                                                      SHA1:8841BFCC2C7E485364A7B2449A7BA7917068BD0B
                                                                                                                                                                                                                                      SHA-256:48C596E816421D66E26690FB899F13922F8C5BF47A5FB9BC433078837FACE44B
                                                                                                                                                                                                                                      SHA-512:BD50A7E49CCDFB1E9F844B824CFE81E688CF8FD2FF6E69AD1FBAFBCFEC9DBFB86860ED33ADA1E7AFA3129BB3DFB84116363D69A84500E2AF8443844CBF5C10B6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview: .#.....,.......................@.........#.!.....#.........................U...i.......................z.......2...........................................................................................................................................................................G...J...............................................................................................................................................................=.......................................................................................................................C.......j.......T.......................................j.......k...q...s.......T.......................................................................................................................).......................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\InstallOptions.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15872
                                                                                                                                                                                                                                      Entropy (8bit):5.470704479865464
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
                                                                                                                                                                                                                                      MD5:033EE34C40E8FA85BF2739BCB2F3E186
                                                                                                                                                                                                                                      SHA1:2CA942F35F77F37DF3FC6097ACAC34F2E77341B7
                                                                                                                                                                                                                                      SHA-256:C91C1796338A265B49039C0B2C7A312D764B99E5174FB2DAE455CA54F8F41EC7
                                                                                                                                                                                                                                      SHA-512:2204E0B8721B8D85C51BD068B1695B16EE096BFC1D1CD5843F48FD04032AEEE2B6A91CE82978A4B3414F3D966EC5B36FB337A4149DAE3A1D0445935D964D247F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....z.W...........!.........`.......+.......0.......................................................................8......X1..................................X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\System.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11776
                                                                                                                                                                                                                                      Entropy (8bit):5.6557532861400945
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
                                                                                                                                                                                                                                      MD5:0FF2D70CFDC8095EA99CA2DABBEC3CD7
                                                                                                                                                                                                                                      SHA1:10C51496D37CECD0E8A503A5A9BB2329D9B38116
                                                                                                                                                                                                                                      SHA-256:982C5FB7ADA7D8C9BC3E419D1C35DA6F05BC5DD845940C179AF3A33D00A36A8B
                                                                                                                                                                                                                                      SHA-512:CB5FC0B3194F469B833C2C9ABF493FCEC5251E8609881B7F5E095B9BD09ED468168E95DDA0BA415A7D8D6B7F0DEE735467C0ED8E52B223EB5359986891BA6E2E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\TvGetVersion.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):231736
                                                                                                                                                                                                                                      Entropy (8bit):6.501157423383711
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Cxk3bYmDGHLQk4h97Dr8TTN/WIKI8NBkAC7cOzgX04h7fKl6zYbpJ/nxw:j3bYmD0ih9fwTTIIKnCDHgL26zqpJC
                                                                                                                                                                                                                                      MD5:93212693138EE84635BAF43345955598
                                                                                                                                                                                                                                      SHA1:14E01E4C6AE4FC82B52B820E62C5353241D1A3F0
                                                                                                                                                                                                                                      SHA-256:86CE1591B184A128ED965F43AE43D1608970065D0BBDF286354B59FF29E87759
                                                                                                                                                                                                                                      SHA-512:F5F373C91FDDADB73CD6BF68E06DE99CDBBA920DE6F88C09344B129B070101DDA4E115EB26C1AFEE13FB26E271B5949773E3512D70A616C8FFB17116C27FAE82
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.../.../.../......./......./....."./......./.....8./....../......./......./......./......./.Rich../.........PE..L...1.|c...........!.....J..........x........`............................................@..........................................................Z..8/...........................................................`...............................text...mI.......J.................. ..`.rdata.......`.......N..............@..@.data....W...0......................@....rsrc................*..............@..@.reloc..z(.......*...0..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\UAC.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18432
                                                                                                                                                                                                                                      Entropy (8bit):5.858723390475489
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:5cdcpry0igQ1Ii1rzn6U4gbfW6irWP+vOg7XRSEi+OPLjte86jugnincl0Nr90Og:WqVibvTh4qnFP+OPEzinclP+
                                                                                                                                                                                                                                      MD5:113C5F02686D865BC9E8332350274FD1
                                                                                                                                                                                                                                      SHA1:4FA4414666F8091E327ADB4D81A98A0D6E2E254A
                                                                                                                                                                                                                                      SHA-256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
                                                                                                                                                                                                                                      SHA-512:E190D1EE50C0B2446B14F0D9994A0CE58F5DBD2AA5D579F11B3A342DA1D4ABF0F833A0415D3817636B237930F314BE54E4C85B4DB4A9B4A3E532980EA9C91284
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......DH.".)lq.)lq.)lq.)mqP)lq.!1q.)lq./jq.)lqT.]q.)lq..hq.)lqRich.)lq........................PE..L...lKPJ...........!.....4...........:.......P......................................i/...............................B..J....:..x....`.......................p..........................................................L............................text...Z3.......4.................. ..`.data........P.......8..............@....rsrc........`.......@..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\UserInfo.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4096
                                                                                                                                                                                                                                      Entropy (8bit):3.2985268507239933
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:qKlqD22TZ4s9XXqQr1wHGzzofD4x/X/3Mbj+cZSoJwhSv3:5Q/RKQruH0pxvcecX+hSv
                                                                                                                                                                                                                                      MD5:9B0DB6A6056E8E51AC35E602AEAB769F
                                                                                                                                                                                                                                      SHA1:B541C6D2635141CDC3A74F59D55DB8DF4A92E7AC
                                                                                                                                                                                                                                      SHA-256:925D80C31702A95D58EDE91EE97FD842DE78CA6DDE69156A6C1A755FBA93CD5C
                                                                                                                                                                                                                                      SHA-512:83FE9D346835940A37E0E0A18D041C9D13FC95A0E9ECE3BC18E555CF0E8E7DDF7B42DBA422B1E55ACE31DB3C9FC807E0B44E93B8F07F5ACB943EAAF77B4F0AC6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L....z.W...........!................j........ ...............................P...................................... "......L ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\advanced_unicode.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1332
                                                                                                                                                                                                                                      Entropy (8bit):3.6031642286014898
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:Q+soqioC/irl1vSCm6a/gC863pXH/aKCo6sSljRF3Cb6LlTQ8CC6Llfnq84RUv:rs4Yx1vEFhaoWXrEJfq86a
                                                                                                                                                                                                                                      MD5:F68824A4130EBAF6BC7AB0F62256D7D7
                                                                                                                                                                                                                                      SHA1:40AF19A0D92B3C9E1A8B1EAAB7D12C69E5DF436A
                                                                                                                                                                                                                                      SHA-256:CD8149A2E89373075EE6DB800B7F2496BACBFE21B23E4A06A3453632503B3965
                                                                                                                                                                                                                                      SHA-512:6A173AAA183BE0E5A516CAD484802DAE1FC53A414F870F93EA846A9EF9F9DF35153766EF632EB5E8CED8F94C2ED09A9DECDF3465D46B0DCC44A6918D88E242CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.6.....R.T.L.=.0.........[.F.i.e.l.d. .2.].....T.y.p.e.=.T.e.x.t.....L.e.f.t.=.1.0.....T.o.p.=.1.4.....R.i.g.h.t.=.1.7.3.....B.o.t.t.o.m.=.2.6.....S.t.a.t.e.=.C.:.\.P.r.o.g.r.a.m.m.e.\.T.e.a.m.V.i.e.w.e.r.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.0.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.7.....T.e.x.t.=.D.e.s.t.i.n.a.t.i.o.n. .d.i.r.:.........[.F.i.e.l.d. .3.].....T.y.p.e.=.B.u.t.t.o.n.....L.e.f.t.=.1.8.9.....T.o.p.=.1.2.....R.i.g.h.t.=.2.6.9.....B.o.t.t.o.m.=.2.7.....T.e.x.t.=.B.r.o.w.s.e...........F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.3.6.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.4.5.....T.e.x.t.=.I.n.s.t.a.l.l. .T.e.a.m.V.i.e.w.e.r. .P.r.i.n.t.e.r. .D.r.i.v.e.r.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.6.4.....T.e.x.t.

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\finish_unicode.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1264
                                                                                                                                                                                                                                      Entropy (8bit):3.530715965349217
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:Q+soh1v05h6KPlUwmCX6sXxoByx2/uwmpCG6sULAQl6R5wJCD6sUqQ8lICx/L1:rss1vqDUwrXxRxMuwM+AQowQtICxT1
                                                                                                                                                                                                                                      MD5:DB0713808219E4D7334171F9E1E6C2BC
                                                                                                                                                                                                                                      SHA1:8D8C463837CFCE60B6F501DD75B398E3C7ED8A06
                                                                                                                                                                                                                                      SHA-256:51B57CF2C70006646A76797CADAA5D014C9FF707DA8A4B4E17BCDFCCC3C00FD8
                                                                                                                                                                                                                                      SHA-512:EF0F8FF01E4F6419BC64AF3A0FADADA15F0C1F23F95A544460DD4FAC83C1DDE3758537FD5F93CC8E3B39A45B310261B3F6511A286D95EE5EDF615EC40AAC08AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.5.....R.T.L.=.0.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.5.....T.o.p.=.2.0.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m. .=. .3.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .u.s.e. .T.e.a.m.V.i.e.w.e.r.?.........[.F.i.e.l.d. .3.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.7.1.....T.e.x.t.=.I. .w.a.n.t. .t.o. .t.e.s.t. .t.h.e. .c.o.m.m.e.r.c.i.a.l. .f.e.a.t.u.r.e.s. .w.i.t.h. .a. .f.r.e.e. .1.4.-.d.a.y. .c.o.m.m.e.r.c.i.a.l. .t.r.i.a.l.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.7.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.8.7.....T.e.x.t.=.I. .w.a.n.t. .t.o. .u.s.e. .t.h.e. .f.r.e.e. .v.e.r.s.i.o.n. .f.o.r. .p.e.r.s.o.n.a.l. .u.s.e.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5...

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\ioSpecial.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):552
                                                                                                                                                                                                                                      Entropy (8bit):3.655791370460627
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:Q+slAm+fpIKiieXtAP9IHauQl33CslECmsCpi8lnMmhXUEZ+lX1APScd5LlcTcpP:Q+samuIfHaHNCsgsSaOQ1APSGLJpDTV9
                                                                                                                                                                                                                                      MD5:9C814A473ED25643CC9BB1F7CF766A81
                                                                                                                                                                                                                                      SHA1:09A81BC8AB8C28FEBD0C7275A7EC3620464A11D8
                                                                                                                                                                                                                                      SHA-256:582286D6DAF032AEA56B205A674505610E241F6180411151EFE23E14E6B0F3D6
                                                                                                                                                                                                                                      SHA-512:E15087E7BDCE5DD4975C8FE774676BEFDADFBCFF8C7DC03720B5D0405FF654B7E8A11EE61383E9DF62545A941BEE8199550624B8C8BF54BA7B43D7A9DCC9ADF0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..[.S.e.t.t.i.n.g.s.]...R.e.c.t.=.1.0.4.4...N.u.m.F.i.e.l.d.s.=.3...R.T.L.=.0.....[.F.i.e.l.d. .1.]...T.y.p.e.=.b.i.t.m.a.p...L.e.f.t.=.0...R.i.g.h.t.=.1.0.9...T.o.p.=.0...B.o.t.t.o.m.=.1.9.3...F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T...T.e.x.t.=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.j.8.7.D.F...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....[.F.i.e.l.d. .2.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5...T.o.p.=.1.0...[.F.i.e.l.d. .3.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5.....

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\linker.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):46080
                                                                                                                                                                                                                                      Entropy (8bit):6.178303301960086
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:vmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//w:vgLFm8OdfwpJS/fqt//w
                                                                                                                                                                                                                                      MD5:4AC3F0AB2E423515ED9C575333342054
                                                                                                                                                                                                                                      SHA1:A3E4F2B2135157F964D471564044B023A64F2532
                                                                                                                                                                                                                                      SHA-256:F223D6C72F86544B358A6301DAF60CCDD86198F32E3447A1860ACF3F59F2DAE9
                                                                                                                                                                                                                                      SHA-512:8FBD5B4989BE51C27FA15AF155D2921BEA9AA5D0557A22D4224256E678DFE7DCAA5F80917A748C31DC9C9A91573E4618E2497CCFD47EEFD7A0FA08C12366A1E5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6e..X6..X6..X6...6..X6..Y6..X6.X.6..X6..%6..X6..66..X6..56..X6.."6..X6..$6..X6.. 6..X6Rich..X6........PE..L......Q...........!.....n...N.......................................................,.................................d......d.......x..............................................................@............................................text....m.......n.................. ..`.rdata..4........ ...r..............@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\modern-wizard.bmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26494
                                                                                                                                                                                                                                      Entropy (8bit):1.9568109962493656
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                                                                                                                                                                                                      MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                                                                                                                                                                                                      SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                                                                                                                                                                                                      SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                                                                                                                                                                                                      SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsArray.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6656
                                                                                                                                                                                                                                      Entropy (8bit):6.182754987468525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mUODeqedh6EHFRA5sX7d7KnnpOKxX22v:2qqedh6EHFRksp7KpFX
                                                                                                                                                                                                                                      MD5:82D49C227928741F6F09C5CEA3BDE9F1
                                                                                                                                                                                                                                      SHA1:B0904368A5E94026D0CA5760D4577236F796051D
                                                                                                                                                                                                                                      SHA-256:8BC5E75BBFA5A8F10526AEC2AF441153B2883D6D288726ED8F7C9AF12A1EE02B
                                                                                                                                                                                                                                      SHA-512:D4F588E3613886E3DAB58330CD69CE7F24C39BE2C4854CC8EDFCEF98E1324926FCDE0D79DF1A8FDF5E2BF9327B17F22A9FA1396568C0ACE4E46D4F548FDC7530
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0.....................................................@.........................$.......X...........X..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsExec.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6656
                                                                                                                                                                                                                                      Entropy (8bit):5.140229856656103
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
                                                                                                                                                                                                                                      MD5:01E76FE9D2033606A48D4816BD9C2D9D
                                                                                                                                                                                                                                      SHA1:E46D8A9ED4D5DA220C81BAF5F1FDB94708E9ABA2
                                                                                                                                                                                                                                      SHA-256:EE052FD5141BF769B841846170AABF0D7C2BB922C74C623C3F109344534F7A70
                                                                                                                                                                                                                                      SHA-512:62EF7095D1BF53354C20329C2CE8546C277AA0E791839C8A24108A01F9483A953979259E0AD04DBCAB966444EE7CDD340F8C9557BC8F98E9400794F2751DC7E0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\nsis7z.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):179712
                                                                                                                                                                                                                                      Entropy (8bit):6.382819581405801
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
                                                                                                                                                                                                                                      MD5:87853C0F20F065793BDC707ECE66190B
                                                                                                                                                                                                                                      SHA1:738E11A9A565923EC75400A0CD4BCE4DB257B21D
                                                                                                                                                                                                                                      SHA-256:66B2F36274DDFEEF35B1D6AE6E5755F834446E5D78A719063347543793987161
                                                                                                                                                                                                                                      SHA-512:FEBFCD11795F4EF0FF3D25CBF1856BE01E7F6423A9F16028C927988C04AB21DE5F0B076D7F4CE9294AA7603C0DB61EA5FFB888AF2E9F7C6A6A11BCABFE9795A2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.I............7y......7y..9...7y..c...........................i.....7y..~...7y......7y......7y......Rich............................PE..L......M...........!.................w....................................... ...................................... {.......q..P.......H.......................0...................................8;..@............................................text............................... ..`.rdata...k.......l..................@..@.data...._...........p..............@....rsrc...H...........................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\start_unicode.ini

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (349), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2476
                                                                                                                                                                                                                                      Entropy (8bit):3.6714176010951047
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:ArTYGhjKiGmTwWf4ViWwXaw3qKD3GqIkT2m:+T5KiXPgVibfrGxfm
                                                                                                                                                                                                                                      MD5:6126DC8C7CE9F6C675C7E04E501ACC04
                                                                                                                                                                                                                                      SHA1:2FEB226187DB601F7003674069BF8304F1E71EDD
                                                                                                                                                                                                                                      SHA-256:DE07D972DDCC6D1B5B0B43E1BBB823C977FCF6FD42BE7E9E6F33CF33FF5B3593
                                                                                                                                                                                                                                      SHA-512:A375A5D311F57C9907BC171A55D5290A05E6D3C4FE0C6F6BD20F252E57B4D8A929CBAEF4BEF0E566FCC5EFD65B9DEA342277D9F9D53FA7EF410A21D18E689DC7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..;. .A.u.t.o.-.g.e.n.e.r.a.t.e.d. .b.y. .E.c.l.i.p.s.e.N.S.I.S. .I.n.s.t.a.l.l.O.p.t.i.o.n.s. .S.c.r.i.p.t. .W.i.z.a.r.d.....;. .3.0...0.1...2.0.0.6. .1.1.:.1.9.:.5.5.....[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.9.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .8.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.1.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .p.r.o.c.e.e.d.?.....H.W.N.D.=.6.6.8.3.8.........[.F.i.e.l.d. .1.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.1.3.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.2.9.....T.e.x.t.=.D.e.f.a.u.l.t. .i.n.s.t.a.l.l.a.t.i.o.n.....S.t.a.t.e.=.1.....F.l.a.g.s.=.G.R.O.U.P.|.N.O.T.I.F.Y.....H.W.N.D.=.1.3.2.3.3.6.........[.F.i.e.l.d. .7.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.1.5.2.....R.i.g.h.t.=.2.1.5.....B.o.t.t.o.m.=.1.6.3.....T.e.x.t.=.S.h.o.w. .a.d.v.a.n.c.e.d. .s.e.t.t.i.n.g.s.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.....H.W.N.D.

                                                                                                                                                                                                                                      C:\Users\user\Downloads\teamviewer.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):43363312
                                                                                                                                                                                                                                      Entropy (8bit):7.993304973703554
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:786432:n5bTkNde3NvoxYDk49MvgsV7FzV83hUcvPYRYntnwHu/olv1qb:nGedowMRFzV8xZvP+YntnwHib
                                                                                                                                                                                                                                      MD5:D9CC2F111B059473F9AAEA203B42104F
                                                                                                                                                                                                                                      SHA1:30E47AC0CFB7C1FCE7290ECE71BF6994DDCD9935
                                                                                                                                                                                                                                      SHA-256:BAE251109038D2F25EC7EC74BE869A47E9493135D2D5AF37848C5C3EA2F41550
                                                                                                                                                                                                                                      SHA-512:88D153C8A29A2F09C49ABAD0DE354D7ED84ECAA821870FB99795970FCCA9C04E7D5A573AD7238F8C3DA533626A46C64C2BD14150821A0C58264EB055A8B5278D
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F.*.....F...G.v.F.*.....F..v...F...@...F.Rich..F.........................PE..L....z.W.................^...........0.......p....@..........................`............@.................................(t...........e...........|..8/...........................................................p...............................text...[\.......^.................. ..`.rdata..F....p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc....e.......f...z..............@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):55
                                                                                                                                                                                                                                      Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                                      MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                                      SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                                      SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                                      SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                                      C:\Windows\System32\icarus_rvrt.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):50048
                                                                                                                                                                                                                                      Entropy (8bit):6.7242310270979555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:80GTBuw+QK1wzf06MEJH9Eh3uilXnK2wYifAPPxWE9tEHx9zFQZ:6TwwjKuf06MEJHShPXnK2w7fePx8jzI
                                                                                                                                                                                                                                      MD5:4E7236C6B0250F15CD2A7B6C0837E96F
                                                                                                                                                                                                                                      SHA1:A6292B400D48B48D5A6C9D399916A79860D1F408
                                                                                                                                                                                                                                      SHA-256:478DCF15F9BD7A3470971C05CCF0E53ED3418D5236E1FDB9DE39BCB1F1B588E5
                                                                                                                                                                                                                                      SHA-512:56B30DFD29F2BCAE85D3A43B0FCD49175E8E7FD63A31B3419EA25B8B902AB69DEB8FECBC32217A2FE19C6733675DFF6DC47A8108F2683B9F22F6F57524F6B05E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s...r..s..r..s...z..s.....s....s...q..s.Rich.s.................PE..d....t.d.........."......J...(...... ..........@..........................................`.................................................Hu..(.......8............t...O...........l...............................................`.. ............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data...............................@....pdata...............h..............@..@.rsrc...8............n..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\bug_report.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4847032
                                                                                                                                                                                                                                      Entropy (8bit):6.519635252550112
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:sMLHHJldomYj0301WmAeyEUyz1kSj4PQCteNOkbBnIQQ9FR8puWuMd7qt/LPQ4zk:28wWSUyWSbBoFRAuWwFw6Ff2p
                                                                                                                                                                                                                                      MD5:38649FFACDA7C9F7176CCFDF11D369D8
                                                                                                                                                                                                                                      SHA1:CF8E7A12F4DD9DD8B5225720244184BEBE8F4DBD
                                                                                                                                                                                                                                      SHA-256:E64E1CEFBDCB5293405A3FE5024C5A627366343689948A40B61103ABD9C794DE
                                                                                                                                                                                                                                      SHA-512:C45A27FC5A33A38A84CB3F26E7528216F5898258D057229C8716FE1C14FE1384250D08C305CE47C0FE9498A0B31AFCDDF8A685741F1F48AB8A2103ED4B67D301
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........kL(]."{]."{]."{.x'z.."{.t.{Q."{.t&zN."{.~'zT."{.t'z*."{.t!zW."{.x!zM."{Tr.{_."{.d&z[."{..&z.."{]."{Q."{..'zu."{..&z\."{.x&zy."{.x#zx."{].#{.."{Iu+z.."{Iu"z\."{Iu.{\."{]..{_."{Iu z\."{Rich]."{........PE..d.....2e.........."....$.R1.. .......V.........@..............................J.....).J...`...........................................?.......?.,....@J.P.....G.LK..H.I.p)...PJ..g....9.......................9.(...p.9.@............p1.p............................text...zP1......R1................. ..`.rdata......p1......V1.............@..@.data........ @.......@.............@....pdata..LK....G..L....G.............@..@_RDATA..\....0J......ZI.............@..@.rsrc...P....@J......\I.............@..@.reloc...g...PJ..h...dI.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\bug_report.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 4847032
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1416796
                                                                                                                                                                                                                                      Entropy (8bit):7.99985206342898
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:nGqsRRTj1yDfl18kJoSQ+ZVUDY61fr1hkNEJWqfeoy+/iVkzOPD5A4z8gz6UCYch:nGTjqfP3ZeUcz1hkifeB+/qkzOyrwCJh
                                                                                                                                                                                                                                      MD5:0B6ACF55679872FCB8DC1F07292DF1B7
                                                                                                                                                                                                                                      SHA1:46A0B7E0C4D3C63EEB50E965F63C11BF7C5A8E5E
                                                                                                                                                                                                                                      SHA-256:056F1D35C8CBFFB203A20DCF14C9D5866B746D20C296051EDB1E73B35E4F51AA
                                                                                                                                                                                                                                      SHA-512:A2E1BDB3CC21A6686417145A183FEDED5451BD9AE60A3EB3C075F22DC319EEBBA2058F813BB25915AAEDE4893EAD0638179EE9C5A82F5E97D5B6A3202499AC43
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...I......&..p.........../D.|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV..5.z:.D...Z...]..F.(...I..u/+g/.B.:dh.t..h.;.t.s.<....e..`....~.PP.....(.s....(..|.].K..<0w....^]......l....1Q.._.E.&...O.S..........a.V@..........0.....[;F.\.*.H..>.^..:=..t...Su...............2.....iKTR=.U.ZL.D.....\vk....6..?{...o.D...."H"KO......q.........oN..pG.s.5....<.....2,aL...,....a.....s...ZX.'..M.&D5(6~t?o....'..w.}.3.....)XL....a.4 cF.5|w~(...d...6h^.'..+....Cz......+...<(.@E q.....y...O...=.Di.z.g.+/.... .`][......8.v..X7m&.4qFg.P.....E<.0V0h;.....r/`.{...wW..... .>E.!.&..f....gN!t..$..>J$<?'q..+...MCD...g...b.......3U....Xx.d..!^........q..x..r......!`)..a......:.P..U.&...c..#ip.U.3.._.....y..P..N..>jl.y....u....a.U.CV|..$....NM.0.O4'.Q#...z.2..h..l%.-.^....U8../Uv.....L...h.%wye..o...F.~..!.W.....v@@VO..s...[^..i..i;)..d...o}|..l.V.....@..AH...]..l>...]'...........m.'X.WW.8k..S.p.2..Hs&..wce.".I..R$..+X.IT..-%.t...z.[I

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\config.def

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):509
                                                                                                                                                                                                                                      Entropy (8bit):5.404008286868016
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:2xpyBjPAcWBjPqyCJYB13Uk7okOfzUoygMovZYZ4kVKnIStk:qpyBj4VBjOJYBRUk8HL6ovZs+n1k
                                                                                                                                                                                                                                      MD5:B11D12DBE5978049F84C29EC4F18696C
                                                                                                                                                                                                                                      SHA1:DABA59951603CE05B5836F849AC402469834AD0E
                                                                                                                                                                                                                                      SHA-256:C064266DEF7923FC26BBE315EF424283A1A6F427C090F2858A3FE055A123AF7C
                                                                                                                                                                                                                                      SHA-512:88803EB75E6B772A8D1D62FCFDD222DE4A3C1E295EDC6F4E52EDB9EEAFA7FE6DF9AEF096960BDA5C669E10C51D742460A71385546AC34585B2EFF55218753F7F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[ui.offer.progress]..url=https://ipm-provider.ff.avast.com/..[ui.offer.actions]..url=https://ipm-provider.ff.avast.com/..[ui.offer.welcome]..url=https://ipm-provider.ff.avast.com/..[common]..report-url=https://analytics.avcdn.net/v4/receive/json/25..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[CrashGuard]..FullDumpFraction=0..[Signature]..Signature=ASWSig2A3347A6BB6F44B62065D07CED1522933F772741E17BBD223A9CD8D832C7EFEAE41B54BDCA06ABD1EDCB5F9F948F9FBF8C6E72D032B37623F8A118835C219A8342ASWSig2A

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\dump_process.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1213880
                                                                                                                                                                                                                                      Entropy (8bit):6.6083157420290135
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:tUCgkCGjKkZs9QrKKUboalbsg/oJxEx4Ih0lhSMXll7iRiPlJkdV4KP:ihLk69yKXoal9/oMx2b9JIV4
                                                                                                                                                                                                                                      MD5:81058D604C247D6EE88316FBE85360C0
                                                                                                                                                                                                                                      SHA1:9D030B38DFB746B08166CA887100429454CCC7CB
                                                                                                                                                                                                                                      SHA-256:71C8D17B7EC93A3681A5E7871DB89E811003DAE88280C39F164F1808C217D79D
                                                                                                                                                                                                                                      SHA-512:1529E7551CC984868DC00C239533EC9C0A1C28E0A95C335D9D5367CBA92817F5EF92404DA3AEBF237EC5859E7C21AF908A1369F388098972E782C72F3D11C1E8
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......=...y..y..y.....u...........m...2.{....k....s.....p.......p.\.{..y..z.....v..y.....m..$..m..x..m.0.x..y.X.{..m..x..Richy..........................PE..d.....2e.........."....$............`..........@....................................?.....`.................................................d........p..`Y..........H\..p)..........$...........................(.......@.......................@....................text............................... ..`.rdata..............................@..@.data........ ...`..................@....pdata...............`..............@..@.didat..P....P......................@..._RDATA..\....`......................@..@.rsrc...`Y...p...Z..................@..@.reloc...............F..............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\dump_process.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 1213880
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):473158
                                                                                                                                                                                                                                      Entropy (8bit):7.999584643378697
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:++Yeps/J1uEzNELXReyWF2/vaCQf55/REyl:+Sps/JBELheyMB7pEyl
                                                                                                                                                                                                                                      MD5:2D7F8CA84D8DDD314CE58009F1F67905
                                                                                                                                                                                                                                      SHA1:D48E09243A505BCA49A5251203A55F416911E46D
                                                                                                                                                                                                                                      SHA-256:857A458F5E8C44D945EA8E339FF720AFCC158ADBE325DDCDD10F9F3074C2C364
                                                                                                                                                                                                                                      SHA-512:AD652159D31559D09CF1BA7785D88B78AA29E5E679EEF65973271B076DA561E8DB42B75D42B6E40F58363ADFD04D4ABF1B2E7EE2506802428C80F8F75B5C2A5C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..........&..p.........../D.|..N...mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X...ar.u....\.n.K...n0.w..T........~8%.....s...(.2.....HP..../..Y...B..J....x....C.....}...g].#y..L.(.K..O..^....9..7A~.O...%..Vn......z..{.. a8.........o......$.<h..Y..p(n#-.t...?...1.7.g....st.,..c...;......a......(..!.)..M. 6..T.c>Z.f.Z`...f..q..wo..._.+C...Z*s.r!.........w..$.T3..{$.,gf..c......b..w..O/d...B.N3.....c8...>....`.&... .It..:..V|i.....U..\.....MKa...D).D.z3....w.QQ.Zg.Qg....zMu.^..D,..D.W....%F.......Bu.My.7km'.........H'uN..^...@..~.+q).'..L.6..RmE..&......O.(..k9..a..jp.....S.#..G.Q.....$.w.....y.....)]......z........O...?..f9}....1.D.../...Z.]V......S$f.22..\..G...n%b*E...zd.r.JH...M............R.,.l2%d<:...B.q ..F....T..nwnP.A../t..5.....a!.l.............i....q.n...; ........l....(.e.[J..h...D+......0..wo$....G...k_...t4..P..u#..U.b`....w.../...I..1...(Y5.....8X..6......R.... ..bW.%r..w.[B.'kf.2K.....3.U.l.Lg....(.ad

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7344064
                                                                                                                                                                                                                                      Entropy (8bit):6.474368524124362
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:Z75x+ifYBKzkbFo3vPtexRl4q5BuvPa4Wg:N5xFfYBS1fPte548Bub/
                                                                                                                                                                                                                                      MD5:9A20D03282B552AAE11F3EBB5C6FE6EC
                                                                                                                                                                                                                                      SHA1:3E517F8239AFF576519F607A49C271AA4297DE4F
                                                                                                                                                                                                                                      SHA-256:E366797102963D17531351F422771A56D6567FDB50A241812222EDE39FF8C5E5
                                                                                                                                                                                                                                      SHA-512:932B5286B74DCDFB7C0E81F401B24C2791DEF63B9935B78112D12F62F633DB289304FDC81EE2EF5EC1557F61CC8C05E4297C0AAC99506DC663FA975CC0A132C0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........d`.............ow..j....{.......{.......{.......{......ow......ow......&k......&k.......}.......p...............p......ow......~p......ow...............z..P....z.......z...............z......Rich............................PE..d...@/2e.........."....$..L...#.......)........@..............................p.......p...`......................................... Mb......Nb.|....Po.......l.....H.o.x)...`p.`.....X.......................X.(.....P.@.............L......Jb......................text...<.L.......L................. ..`.rdata..D.....L.......L.............@..@.data....x....b......|b.............@....pdata........l......Bk.............@..@.didat..p....0o......\n.............@..._RDATA..\....@o......^n.............@..@.rsrc........Po......`n.............@..@.reloc..`....`p......bo.............@..B................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 7344064
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2220583
                                                                                                                                                                                                                                      Entropy (8bit):7.999917899300359
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:U/G4o5xkaJ6/tav5kjKVRWiQicS0MJCz/IJZk3pA475b:U/GD01+5keRBQicSTJCz/IJZk3775b
                                                                                                                                                                                                                                      MD5:404611D3727A35A6ADC617416AAD3665
                                                                                                                                                                                                                                      SHA1:1EECA483D4F95D177B27BAA7796D87335B4D9044
                                                                                                                                                                                                                                      SHA-256:AF281A397087342015CA3CAF427403158DF0744FAFA2D9BCFF7A526CFD68CE41
                                                                                                                                                                                                                                      SHA-512:AC0FB4B69E0C53F3E8B33646737F8708BBF6750F8D22C83FD868848B1A57519403172E309C750DE1AF428273861689E5229F63EA7A1BB8D0A9C3EA973B5366FC
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...p......&..p.........../D.|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f.)w.....G.~...]9..3".1.'.KZ......D...'.n]u..1.@.s.;X....-r.r...]........=7M.4N"(..W:@......."..o...m......JW.........`.K`$...<......1B..n.0. ......K.'.A.>..ja.u.3....:..[.....q.)..9.Q..*s........IJ.&..4...h,m.O..^.$...mJ~|.M...~..-..T..|E*%).}2zv.o..P.^..g.#..%^R.*.x...#.f.:....B.x...j ...x.."Z.8n........W..,..M...I"._.~.u.b....L[r.N@.-D...... *..X.\b.|...XE.l..`.#.....Up5W...DV.]h;sp....,..t..cN_.;................ ....k.....V...Wh%...8..'....=g).~.:...h.....x%1...r.2E..H.$K...-.y.9.~...@.mK,...`.......DjL..'.4d+.MP.#.@....?....m.u.C...0...W.......i.X.M.|X.ma2..U!.<..f...7+^!T.C..~.G.7Z...My.]5Q;pRl....^^G..T......+..v. ...UtG.l.,P`D.s......*.#...C...8.M..O..!..T.p.....q..g.+.8.)......./..q.l..g(dG....ul.]O.i$&..r...}8.B".99..(.?.ibp.6....o....l5tD$i3. X.2..p.q.Fd...8.4.,.......f.%.&.VU....d&.....Mv&....h.4%..0.P..+-`...?....i..5q.D._

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_product.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):809400
                                                                                                                                                                                                                                      Entropy (8bit):6.573990374494777
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:ooLj2W+3WZ1licwT/5C3Qh0lhSMXlP8ZtM:ooLx+3kLirdC1
                                                                                                                                                                                                                                      MD5:A6A744FFE205D820082D365983D49DFA
                                                                                                                                                                                                                                      SHA1:F1D8C40020140AD707666394B457281B52156CA6
                                                                                                                                                                                                                                      SHA-256:5908CBEFE21A5E6518DF8EB8077A1DF8DD8DC3E1449F79557121F92B13DF33EF
                                                                                                                                                                                                                                      SHA-512:23AF2D33DE3B2F35C975107701033474BC3F65FAD96EFDEDD61A9A234EC4B5BC7D7348E313392A99E0BE9DE530DAA8390C9E5941AF8658EB33C584727DF717C6
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.........!.sO..sO..sO.|.J.bsO......sO...K..sO...J..sO...L..sO.|.L..sO.|.K..sO.5.L..sO.5.K..sO.....sO...K.1sO..sO..sO...J..sO.|.I..sO.m.K..sO.|.N..sO..sN..qO...F.<rO...O..sO......sO..s..sO...M..sO.Rich.sO.........................PE..d...//2e.........." ...$.&...@......P................................................a....`A.........................................j......Pk..........x.......<f..H0..p)...........}.......................~..(...@|..@............@...............................text....$.......&.................. ..`.rdata..L<...@...>...*..............@..@.data............H...h..............@....pdata..<f.......h..................@..@_RDATA..\...........................@..@.rsrc...x...........................@..@.reloc............... ..............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_product.dll.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 809400
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):307340
                                                                                                                                                                                                                                      Entropy (8bit):7.99943192939091
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:LLb6XM3IKBhQK5q3I22jC1MFWKLHShyKul8SIKHtXgg:j6Xw/Hq3fu1LrKuyS3tXgg
                                                                                                                                                                                                                                      MD5:A49D47B086CF68E3D0068D448433608A
                                                                                                                                                                                                                                      SHA1:1DAC154F6AD6AB3ACD9B66CA12EF97AF80FFB444
                                                                                                                                                                                                                                      SHA-256:B6C361D05A805328706A6A115CF1FC150E02305D8B10F8A69846BD73164F8009
                                                                                                                                                                                                                                      SHA-512:EC1231C18A66E47B1AA3B3046C7636E3FF3672E51CA37BDAFC623911B5B7F8F39206F3B7812B7B2E20017D4C700E49341F603B9D367BC09349D19DFE65D5AE9C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..Y.......&..p.........../D.|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f..^;[..._...s...Q.O....U.sg..i#..j..K.6.js./....@....Nk{. .Z..d....E.....>m....{U......I...r.....T.EO..pDs.w.....W ...U..j?..j.z....v...../.K?z.k...Fy9v0.J.OP.``..E.y.o..T..{.P..;.!.4.......)..k.W...M*...[.{.~L0.L:H.Fl.w..PQ(.m...&R.r.}.H..*.r...xqa....+......B....P.$p....z..I..7..U.;..)..3...`1v...#...P.....OH...B...U.*...._'.W.t...z.....L.........fg.M.'.......^.v.>ZgN...N*k..u.P....]..W.<.....hi..)...%.%Y.......g..r.{..g<k$..o.7...-.4.l.V.{....^V...}[..Q....P.....'.....Y_c....:.X.+2..t...C0..$../...........G..j.7..Fk.....].n....Z..$`..2..#$.Ge.)..f.Y.*....J[.r....]Q..>e..u..[v.AL..O..q.`.\.'...u<.....y.$.....U.L.=4x.R.o.pf...4.{.i*.......'......9......cww.8......b...Y...E......V..A..n.._<.5..Dm............DE...k.c..%.G...]3.Y.;$.;I.....!4...,.I...C<..$WALn..K+.l.0..P..7.=..:.....{....H.\q.1...5L;v.!L.A.....y<....%9/&`2K.\.I.;_.......|..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_rvrt.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):50048
                                                                                                                                                                                                                                      Entropy (8bit):6.7242310270979555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:80GTBuw+QK1wzf06MEJH9Eh3uilXnK2wYifAPPxWE9tEHx9zFQZ:6TwwjKuf06MEJHShPXnK2w7fePx8jzI
                                                                                                                                                                                                                                      MD5:4E7236C6B0250F15CD2A7B6C0837E96F
                                                                                                                                                                                                                                      SHA1:A6292B400D48B48D5A6C9D399916A79860D1F408
                                                                                                                                                                                                                                      SHA-256:478DCF15F9BD7A3470971C05CCF0E53ED3418D5236E1FDB9DE39BCB1F1B588E5
                                                                                                                                                                                                                                      SHA-512:56B30DFD29F2BCAE85D3A43B0FCD49175E8E7FD63A31B3419EA25B8B902AB69DEB8FECBC32217A2FE19C6733675DFF6DC47A8108F2683B9F22F6F57524F6B05E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s...r..s..r..s...z..s.....s....s...q..s.Rich.s.................PE..d....t.d.........."......J...(...... ..........@..........................................`.................................................Hu..(.......8............t...O...........l...............................................`.. ............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data...............................@....pdata...............h..............@..@.rsrc...8............n..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus_rvrt.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 50048
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26103
                                                                                                                                                                                                                                      Entropy (8bit):7.993771307079847
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:384:RspI7z9vekX1IYi4n8YNfqxcNMT/e0fW5vKG1p6DKFFYFXpGQ8:RKMFX2rSNfscWnfW5VF2pgQ8
                                                                                                                                                                                                                                      MD5:5EA78A3959501E4FA1924B3EA9E1B244
                                                                                                                                                                                                                                      SHA1:AC80A6CE1431A847BEF6368082CFBF55A78C8536
                                                                                                                                                                                                                                      SHA-256:264182E7566F82B33845911D769F7EC3150EFDA17799450FF0C151FA1E6D16E4
                                                                                                                                                                                                                                      SHA-512:B35F00F0F07E42CC77977BF1CD8B26A86758666F0E7A6F4F0EF2EFD6F25D240DEED07C86F267E29CD376A7001423F519BE6E393BD360680A4D05468054134AF9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..........&..p.........../D.|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;.6I\&...A...@...b!~h.7...iXOo..4.m%.......".61..B.....Y...UPt..,....-.-..)...f7Rv..#~O..G..c....b..d.#sw...xj0UeA.]Q.e.A..Ja..?.n..gC.....&.....^,?N......;.X.....l..Fxg.'P.$N.5..Ty.l-S.i..8g..P<-...w.L...*...xgK...(Tm...n.s..H.e.^.h.......R..Q]..1...h|..dJ....o...._...^...........EV...~...........k...C...Cr.q.'.*q.@..x.w...6!.9pu.D%....*...?.#M.........a.w&..H<x .....Rp..*.(O..&W=.q=..`..f.......tv."....(...F.R..Nz...B...xx..qC{'..`..P.h.'p.U..a}...Z..[....}t.9..W.x$i;..|P.lf.M.T.u../.P..?..0...9..Zv.|...0.N..rl.].DSl.......=In..).>.? Q....SA...].....\.f.:........o.U.Ky.;wr.].V.[.:........Q...f../.D..9.<\...d...K.U.....Y^.9E......R....."*O.....L.w.B=..... ...mW.<....)fv<[.S|'B....o......T\'..e...3.|YW.4.a..p.i....$m.%|..c..=V,..Y.n.._8}q.@.'....JO...#O...m.i.s*...e(.1{.z...v8.6..).;Y?.q..`.3.MU.b*...:..Q.....q....0G.....i4v.k...#..[B.\T.._..k.o..R.v..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\product-def.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):56896
                                                                                                                                                                                                                                      Entropy (8bit):5.121067082745384
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:vOtgPgPXIZcgY0NyvnhYYfbVQ9T7G4OEAdy9g4kft9Fcmi5H2mhxpwqi+5J58Rvn:qe8SVGOtO
                                                                                                                                                                                                                                      MD5:1F4E93C7D5A1F0BDCD0A2CCCC0297266
                                                                                                                                                                                                                                      SHA1:D6B9A429146C7D95A2075EDADE7535B24660B337
                                                                                                                                                                                                                                      SHA-256:1F98585D5DC25E2499D4D74DEEF89744DC8DE9CE319C4178243B96B8FBC82828
                                                                                                                                                                                                                                      SHA-512:4578E96D00CB01C0E110721EDEC6FA532AF630522DE8A5E6A0F681371EED8E9EC8042976AE50B52E9BB169968D7668DE66A108148CD97D030EDCC0CC4D0927B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product name="avg-av-vps">..<product-defs>...<config>....<install-folder name="AvVps"/>....<full-name name="AVG Antivirus Vps"/>...</config>..</product-defs>..<group-defs>...<group name="base" mandatory-selected="true">....<action-list op="install">.....<delete-pending-files/>.....<commit-extracted-files>......<important>true</important>.....</commit-extracted-files>.....<expand-vps-version order-base="commit-extracted-files" order="+1">......<important>true</important>.....</expand-vps-version>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg-av]%" exists="true"/>......</post-condition>......<src>%PRODUCT_INST%\*</src>......<dest>%PRODUCT_INST[avg-av]%\defs\%VPS_VERSION%</dest>......<ignore-same-files>true</ignore-same-files>......<move-type>Immediately</move-type>.....</copy-path>....</action-list>....<action-list op="uninstall">.....<commit-extracted-files>......<important>true</important>....

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\product-def.xml.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 56896
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12955
                                                                                                                                                                                                                                      Entropy (8bit):7.986470808559502
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:dRC2HpUavGLVCoV9ngCVQ+5KhjbVBHD6Ib9vmWcHM1L1Nz5yZbW4qZjwvrjHDybR:LCapUJ51rWbVdPb/DzpjwvHO8W62d7
                                                                                                                                                                                                                                      MD5:03E397B8F410ECCA1332444633CF85B2
                                                                                                                                                                                                                                      SHA1:FD5EA916B9F77082CA699EAE4335EA69E8A31F14
                                                                                                                                                                                                                                      SHA-256:CCECE2D04C35841BA7E55ACC2D2CB1530508A918E7090B71F20999346B8D38C9
                                                                                                                                                                                                                                      SHA-512:42ABE75A99C37D029362867927737083D79448A2570B5E8D72FC78F4CDBF8A4AC148A7182BAF018D7EFA38B17A7A7A70793E5EBC8ED125CA149C45776BE04457
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@.@..............f......{3....&.7d..>$....`K...H......8..:_..~...\......>./........%..H.......o...Y....9-.f.P!....p...tC.k.....[...j...7^..1......N8...2....`..D.X.....h.TXhJk]......k...*3...J_..@[...URa.nK'.9W.a..Z.3k/.1e..gF6?.t...~.3e.=........BD....v...G7=..C.zM[B9d^..A...!....3BN3.(`..5T.....ZY&#AM.JA.......lnm.L.`x.......b@.`!...:...ZV.M~.P.%,.p.....Y..X2.oa.\.....}^....>.....7.{R=...3m>......I40Bua......[.q..Fn3j1....#Z...{.P.D...]$.P.yl\v.;..s......0.ha.J.0...8Z2N..D...sx....y......9...w.U..Y..h4.bi\Z.....A`...mE..P..!....l.B..,@...BM..\.+7.....qa.R...W..[|.V@N.5\..V..7...jU.......59..../.{.".o......m.....l'}.ac]q&..5...s.8.o.=.{...,..:....~&,.$...7!.[+.cNu`...O....tp.:8.O.j.N.,....|W[.."4.~.G*.?.z.,...@...Gyp..8$....4.h..H...*.c....o...B/..$[x.....g.u....\..c..\.$....0...%...U..E..#..S.^..,P!O.WJ....|..J...G.&...B.A.v.e."...w.c5%.......3me..".NS!...&SjK)..-:."......k.4Y.....E^..@,U.;/.t....(.\..o.y.m..].yY[...vJ.. .noYT^FM.Q........

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\product-info.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5931
                                                                                                                                                                                                                                      Entropy (8bit):5.107271951547609
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:aV4ZwWBE0rhimhw/h5hJUc9IQjqWSvXoqWDCITPivefWi0V5Q+gNoM:aeZwZ0Fim2/hbJUc9IQGWSvPbITqvefX
                                                                                                                                                                                                                                      MD5:6D5B220A61F09EC828CACAC75BC35AC8
                                                                                                                                                                                                                                      SHA1:0C3F286540E0DFD86D4D0E1AA337B6760381D4F9
                                                                                                                                                                                                                                      SHA-256:B65FB54E98DAB218B6A9C19E7AE3394B4B0118540940A3F00CA69368CB6FD694
                                                                                                                                                                                                                                      SHA-512:7F1AA31168D24E70819DAB4E4E339B87F38209394EAED45D1DA9BEB082BC305443E49477C5E3FEEC8F833540BD197578AFD5D186A87D11BF7ABB315E327B1AEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av-vps</name>..<version>23.10.2702.3679</version>..<build-time>1698402534</build-time>..<inner-version>23102702</inner-version>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>a1fb1bf840d417e6baeaf525ce6f4c4c6ed5e6c669d7f5f35f5832c88c0ff431</sha-256>....<timestamp>1698402472</timestamp>....<size>6571448</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>e366797102963d17531351f422771a56d6567fdb50a241812222ede39ff8c5e5</sha-256>....<timestamp>1698402473</timestamp>....<size>7344064</size>...</file>...<file>....<conditions>.....<o

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\aswOfferTool.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2343864
                                                                                                                                                                                                                                      Entropy (8bit):6.799756934080038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:EKggggMGvxFqA51R48QUTk5AvAfAAEV1rnFTZT0krlGW+:DvxoA51R482Ao7ELxTZT0krg
                                                                                                                                                                                                                                      MD5:61CEBC6B9E393B36D6A89A16EE7CEE9E
                                                                                                                                                                                                                                      SHA1:22997CE4600037BA4618875DC03C4EA04D84E1D6
                                                                                                                                                                                                                                      SHA-256:9FE456AB74B9825AED2E1E42BDFCD80D2C71C70A2B57CC17EDC5AF35E4F092B0
                                                                                                                                                                                                                                      SHA-512:5EB0DBB6A17C16F800FAA716B26FED2F451E81162B30951F3B528AF1B5DC5F9C16E8AD575FB11ED1AE450CB46BD9D1C77F9FEDD4F72709026262F252E4A38C7C
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........Y...8@.8@.8@.BJC.8@.BJE.]8@.5F..8@.5FD.8@.5FC.8@.5FE..8@.BJD.8@.@..8@..MD.18@.8@.8@..VD.8@.BJA.8@.8A.?9@.GI..8@.G@.8@.G..8@.8..8@.GB.8@.Rich.8@.................PE..L...a&.e...............$.............0............@...........................#.......$...@.........................0...............................H.#.p)...0#.....(k.......................k......hj..@...............l............................text...:........................... ..`.rdata...G.......H..................@..@.data...$m... ...H..................@....rsrc................R..............@..@.reloc.......0#.......".............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\aswOfferTool.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 2343864
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):895072
                                                                                                                                                                                                                                      Entropy (8bit):7.999787063091785
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:3/Tliz1mmM6BoCkuim7PiZVNjgx1MDPWxaRqvV4hrJ19vLAzw787gYk8kIhf0356:v5iz1hzTP6qYdTrzyk78ExYfG58Pqy
                                                                                                                                                                                                                                      MD5:29ADE4000DD199A072C72313E8D094D6
                                                                                                                                                                                                                                      SHA1:BB9A9BFDBB22C113E1E7AAC6328D397E8BA3C7D5
                                                                                                                                                                                                                                      SHA-256:BE0FF1C4FEED0F5E3699F4CB741ECAA701C16E5AF2F8C1260A496EABB008B338
                                                                                                                                                                                                                                      SHA-512:03C4032D9355974FF03E4C75912C850DDE719DFFBD57B84710502E5BB21FF91E931690768588C7425797BB11AC615B629BD92763C7A9ECD5EC5FE08DC0A1ABEE
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...#......&..p.........../D.|..N...mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X...av.........A..qNQF..O'..M...B6."......<........z.jw.4..9..A.K"U...fi...IDg.h......q.PY......["..*....z.q.p>..?.k8.'q..\..q....jq..)....-....J....T`. ..3.....@].Y..tu..M~ ].9...hX........kL....+..$....@......M...L#zP....[o....=T.K;......I..........[.N...FB..4..G...bpBF..YFg..B..M@......c....X....IO...-.s.3.....Yp.Y....S.6..wE.N.#....^......n>B.F.g.4..jN.....2K...0q....m.;.3.06......!.=....41:g.Oxug".O..?=.rs+...L..A=.,.S.2......xk..BG...,.I1`..u{...;....EX..dF:nck..V4..G...bz.x..]..}2<%..N....,.%."...WN......aW....i.1=...{NR%..P.......>..7..f....n..A..(B.R.(T....Q..O.w....5p..S.x..X.SxY..Z..._.K.&9.=.....B..lP...........:E.U..k..?..U....y..6..H...W.=..=..MQ..zZ.}wV/....lEx^.YW.{....o.07..v4...sRpD>..@...fz\i>..+%L.`3.{R"..jt....Px@.b<(s...h...U..P.....}..... en..Se}..F.1Y.KX.zZ.9..7..s.2PaK...eq..ySq8..o...{.n.Y.]...2.........Y..... .= ^.R~..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\bug_report.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4847032
                                                                                                                                                                                                                                      Entropy (8bit):6.519886418886043
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:VMLHHJldomYjw3stmiQKWIUyz1kOn4PQOtepOAbBnIQQ9FR8puWuMd7qt/LPQ4zF:vgwmmUyWObBoFRAuWw9sZFf2p
                                                                                                                                                                                                                                      MD5:B1A603C438CC546915BE82D1A193FFD9
                                                                                                                                                                                                                                      SHA1:AC2C1200D4451F781543D85327C8979CE8D8C3B1
                                                                                                                                                                                                                                      SHA-256:F3D41563EF598F824DB6DCE8E182B3110696C20A868329C5BD82F53DB4FA0337
                                                                                                                                                                                                                                      SHA-512:F4D1428E0478A43C2BFF8E78902DF4EDCCCBFE58FDE438DCEC1D7BCBBDD121658CF95A978FB2A893FF3923C1EBB2B98275F7F1BBFB15A997B4219CA47B09D45E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........kL(]."{]."{]."{.x'z.."{.t.{Q."{.t&zN."{.~'zT."{.t'z*."{.t!zW."{.x!zM."{Tr.{_."{.d&z[."{..&z.."{]."{Q."{..'zu."{..&z\."{.x&zy."{.x#zx."{].#{.."{Iu+z.."{Iu"z\."{Iu.{\."{]..{_."{Iu z\."{Rich]."{........PE..d...j&.e.........."....$.R1.. .......V.........@..............................J.......J...`...........................................?.......?.,....@J.P.....G.LK..H.I.p)...PJ..g....9.......................9.(...p.9.@............p1.p............................text...zP1......R1................. ..`.rdata......p1......V1.............@..@.data........ @.......@.............@....pdata..LK....G..L....G.............@..@_RDATA..\....0J......ZI.............@..@.rsrc...P....@J......\I.............@..@.reloc...g...PJ..h...dI.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\config.def

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):679
                                                                                                                                                                                                                                      Entropy (8bit):5.374487617780376
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:2xpyBjPAcWBjPqyCJYBheSfU3Uk7okOfzXy9FQV6UaAAOheMOB94UNfm4k:qpyBj4VBjOJYBBfEUk8HLC9m3OzZNfmp
                                                                                                                                                                                                                                      MD5:31F29F1B6F46769195F001ABD4292EE6
                                                                                                                                                                                                                                      SHA1:55CEE013F168602B2A04AEF6787D4251D4B48318
                                                                                                                                                                                                                                      SHA-256:142967F80C46AE111207ABBD09C3FC23478C9DB7457ECD6BF828F71E7966F938
                                                                                                                                                                                                                                      SHA-512:7736844FCC51A15C4CE108E58B92FC61D2B36BE251566D2DFE2D9ABE742B61DD83FE7A1D1B18DCAE50D1CFD41587F29F156D67B2ABB921709DCA8687C291F2AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[ui.offer.progress]..url=https://ipm-provider.ff.avast.com/..[ui.offer.actions]..url=https://ipm-provider.ff.avast.com/..[ui.offer.welcome]..url=https://ipm-provider.ff.avast.com/..[bugreport]..product_finished_errors=45005..[common]..report-url=https://analytics.avcdn.net/v4/receive/json/25..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[offer.browser.asb]..decision_type=2..download_url=https://cdn-av-download.avgbrowser.com/avg_secure_browser_setup.exe..enable=1..priority=1..ui.offer=welcome..[Signature]..Signature=ASWSig2A29D0DB7B3CB409C4CDAE018DB2F530D70264B769BA0969CD1BBF138F5877A22C4547A7469524BFDBD688DE308654CE81A3B628217192AB4E49C76D6A115033C3ASWSig2A

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\config.def.edat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2194), with CRLF line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18035
                                                                                                                                                                                                                                      Entropy (8bit):5.647824586371176
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Dw9+iXHcV2gJJi0YkdTJ3p+qOlG1srr7dl9D3e7A5obqAY:O+iYJiaJFOlWw/D3es5oGAY
                                                                                                                                                                                                                                      MD5:637DCC5D11B6EB98BDC309EC36701DE8
                                                                                                                                                                                                                                      SHA1:1ED8107B7B5EACCF4A9069BEB53CFB9C0BC88B22
                                                                                                                                                                                                                                      SHA-256:CE0F73CEA417942AFE49F0F902D85EC18AC16A7ED5D3AE758AE825FFB0F7C152
                                                                                                                                                                                                                                      SHA-512:BA4A0323A5EEB9DE9EAC3F8DFFE2CB38FCA840F78E2907C3F50748BCAC14696003CA25D0F7C0EB402C0D3EA0D9125CEFDC479147A1CAC16858C9C072BB3C37A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..[WebmailSignature]..GmailEnabled=0..MaxRequestSize=16384..OutlookEnabled=0..YahooEnabled=0..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=2..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..userLdrModuleFlags=0..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugin]..ATisON=0..DohMode=3..Pinning=0..[OPM]..def_base=e

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\dump_process.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1213880
                                                                                                                                                                                                                                      Entropy (8bit):6.608370550710603
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:PACgkCmLmk9Q9QrKKUboalbsg/oJxEx4Yh0lhSMXll7MSiPlJkdV4K/:4hHkq9yKXoal9/oMxm69JIV4
                                                                                                                                                                                                                                      MD5:36B9397D83C5A7BF33C02D5213BEB1C1
                                                                                                                                                                                                                                      SHA1:792A44D1E5478575E658C304E742E84A13EFF5DA
                                                                                                                                                                                                                                      SHA-256:4246AF29405597481F4D3E6F1E55CF71175E7762E69F97A3470C1253959D768A
                                                                                                                                                                                                                                      SHA-512:5FBA613D021921A603D3462EB50AC767AF867CF3F706132A461A82EEC481309862AC868076F3E9515DA0034110782DE500B27114FCB57B7BBD637B7332D232B9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......=...y..y..y.....u...........m...2.{....k....s.....p.......p.\.{..y..z.....v..y.....m..$..m..x..m.0.x..y.X.{..m..x..Richy..........................PE..d...D&.e.........."....$............`..........@..........................................`.................................................d........p..`Y..........H\..p)..........$...........................(.......@.......................@....................text............................... ..`.rdata..............................@..@.data........ ...`..................@....pdata...............`..............@..@.didat..P....P......................@..._RDATA..\....`......................@..@.rsrc...`Y...p...Z..................@..@.reloc...............F..............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\edition.edat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:Jn:J
                                                                                                                                                                                                                                      MD5:9BF31C7FF062936A96D3C8BD1F8F2FF3
                                                                                                                                                                                                                                      SHA1:F1ABD670358E036C31296E66B3B66C382AC00812
                                                                                                                                                                                                                                      SHA-256:E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
                                                                                                                                                                                                                                      SHA-512:9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:15

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7344064
                                                                                                                                                                                                                                      Entropy (8bit):6.475073805528636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:zzhxeOfs3SHwHF8TjntexRl4mVUuvPa4Wg:vhxpfs3SVPnte54wUub/
                                                                                                                                                                                                                                      MD5:A87978C382EABC0165DB0C7EDC5797B2
                                                                                                                                                                                                                                      SHA1:2D145E3C71549A378DD9ECACBB99FA5F0AD2565F
                                                                                                                                                                                                                                      SHA-256:7794CF36A6228135BEF6581458EEB15D420159596FE2F0EA6296CBB2971089FD
                                                                                                                                                                                                                                      SHA-512:1D1E1212A3BE1A7DC4FB508DAD20A2502217DF2CFBBB8B5AF672E85EF68AAE740C9FAC2095A6082A993127FE210D0635ADA72B2E90D98ABF306C7CA9AC3D5CB4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........d`.............ow..j....{.......{.......{.......{......ow......ow......&k......&k.......}.......p...............p......ow......~p......ow...............z..P....z.......z...............z......Rich............................PE..d..._&.e.........."....$..L...#.......)........@..............................p.....)#p...`......................................... Mb......Nb.|....Po.......l.....H.o.x)...`p.`.....X.......................X.(.....P.@.............L......Jb......................text...<.L.......L................. ..`.rdata..D.....L.......L.............@..@.data....x....b......|b.............@....pdata........l......Bk.............@..@.didat..p....0o......\n.............@..._RDATA..\....@o......^n.............@..@.rsrc........Po......`n.............@..@.reloc..`....`p......bo.............@..B................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_product.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6014392
                                                                                                                                                                                                                                      Entropy (8bit):6.481855729868027
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:DMLgHYldBpyoolheLtE1dzXMrB6ZgYAXUwzmcaFS0qrMOyMiqXrmrkT7RxnZZPUD:UGoVzygLnl1LpRHDwyva
                                                                                                                                                                                                                                      MD5:98E1C0556DBB60FA186052A18A8E23E0
                                                                                                                                                                                                                                      SHA1:382A506F330EB8EF25D36330A8289C0F73F8E5A8
                                                                                                                                                                                                                                      SHA-256:39174C0022763E52089A0A3D3CC047AE80A64244E358E001389F499A8160C579
                                                                                                                                                                                                                                      SHA-512:CC82F73503ABCABE840DFACE0424092F047773233AB033E295F6C1B30C467260790B2285C0CFCA176D506A1E217B421BC1358C5D6E1CB8F4CE233AB1A2D2C110
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......Gb...............q.......w......}......}......}..m...}.......q.......{m.....Uv.....Uv..+............q.......v......m......m.......q..........l....q..$....|..4....|.......|........i......|......Rich............PE..d....&.e.........." ...$..<..2 .....@<#.......................................\......\...`A........................................@.O.......O.h.....[.h....0Y.l...H.[.p)....\.4...PqG......................rG.(....pG.@............0<..............................text...n.<.......<................. ..`.rdata.......0<......"<.............@..@.data....$....P..n....O.............@....pdata..l....0Y......VX.............@..@_RDATA..\.....[.......[.............@..@.rsrc...h.....[.......[.............@..@.reloc..4.....\.......[.............@..B................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_product.dll.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 6014392
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1675280
                                                                                                                                                                                                                                      Entropy (8bit):7.999896428853255
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:UJNNrs21hNKbAE9Ljhn5snOO+j2OUdSITmKJ+msUGRTp:UJNNrsiErvh5sOvoRTmYkUI
                                                                                                                                                                                                                                      MD5:201656CEA6EB0C43CD283456955AF3A9
                                                                                                                                                                                                                                      SHA1:4E694FF5E8808DDD83002763BEE78C712FC66736
                                                                                                                                                                                                                                      SHA-256:0A68E6C021F8B4CC993AA70E1408C59CE4B6F82B2F586A9BAEC9DAC4F586B13B
                                                                                                                                                                                                                                      SHA-512:B903B53B0FBDA4DEFF103979C1F0239426B15F13CBE20A5D63DE36D6B65C897592FD6AA296F853647ECBDD139F3AD8C39FE409E8676A3DB60E2B05E3EE0DC642
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...[......&..p.........../D.|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg.!W8 k..tZ.}....m..*..O..T.>.....N.?._.r.g.;.$..... .Y!a... `cs.l.....P......v..{..HC.....Wb.8....e..b.....8....F.E.0......K..B..P..=,...D.-...FM._....+.S.....I.Fb.@.c..4..@..."N..Kc.....U..T^...C.........5..3.f..2...f....,.&./g..M.'..@.|h...y.....v.#$C..,.D....@.H..s/.zd..9...x.d#L.Y.M-.1.hXz.e..d.8.A...lt:Y.d.....GV....>:....9...._.....bS P.Q....X.>.....H$......>.,q.E....kJ)>$..:6zC*F.{...d..c....j.....%..9.ZR....*......"6Q..&.Y..&......).A.:.SN.O..].mT..)M...Y...a...j..y.>.4.^d...]Q..}d.S........!....{oy..qZ..._....n...7.A.g.d....tLC.s.[.:.%....".2.?.....49.9.I.Fq.qR,....-..q.J....x...RI..Y..>...B./.....y.y.21..e...6..q.B..cS...7@.Y.d.g.d..y).3........Ae..;....I.9....8...bB.=.".|.o..||...S.~.;L...Y......*.C.`r..C=L..wN).....T.|.P.Os...f+.....=...MFh..r.LDa...P_.U....j..2.M../dh?TV.../...=?..f.%{.&......G....'U.FB?..:.. ...(.......9Q.....t..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_rvrt.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):50048
                                                                                                                                                                                                                                      Entropy (8bit):6.7242310270979555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:80GTBuw+QK1wzf06MEJH9Eh3uilXnK2wYifAPPxWE9tEHx9zFQZ:6TwwjKuf06MEJHShPXnK2w7fePx8jzI
                                                                                                                                                                                                                                      MD5:4E7236C6B0250F15CD2A7B6C0837E96F
                                                                                                                                                                                                                                      SHA1:A6292B400D48B48D5A6C9D399916A79860D1F408
                                                                                                                                                                                                                                      SHA-256:478DCF15F9BD7A3470971C05CCF0E53ED3418D5236E1FDB9DE39BCB1F1B588E5
                                                                                                                                                                                                                                      SHA-512:56B30DFD29F2BCAE85D3A43B0FCD49175E8E7FD63A31B3419EA25B8B902AB69DEB8FECBC32217A2FE19C6733675DFF6DC47A8108F2683B9F22F6F57524F6B05E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............s..s..s...r..s..r..s...z..s.....s....s...q..s.Rich.s.................PE..d....t.d.........."......J...(...... ..........@..........................................`.................................................Hu..(.......8............t...O...........l...............................................`.. ............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data...............................@....pdata...............h..............@..@.rsrc...8............n..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_rvrt.exe.lzma

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 50048
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):26103
                                                                                                                                                                                                                                      Entropy (8bit):7.993771307079847
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:384:RspI7z9vekX1IYi4n8YNfqxcNMT/e0fW5vKG1p6DKFFYFXpGQ8:RKMFX2rSNfscWnfW5VF2pgQ8
                                                                                                                                                                                                                                      MD5:5EA78A3959501E4FA1924B3EA9E1B244
                                                                                                                                                                                                                                      SHA1:AC80A6CE1431A847BEF6368082CFBF55A78C8536
                                                                                                                                                                                                                                      SHA-256:264182E7566F82B33845911D769F7EC3150EFDA17799450FF0C151FA1E6D16E4
                                                                                                                                                                                                                                      SHA-512:B35F00F0F07E42CC77977BF1CD8B26A86758666F0E7A6F4F0EF2EFD6F25D240DEED07C86F267E29CD376A7001423F519BE6E393BD360680A4D05468054134AF9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..........&..p.........../D.|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;.6I\&...A...@...b!~h.7...iXOo..4.m%.......".61..B.....Y...UPt..,....-.-..)...f7Rv..#~O..G..c....b..d.#sw...xj0UeA.]Q.e.A..Ja..?.n..gC.....&.....^,?N......;.X.....l..Fxg.'P.$N.5..Ty.l-S.i..8g..P<-...w.L...*...xgK...(Tm...n.s..H.e.^.h.......R..Q]..1...h|..dJ....o...._...^...........EV...~...........k...C...Cr.q.'.*q.@..x.w...6!.9pu.D%....*...?.#M.........a.w&..H<x .....Rp..*.(O..&W=.q=..`..f.......tv."....(...F.R..Nz...B...xx..qC{'..`..P.h.'p.U..a}...Z..[....}t.9..W.x$i;..|P.lf.M.T.u../.P..?..0...9..Zv.|...0.N..rl.].DSl.......=In..).>.? Q....SA...].....\.f.:........o.U.Ky.;wr.].V.[.:........Q...f../.D..9.<\...d...K.U.....Y^.9E......R....."*O.....L.w.B=..... ...mW.<....)fv<[.S|'B....o......T\'..e...3.|YW.4.a..p.i....$m.%|..c..=V,..Y.n.._8}q.@.'....JO...#O...m.i.s*...e(.1{.z...v8.6..).;Y?.q..`.3.MU.b*...:..Q.....q....0G.....i4v.k...#..[B.\T.._..k.o..R.v..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus_ui.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11592120
                                                                                                                                                                                                                                      Entropy (8bit):6.579092922372079
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:jJ9aK4TOtq7qJwlsADfPSo5nagrqNO0L:V9Pbq7qJwls0PBagrqNOc
                                                                                                                                                                                                                                      MD5:0DC17CA800AEA2358E0A565D7FB38299
                                                                                                                                                                                                                                      SHA1:634F5963D0B49B10CE584E122E2E879328FAC8D1
                                                                                                                                                                                                                                      SHA-256:AC47C136E574DA442AD0961667930A5076C3082F98E0EDCB8FBD732D51E3B6CD
                                                                                                                                                                                                                                      SHA-512:5853CFB68C74CF473916F8F19CFDA0DC0299D0F10DCF47A8BC9E022C3F936D9FA8204CE258DD5E7C0F0361E16882C06EE4229199EE927B8DC68C7CB547EC8B15
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........'.._F.._F.._F...4...F...8q.VF...8..KF...8...F...8..SF...4..@F...4...F...:...F...:...F..V>..]F.._F..YF...3..\F...3..^F...(..]F...(..OF...4..jF.._F...E..K9...F..K9..^F..K9s.^F.._F..]F..K9..^F..Rich_F..........PE..d....&.e.........."....$..}...]..... ..........@.............................p..........`.................................................t...................L...H...p)......................................(...`...@............ }.x............................text.....}.......}................. ..`.rdata..p.".. }..."...}.............@..@.data.....3.....n.................@....pdata..L............8..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\product-def.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1272872
                                                                                                                                                                                                                                      Entropy (8bit):5.3949942288945785
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:1FBLzSYiQizFv2okIuzNrGmmaeAjfde0hfHge:1FBtd8vTuzNrGvofU0hfAe
                                                                                                                                                                                                                                      MD5:ABF68F41FD38238488C9984783581B8B
                                                                                                                                                                                                                                      SHA1:F4283041B4A747A2A696D162466335AC59274B7A
                                                                                                                                                                                                                                      SHA-256:1DE662D6A41687462BC259FB9E3BA374EDF79947739CE997D3E9DF297CE6392D
                                                                                                                                                                                                                                      SHA-512:7CCECD2F9B501DAA96F70CC2378C115EAC0E3CD85559B9B25038E374416B9555D526B5B55194808B654132C759B6E874D8D7710F567D6291D20765D2CFCEBFEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\product-info.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9649
                                                                                                                                                                                                                                      Entropy (8bit):5.275866628060874
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:KXjXXliDZwBmNvpgGm8I6AERUc97Qlv1i+FKqJe1oGA0Ny8RzQ2gWwKsVijk:KXb180mNv+GPAj5KCe1xbNyW3kijk
                                                                                                                                                                                                                                      MD5:C19FCBF02140B9AF1A3BA40B3C8586CD
                                                                                                                                                                                                                                      SHA1:B6580C396DFDC265F0A5EADE38BCEFE052538635
                                                                                                                                                                                                                                      SHA-256:FFCC9BB534F4C1DBED3A01008CFA4B0EEA83741CC67010FC518135C0CA397EAF
                                                                                                                                                                                                                                      SHA-512:9801181AE3CE4D47AB8D4218ED64AAD473574F4DC580EE6494BBCA1E4A91975F4F7101DF02F561690135D9642BD95C25278222FB7B670F1BC0042FE0DC82F466
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>23.10.8563.1247</version>..<build-time>1697532238</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4c3e1cdb48f03e9cd05318adadcef0545af250b36b9dbe5c9839985baeb05e0d</sha-256>....<timestamp>1697532136</timestamp>....<size>6571456</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>7794cf36a6228135bef6581458eeb15d420159596fe2f0ea6296cbb2971089fd</sha-256>....<timestamp>1697532137</timestamp>....<size>7344064</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<nam

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\setupui.cont

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      File Type:XZ compressed data, checksum CRC32
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):312724
                                                                                                                                                                                                                                      Entropy (8bit):7.999459609867886
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:EV41wbKO2TLKSLAhJnwDlQIRBsUAjYCUozoM2B1NEOWZKpJtqZTQLLRVLc7SryyR:EVW+KOovEhJCsUAkffLNExKpOT0s7LEn
                                                                                                                                                                                                                                      MD5:053FF55435136DAEBD2F6FAA12FE1831
                                                                                                                                                                                                                                      SHA1:815113C56692EB0819E19BE9A72FA57B3A6BFF3F
                                                                                                                                                                                                                                      SHA-256:F376E9AF363D39E60246C7DCE9C8C9ACCB7DA5DC8D23E54861778C278E60C0D2
                                                                                                                                                                                                                                      SHA-512:0352E13FECE37EA1B326CE6FE1E2556D5E239950372E42D57A4BE509A8F680F19EA720753DD40F904638835E12CF4B75D15145D18BD64015DC5D481BCAD7F2D4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.7zXZ...i".6..!.....#..,.q...].0...?..Lm.K%. .6.X.....L.@#.....n.....=...+..^......XmT"....o..i..^wp.Tp..........uH.u....1W...jZ.`.(C.....J.uu..$....T...0]d.....HAa.!._/.b.....{|.L...W..3Sq..h.T..@N...A.;..J^XS.....;7....+.).C..Y.Uw.[T.w_(-.i.4...r?Y=qR.;.....>.......aDi1..g....6.@.H..0.Y U>.......[m&.N.~0.ns\.......+..{.L...r..Z!..'.t3.k....-w.1.!.~..'.f~......u/[*@.h....X. .j6.....2.b....@.Aj1.8...,.Ofz.b...Aq..e.o.=]..`z!..Y..jQ9.]........TboT.^..[r...........(.O..'.`UG..:"......5......-.'..e.}^.FI..%Y4-.|.._...BlEV.5.f...3.M8*.g...#.=;........7..\K.t.s.".>>.......M..=[(....U....&l..P.....+.".P..R...A....y(\.S<O)j...eb8.UH...D........a...e..A.L..O...vF.dD>..WR.l....%....X.P....C....;...c...k.r.....O.y..;.;..6e\o.F]..#.4D)....a.>..M.N...:...+.Nn.{i..A......Z.._(..Y..Iy:.&.M$.k==..*.N3...q.7.]...l_...R.B...;.A#......V..7../..0.S.)b..z@C...}...B?...@..88...rk.Q#....E..rf.u}..%.".UX.ZzHxx...F.A'?t/*........5...y...|PIWC.Gh..k<.~..t...o(.5j.V

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\12fac158-629c-48a3-8e62-e176bebbb3b8

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 11592120
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3758974
                                                                                                                                                                                                                                      Entropy (8bit):7.999951681815112
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:98304:1OA6B0RzGWziOfUR5fJqxJ8bMh3MdZrHaWpnfnGTFVbQj0:XpRz9iOcfJq8Mh3MDaWlvGhVh
                                                                                                                                                                                                                                      MD5:A176AC1BE3E12A19F0C46B75B25DDC30
                                                                                                                                                                                                                                      SHA1:AFACB85BFF440F91B998B98B152034276034CADC
                                                                                                                                                                                                                                      SHA-256:46A429E2A85808C97CB3785340B60FCBCE6B622F081341E60CD5ADF7DABA54C6
                                                                                                                                                                                                                                      SHA-512:64DB53B689DE540613CD88FFC0FB5BE4BD620DEC44C3F21990280F2B194B822F698D6FA5C4CFE282E477026185286FEC2950C39B4A3796634A5D87F69F350D93
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]............&..p.........../D.|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..8..]....&..z`..c..`Ed....].._.WP..N....:..<..IAY[...R{.rd.c.Iz..l)..9.....$...........?P'....T1....Fu.9..|E.M.,....N...}0..r&w:/..F.....j...`4..4...\...8.DR.j..Q.}...l..o.!.:..MQ..A%.0..%.[g..F.~!P.....`rJ.T.`..=@o....r.!F...`-CAPhq.R.RSD)........A..2.Q......i.....O..6....v.g.;Do....0.....T.....*6..>.I.o..z....!......IYcB..n....V..w[. Et.........H.C.s.Y.....8w......j.7G.pu.o0G..d;.]...l..ptSg....XM.i.....Jn...r.;E.VU,..(.V.....&U..r....f..Q....[:.......>.o$9.2X:....hSaq|.z.vQ.,....\.....B1.1=..P.u..>..4C.sn..o"J...l.(.)f9&q.`..-.g......6/..O.s.O.....Y.8}c.}f-.2.]...........~..1...`........R......"[...p.6..]...P......U.CHV.v.G{.Z..Zt.0X..!....k...{I.. ....4ku.p?....~...)...Dg{BB......;....).Q..zG.a.................2...+.#..)..^<.#...M...!.=...u.&...:.....h.,=. O.h.j.^]..{Z...&(.\].r..q^"...A.. .8&mm+...=8...v.O.+@..W.....y.#q...V..9K".....#

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\32ad3329-2954-40c9-87bd-ac3d83b260cc

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 1213880
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):472983
                                                                                                                                                                                                                                      Entropy (8bit):7.999621173128121
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:12288:fWLMK7hju1ymAJzWSJwy011gDa2iyxqlOlnz15rxoK:fI7hjqHAJDqaDa9ygyXrGK
                                                                                                                                                                                                                                      MD5:A0607769CC8720C43EAF7B05A0212C50
                                                                                                                                                                                                                                      SHA1:2FBF305069A1AC8065F99401EFE013B044B952A9
                                                                                                                                                                                                                                      SHA-256:6E494A03E0D6FDC4EB175E1EF55CB4E27858D745C63C67E1E55354128C229345
                                                                                                                                                                                                                                      SHA-512:CDA1DF39EE6CD6BF40B255B11DCB29CBA6C2FFB0485BE7CD511D508AE880E286C7E9E769DA15DD29E99C8403B9C5F09811F3B6B31FC15B262B8A30B7D633DB2F
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..........&..p.........../D.|..N...mx...6.`....U....U6.2..}.a.Ys..NY..T..:D.0Ww..N...X...ar.u....\.n.K...n0.w..T........~8%.....s...(.2.....HP..../..Y...B..J....x....C.....}...g].#y..G.@!..8u.].o..{..h...S.#....6q......2o.YTf.m.f......!.Kp...`p...6P!...P.Q ...7..6..=.)d.aEs.N...6.6.V..i.S......r..:...#v.#.....T. ,..kv]zFo...Y.beZ4..\DU..n]C.,...c......B#.....1...P|.C...Fl.....[.:. ..+....+b..a.OV....vb.w'..g'].e..[..n.p..>w.H)IT.W.)...n....nQ....^.....i........>E.~....,...2TrI?r.@..g].`.U..R......R...N.x#h......r.R..{.w..F....wsR.O.x..Q[.A}.](..I8.}.Hn..r~._....K..(..F.m..o...@J.C...W<...a.z..T......S;;.br..qu..8>.0.]l.....6.'~..S.N...vU~..:.G........y.gc5F....nq......_.1...q.sz...=.3.W6X.C..pZ.W. u%..Pc.fie{.....t..F9..t...F~a"..N...q......IG[.."u96&..;.N....=N.....p._...Z..Q......|....<.J.*.Vj...K.~..lqp..Ah.6A...ir...lr.....V.....Z.oE.8$~......m3....#q5.g..t.....H.g.{?~...j..R....%...R.|u{!z..A..u..........1P.c...e.WZ.H

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\388c93c1-d0b9-4a82-b568-496d7fd69081

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 4847032
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1415844
                                                                                                                                                                                                                                      Entropy (8bit):7.999866705663655
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:24576:h4PPqpRJmKFgrEmD6oWFpqbSotqjR6GABXWe1mLB3mWtmr7hYAQmyt3UNDyr:h4PiZmKFWEmDyq+JR6tBWgaB3ftmnhYl
                                                                                                                                                                                                                                      MD5:2172190ADA7E15B64D6F3DAA990BE549
                                                                                                                                                                                                                                      SHA1:6CF38464829DA5E6D3C5C144BCFCB6884FC7C4D4
                                                                                                                                                                                                                                      SHA-256:963801FBAB933E4D8B5361EC12FEED902E5D8CD08A0CCF2E772738AE46C11317
                                                                                                                                                                                                                                      SHA-512:102ADB9D29F3F792217168EC9E97071257423935591A522A72202FE14DF824EA4017C1994D640ECA742DE5046884FEE50A8245F95B4E921EBCC83DCDD7F03D34
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...I......&..p.........../D.|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV..5.z:.D...Z...]..F.(...I..u/+g/.B.:dh.t..h.;.t.s.<....e..`....~.PP.....(.s....(..|.].K..<0w....^]......l....1Q.._.E.&....`#.~..yv....:N\.`.]...1.38.M{...y.P.t..~Ce..@E...J|Als..-e.3I....4$...u.>....o..8.l.Z.`.........;.!.*.....M...../..u.n.....A$.Q..Y.....&.$p...9(C......%....3.A:.4.n...x..1q.v...b.`..+f..h`R.&/. .c.2.....0r.y..dpT..p......e8.U_w.!.5%2..5n1......l....Q.\....O....D...mr.?.S*9j...#..J..{.b.....0.......Da...vF....H..j"..nB.8..6....4m3u......8.O.....D.c....$.O.:+..T....3.B.tW....O=.:.D9.-g..P.....w.T.>..Zz"6An.M.....*.J....M...s..|W.K.e9.f.2.d...%...qn\.J/N.4...C@.l.&..z...8.......x..:.e"0_'E.:..&. t>.H..g.mZ.. K.4o.F.k....z.....Eha.Zv...<y..9.6..f.........Y..%...'..?_.M...B.C.....De.?...;.i.|t..._..< q/.....'.u........L(.7L$..u.}.Y..*Y@.\v.U....ey.. .<><.8."..J...^m.....j2......j..."..O.RY.).+...i...H..9.$Q..{...,(..\.E.)..m ^...X.9..G.

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\5512c1de-3853-4f9b-b7bd-be15f0299d82

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 15296
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9561
                                                                                                                                                                                                                                      Entropy (8bit):7.980334307230947
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:HmAMdKXJd6hvLTG+y8XjWlMB5r1ZP37g+L/Qc5khlN2i:nMYd6VmeXKqV1ZP7uH8i
                                                                                                                                                                                                                                      MD5:6B5A05BDB671ED214CE616C8933F3DD5
                                                                                                                                                                                                                                      SHA1:63191E9AEDF21D9D4962E14361B89AB6C29C4214
                                                                                                                                                                                                                                      SHA-256:15F1910F8920F543E0CB4EF3F95E372DC9327328A673E1D4D6A2FFD5CB392D18
                                                                                                                                                                                                                                      SHA-512:ADE79B94FA0DF26C0FDC5F8081FB3CA3DF552F85DE95A41FB1BBD22A676DD42FCEBFF1F563FE767F537052C4370730FDC83AA5F1295DE7EDDDF7FC80681A0BB1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..;.......&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y..mR..O...8.C'.B!...Y...;Pn.,.4Wl.xg........7.Xv.x...Z.I-.....k......H^..;.^.....?..c.qP*..s....x.D..)T......$XA.Z.K..zB..r......kt.,....X.\..c<R'..jmt.y.FLT[..]=...$4..RW.\9.t6.1.s+(>.9...o...`.jD.o....8.^NW...D.....}~.q..W..?J..4...}.....,..-CGe.p.J..0.~L3^.#.}iG...z..:S$...PG......WE';G..u.5........'...;r..u.T.e&..ep\y..l...9..xbW....R..(%&..q..*......)...S..?........{6.._XM.....u..9O.tf 3..u..67dS.Z.O5....<...Q6.....d...pb...E./X..........7..s...Q.@Q.r#.@.....O..e>v..2.[X.'..)eNE.wb:.......i.....C...^..o...Zw.{.d....R...w=U.......j.}..^..U.,..?..+(;..*P....G...)k..h..:y..e...H.5|....q&.?~BeW5....A.A...h..k(..i..+.....L...3..].f.%w..u.....2^...V..Rg.|....M...N<......sR...b .xhva...$...l/I...@w.....:]W...o.Bt.SZ..@.]~.?.L...Q...nk.uT.$f."..o.>.....k)..bL~.......f.q...Zg..N.OQ...H74..n|"..B./..q...aLv........eJ.Q...g*O....^.{..5:...4.*..A~"O

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\6f5f8478-e899-495e-83ae-2defd5d653fe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 1272872
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):137458
                                                                                                                                                                                                                                      Entropy (8bit):7.998649906987011
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:3072:+3Bc4psJIXIoMyp7hjIiVN6r/cTOM6w2xlIUS5MO+YO6ETIldsGqw:+xzxXIT0jIGRORDn3O+vTIldsM
                                                                                                                                                                                                                                      MD5:C4C765BC9080D175CB7824F4E9D14736
                                                                                                                                                                                                                                      SHA1:A006F47C65DDBE21A50D0FACCAA19B25818E1D1F
                                                                                                                                                                                                                                      SHA-256:17F8258161634A2C55C88D3164D1D41EB8C2F8496B0F6DF2CB0B3C523766F959
                                                                                                                                                                                                                                      SHA-512:3F717054F3F00147EACA6D0C5187A2987FD0E7831F921CD70CE7318AD8BFF49C0276C8F54B9CBD2EB4291588C0155FD7E8486A6B5AFD4D2DFB192C01C83FD254
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@.(l.............f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%...*/.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjC*d..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.*@a{....|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V....*.`.U#...\.8.T....C.K.H..#UD.?..#..;..#......P.!...(.QS..v*...>..T.....T...65.vX{l..8.G..E......A.....+.Q...G.<..!k.....f."._...&.t...Dm....wZ.-..W..uX.zb.....Ru..h.-.OV..c.^.l..`..

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\7364a974-5bce-49f1-a616-762f62a206f2

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 312724
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):317112
                                                                                                                                                                                                                                      Entropy (8bit):7.999368198678113
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:IiFbJakFmw5J05I4728FIGaiwPdgmbwlCyRRZX72pwKO:TP9mHID82+0gIwlCADiKt
                                                                                                                                                                                                                                      MD5:B1E352EB58FD17D792FA4C87C053ADA8
                                                                                                                                                                                                                                      SHA1:CA152C01D71D7DEBC2388022667E24249D31D65E
                                                                                                                                                                                                                                      SHA-256:87EF9FD888F9F4275AEE2A1D2177F1EA9EC460FECEA11D879F7977929A2F020D
                                                                                                                                                                                                                                      SHA-512:D29F6E31CA288489D07725842CEA3EE5A4AEF1E768D24FED1AE0538D50A8F15B25F188B1B6B208D17F35612332C5B530743CCEA02DD358178C7DADD3ABF47ABB
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..........~..E..8... .rZ.~0..9.I...T.....<.|q(..n.c..y%=D....# .....HfK......4...yz.E.R8...G5;R.7...i.....'...S.+*^V.W..3..w:..T..l.....A.B.sD..y..>...`..J(Uz......{..SH6y....<M..|.]q.T..< b.H.s.......%g2.6..y.U%.=!.7t.....u...Ak._..7..*C...P...mX+qT...........v:.5...cu....v..u.$g|g'3...?``...E.A./a.@..f...4.=.L.x......|..w....m.|.,[.....6 ..pY.M]<.]..),}vT.....|H..J..+..\..N..{M.....!..2\.......!u..A....!4..._6...~.....U....s...;..n.G..`.N.x...sl..Q..ui~.....-0.z/.{..(@.rJ.+2S`......!k._..(.{1.?.<..Lr....E./..7X......E<QQ.......uL/.......4..8........;....%.Y~}f...j..g....G..HH.....(.e`.fr*<...@.."..V..........t...$.....*sa.?...@.[Zrd...szg>WaR..QT`l..;...Bd.3.P.A5i.}`.E./...k.[L.F.n.....sD{.X..u.0....x.[.u-RiW.M....... L j....\A,....._'..XW.|C.{..A..|.......0`.e\.g..z...R"....<........0.a.:....WO.z..._#..ura...G....K.^..e.w...B4."...%.M.B..>.#2...ZB...8..hEe....<........o.s5?u...o.....8....Q..9.n.:.....x.e@.*1I.5BZ. e.IY3

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\bug_report.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4847032
                                                                                                                                                                                                                                      Entropy (8bit):6.519886418886043
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:49152:VMLHHJldomYjw3stmiQKWIUyz1kOn4PQOtepOAbBnIQQ9FR8puWuMd7qt/LPQ4zF:vgwmmUyWObBoFRAuWw9sZFf2p
                                                                                                                                                                                                                                      MD5:B1A603C438CC546915BE82D1A193FFD9
                                                                                                                                                                                                                                      SHA1:AC2C1200D4451F781543D85327C8979CE8D8C3B1
                                                                                                                                                                                                                                      SHA-256:F3D41563EF598F824DB6DCE8E182B3110696C20A868329C5BD82F53DB4FA0337
                                                                                                                                                                                                                                      SHA-512:F4D1428E0478A43C2BFF8E78902DF4EDCCCBFE58FDE438DCEC1D7BCBBDD121658CF95A978FB2A893FF3923C1EBB2B98275F7F1BBFB15A997B4219CA47B09D45E
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........kL(]."{]."{]."{.x'z.."{.t.{Q."{.t&zN."{.~'zT."{.t'z*."{.t!zW."{.x!zM."{Tr.{_."{.d&z[."{..&z.."{]."{Q."{..'zu."{..&z\."{.x&zy."{.x#zx."{].#{.."{Iu+z.."{Iu"z\."{Iu.{\."{]..{_."{Iu z\."{Rich]."{........PE..d...j&.e.........."....$.R1.. .......V.........@..............................J.......J...`...........................................?.......?.,....@J.P.....G.LK..H.I.p)...PJ..g....9.......................9.(...p.9.@............p1.p............................text...zP1......R1................. ..`.rdata......p1......V1.............@..@.data........ @.......@.............@....pdata..LK....G..L....G.............@..@_RDATA..\....0J......ZI.............@..@.rsrc...P....@J......\I.............@..@.reloc...g...PJ..h...dI.............@..B................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\c03fec4d-c72d-42be-aa27-7b395636eb68

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 7344064
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2220031
                                                                                                                                                                                                                                      Entropy (8bit):7.99991575289602
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:49152:KWwcWTyp+tRc3Yim5fDR0qVGlgLiOA4cbC1MW6+qEvGTa+:KWwx2qrfSqCgeV4cb5WWPa+
                                                                                                                                                                                                                                      MD5:6AAA46341BB03CDCDC70C1A1A15CCBEA
                                                                                                                                                                                                                                      SHA1:7220C1189CCE38A552F1F69FB6F33B61DE8F458A
                                                                                                                                                                                                                                      SHA-256:A58DD457E935D612C7941F245A7DF6C0EEEF801BF65F799DCFB96725DEF3CFB9
                                                                                                                                                                                                                                      SHA-512:ACC8B8E791BF701230F99E4750441509C0C681FB382707F427E7109E462BEDA80E075072461C994EA280B2134D58229AD64E5A0757E59CF2635B8B2401B38534
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@...p......&..p.........../D.|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f.)w.....G.~...]9..3".1.'.KZ......D...'.n]u..1.@.s.;X....-r.r...]........=7M.4N"(..W:@......."..o...m......JW............vG.HDA......+wA..`....yO.m5..2...l..J;......J.&aX....u.....o$>W..u'Ar.2&.~.xx. .R.hD...,.,j.....B8..e)D.....G..)2.SO...j-.4QlD.Mc&..+s.oX.tC.....ew...*xTh..u.G..S.,.B.r).w..8..Q....F.5.KBg.....i}Ly..K9~h..a..<..O.ca'.Y.bs.$4.y.m.5.....!]..... ..G......?.|..>'G...0....x..Md...I*.Q.%..?_q.....d=.3.|B.H...q.bn...h..p..DJ.Tn9)...@.s......SM....d...2.qw0....:9Q.1Y..P..E..V.@/_GF....O..%....S..<.).....h.8....{A...|sP..9.A..i.e....@oa@.z.~...{.nMQ..'.;.}...J........a..{.UC,.!.%4L...jM..o.......x...q.d.W3m..?..z...r..a....j...2...C......`....:..C.R.4..x..N.....I...Z.'5.{.TSN~C.5.+...^...(*.[E.<p\.....d.+.Z.P..E..P..Z<.........![{.S5.7.\..f.jTT...{...w..?^.....).%......ZA....dR"..KU.m.km.)...h......)t.c.n!....J...s........O+..6

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\db73fa74-0672-4c46-99c2-319cc2d1c20d

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:LZMA compressed data, non-streamed, size 15296
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9561
                                                                                                                                                                                                                                      Entropy (8bit):7.980334307230947
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:HmAMdKXJd6hvLTG+y8XjWlMB5r1ZP37g+L/Qc5khlN2i:nMYd6VmeXKqV1ZP7uH8i
                                                                                                                                                                                                                                      MD5:6B5A05BDB671ED214CE616C8933F3DD5
                                                                                                                                                                                                                                      SHA1:63191E9AEDF21D9D4962E14361B89AB6C29C4214
                                                                                                                                                                                                                                      SHA-256:15F1910F8920F543E0CB4EF3F95E372DC9327328A673E1D4D6A2FFD5CB392D18
                                                                                                                                                                                                                                      SHA-512:ADE79B94FA0DF26C0FDC5F8081FB3CA3DF552F85DE95A41FB1BBD22A676DD42FCEBFF1F563FE767F537052C4370730FDC83AA5F1295DE7EDDDF7FC80681A0BB1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:]..@..;.......&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y..mR..O...8.C'.B!...Y...;Pn.,.4Wl.xg........7.Xv.x...Z.I-.....k......H^..;.^.....?..c.qP*..s....x.D..)T......$XA.Z.K..zB..r......kt.,....X.\..c<R'..jmt.y.FLT[..]=...$4..RW.\9.t6.1.s+(>.9...o...`.jD.o....8.^NW...D.....}~.q..W..?J..4...}.....,..-CGe.p.J..0.~L3^.#.}iG...z..:S$...PG......WE';G..u.5........'...;r..u.T.e&..ep\y..l...9..xbW....R..(%&..q..*......)...S..?........{6.._XM.....u..9O.tf 3..u..67dS.Z.O5....<...Q6.....d...pb...E./X..........7..s...Q.@Q.r#.@.....O..e>v..2.[X.'..)eNE.wb:.......i.....C...^..o...Zw.{.d....R...w=U.......j.}..^..U.,..?..+(;..*P....G...)k..h..:y..e...H.5|....q&.?~BeW5....A.A...h..k(..i..+.....L...3..].f.%w..u.....2^...V..Rg.|....M...N<......sR...b .xhva...$...l/I...@w.....:]W...o.Bt.SZ..@.]~.?.L...Q...nk.uT.$f."..o.>.....k)..bL~.......f.q...Zg..N.OQ...H74..n|"..B./..q...aLv........eJ.Q...g*O....^.{..5:...4.*..A~"O

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\dump_process.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1213880
                                                                                                                                                                                                                                      Entropy (8bit):6.608370550710603
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:PACgkCmLmk9Q9QrKKUboalbsg/oJxEx4Yh0lhSMXll7MSiPlJkdV4K/:4hHkq9yKXoal9/oMxm69JIV4
                                                                                                                                                                                                                                      MD5:36B9397D83C5A7BF33C02D5213BEB1C1
                                                                                                                                                                                                                                      SHA1:792A44D1E5478575E658C304E742E84A13EFF5DA
                                                                                                                                                                                                                                      SHA-256:4246AF29405597481F4D3E6F1E55CF71175E7762E69F97A3470C1253959D768A
                                                                                                                                                                                                                                      SHA-512:5FBA613D021921A603D3462EB50AC767AF867CF3F706132A461A82EEC481309862AC868076F3E9515DA0034110782DE500B27114FCB57B7BBD637B7332D232B9
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......=...y..y..y.....u...........m...2.{....k....s.....p.......p.\.{..y..z.....v..y.....m..$..m..x..m.0.x..y.X.{..m..x..Richy..........................PE..d...D&.e.........."....$............`..........@..........................................`.................................................d........p..`Y..........H\..p)..........$...........................(.......@.......................@....................text............................... ..`.rdata..............................@..@.data........ ...`..................@....pdata...............`..............@..@.didat..P....P......................@..._RDATA..\....`......................@..@.rsrc...`Y...p...Z..................@..@.reloc...............F..............@..B........................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7344064
                                                                                                                                                                                                                                      Entropy (8bit):6.475073805528636
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:98304:zzhxeOfs3SHwHF8TjntexRl4mVUuvPa4Wg:vhxpfs3SVPnte54wUub/
                                                                                                                                                                                                                                      MD5:A87978C382EABC0165DB0C7EDC5797B2
                                                                                                                                                                                                                                      SHA1:2D145E3C71549A378DD9ECACBB99FA5F0AD2565F
                                                                                                                                                                                                                                      SHA-256:7794CF36A6228135BEF6581458EEB15D420159596FE2F0EA6296CBB2971089FD
                                                                                                                                                                                                                                      SHA-512:1D1E1212A3BE1A7DC4FB508DAD20A2502217DF2CFBBB8B5AF672E85EF68AAE740C9FAC2095A6082A993127FE210D0635ADA72B2E90D98ABF306C7CA9AC3D5CB4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........d`.............ow..j....{.......{.......{.......{......ow......ow......&k......&k.......}.......p...............p......ow......~p......ow...............z..P....z.......z...............z......Rich............................PE..d..._&.e.........."....$..L...#.......)........@..............................p.....)#p...`......................................... Mb......Nb.|....Po.......l.....H.o.x)...`p.`.....X.......................X.(.....P.@.............L......Jb......................text...<.L.......L................. ..`.rdata..D.....L.......L.............@..@.data....x....b......|b.............@....pdata........l......Bk.............@..@.didat..p....0o......\n.............@..._RDATA..\....@o......^n.............@..@.rsrc........Po......`n.............@..@.reloc..`....`p......bo.............@..B................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_mod.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15296
                                                                                                                                                                                                                                      Entropy (8bit):6.94926345429301
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:vNPw/U+88IYiifmJdOAM+o/8E9VF0NyO7t:0U+MYiiIOAMxkE2t
                                                                                                                                                                                                                                      MD5:D44D74A4762092D60D8890F17EC9923E
                                                                                                                                                                                                                                      SHA1:85D3279721F2F88790FDAA3C57E73170C64E2B51
                                                                                                                                                                                                                                      SHA-256:ED051B68024077E7B870548A54887574ECFEFA3B18159FC2AB8B96EE6BB895A2
                                                                                                                                                                                                                                      SHA-512:34B483ED52FEB579A069242FC1A9A3027E44A7310498EB9E30430B38DC50D31F2DE00FE057C57B4E52D5954161874853B130097E9110E684F553A979519BE843
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..!..!..!.....$..!..'..5.. ..5.. ..5.*. ..5.. ..Rich!..........................PE..L....%.e...........!...$..................... ...............................P.......6....@E........................ !..\....#..<....0..............H...x)...@..(.... ............................................... .. ............................text...e........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus_ui.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11592120
                                                                                                                                                                                                                                      Entropy (8bit):6.579092922372079
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:196608:jJ9aK4TOtq7qJwlsADfPSo5nagrqNO0L:V9Pbq7qJwls0PBagrqNOc
                                                                                                                                                                                                                                      MD5:0DC17CA800AEA2358E0A565D7FB38299
                                                                                                                                                                                                                                      SHA1:634F5963D0B49B10CE584E122E2E879328FAC8D1
                                                                                                                                                                                                                                      SHA-256:AC47C136E574DA442AD0961667930A5076C3082F98E0EDCB8FBD732D51E3B6CD
                                                                                                                                                                                                                                      SHA-512:5853CFB68C74CF473916F8F19CFDA0DC0299D0F10DCF47A8BC9E022C3F936D9FA8204CE258DD5E7C0F0361E16882C06EE4229199EE927B8DC68C7CB547EC8B15
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$........'.._F.._F.._F...4...F...8q.VF...8..KF...8...F...8..SF...4..@F...4...F...:...F...:...F..V>..]F.._F..YF...3..\F...3..^F...(..]F...(..OF...4..jF.._F...E..K9...F..K9..^F..K9s.^F.._F..]F..K9..^F..Rich_F..........PE..d....&.e.........."....$..}...]..... ..........@.............................p..........`.................................................t...................L...H...p)......................................(...`...@............ }.x............................text.....}.......}................. ..`.rdata..p.".. }..."...}.............@..@.data.....3.....n.................@....pdata..L............8..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\product-def.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1272872
                                                                                                                                                                                                                                      Entropy (8bit):5.3949942288945785
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:1FBLzSYiQizFv2okIuzNrGmmaeAjfde0hfHge:1FBtd8vTuzNrGvofU0hfAe
                                                                                                                                                                                                                                      MD5:ABF68F41FD38238488C9984783581B8B
                                                                                                                                                                                                                                      SHA1:F4283041B4A747A2A696D162466335AC59274B7A
                                                                                                                                                                                                                                      SHA-256:1DE662D6A41687462BC259FB9E3BA374EDF79947739CE997D3E9DF297CE6392D
                                                                                                                                                                                                                                      SHA-512:7CCECD2F9B501DAA96F70CC2378C115EAC0E3CD85559B9B25038E374416B9555D526B5B55194808B654132C759B6E874D8D7710F567D6291D20765D2CFCEBFEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\product-info.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9649
                                                                                                                                                                                                                                      Entropy (8bit):5.275866628060874
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:KXjXXliDZwBmNvpgGm8I6AERUc97Qlv1i+FKqJe1oGA0Ny8RzQ2gWwKsVijk:KXb180mNv+GPAj5KCe1xbNyW3kijk
                                                                                                                                                                                                                                      MD5:C19FCBF02140B9AF1A3BA40B3C8586CD
                                                                                                                                                                                                                                      SHA1:B6580C396DFDC265F0A5EADE38BCEFE052538635
                                                                                                                                                                                                                                      SHA-256:FFCC9BB534F4C1DBED3A01008CFA4B0EEA83741CC67010FC518135C0CA397EAF
                                                                                                                                                                                                                                      SHA-512:9801181AE3CE4D47AB8D4218ED64AAD473574F4DC580EE6494BBCA1E4A91975F4F7101DF02F561690135D9642BD95C25278222FB7B670F1BC0042FE0DC82F466
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>23.10.8563.1247</version>..<build-time>1697532238</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4c3e1cdb48f03e9cd05318adadcef0545af250b36b9dbe5c9839985baeb05e0d</sha-256>....<timestamp>1697532136</timestamp>....<size>6571456</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>7794cf36a6228135bef6581458eeb15d420159596fe2f0ea6296cbb2971089fd</sha-256>....<timestamp>1697532137</timestamp>....<size>7344064</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<nam

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\setupui.cont

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:XZ compressed data, checksum CRC32
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):312724
                                                                                                                                                                                                                                      Entropy (8bit):7.999459609867886
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:6144:EV41wbKO2TLKSLAhJnwDlQIRBsUAjYCUozoM2B1NEOWZKpJtqZTQLLRVLc7SryyR:EVW+KOovEhJCsUAkffLNExKpOT0s7LEn
                                                                                                                                                                                                                                      MD5:053FF55435136DAEBD2F6FAA12FE1831
                                                                                                                                                                                                                                      SHA1:815113C56692EB0819E19BE9A72FA57B3A6BFF3F
                                                                                                                                                                                                                                      SHA-256:F376E9AF363D39E60246C7DCE9C8C9ACCB7DA5DC8D23E54861778C278E60C0D2
                                                                                                                                                                                                                                      SHA-512:0352E13FECE37EA1B326CE6FE1E2556D5E239950372E42D57A4BE509A8F680F19EA720753DD40F904638835E12CF4B75D15145D18BD64015DC5D481BCAD7F2D4
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.7zXZ...i".6..!.....#..,.q...].0...?..Lm.K%. .6.X.....L.@#.....n.....=...+..^......XmT"....o..i..^wp.Tp..........uH.u....1W...jZ.`.(C.....J.uu..$....T...0]d.....HAa.!._/.b.....{|.L...W..3Sq..h.T..@N...A.;..J^XS.....;7....+.).C..Y.Uw.[T.w_(-.i.4...r?Y=qR.;.....>.......aDi1..g....6.@.H..0.Y U>.......[m&.N.~0.ns\.......+..{.L...r..Z!..'.t3.k....-w.1.!.~..'.f~......u/[*@.h....X. .j6.....2.b....@.Aj1.8...,.Ofz.b...Aq..e.o.=]..`z!..Y..jQ9.]........TboT.^..[r...........(.O..'.`UG..:"......5......-.'..e.}^.FI..%Y4-.|.._...BlEV.5.f...3.M8*.g...#.=;........7..\K.t.s.".>>.......M..=[(....U....&l..P.....+.".P..R...A....y(\.S<O)j...eb8.UH...D........a...e..A.L..O...vF.dD>..WR.l....%....X.P....C....;...c...k.r.....O.y..;.;..6e\o.F]..#.4D)....a.>..M.N...:...+.Nn.{i..A......Z.._(..Y..Iy:.&.M$.k==..*.N3...q.7.]...l_...R.B...;.A#......V..7../..0.S.)b..z@C...}...B?...@..88...rk.Q#....E..rf.u}..%.".UX.ZzHxx...F.A'?t/*........5...y...|PIWC.Gh..k<.~..t...o(.5j.V

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\ecoo.edat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                                                      Entropy (8bit):3.422577995321604
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:1HRcMK:5RU
                                                                                                                                                                                                                                      MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                                                                                                      SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                                                                                                      SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                                                                                                      SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                                                                                                      C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\icarus-info.xml

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1910
                                                                                                                                                                                                                                      Entropy (8bit):5.383437158213508
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cEDn8Zf4888picW+PyNQshYRWN1lVRb2lEkZxM:H8J88ocr6usysvVZ2FZxM
                                                                                                                                                                                                                                      MD5:F12D8E185DDEA9AEF66232D225A84D3B
                                                                                                                                                                                                                                      SHA1:0601FC706B60B1A9117095E0C184936E140CC7F0
                                                                                                                                                                                                                                      SHA-256:AC97C94B167CD77B205502271EFD7B57805D96F5FD042D4EFEC691168EF55E92
                                                                                                                                                                                                                                      SHA-512:66D3C0860779CD5E5FF8258C1A292704F9946AD87132ACF66444444EF8E2B05ACE39A9DC9C9CAF92DA69B71820C72A25D4EAF13A26C80B51FBCF21B8BCAD5B13
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.<icarus-info xmlns:xs="http://www.w3.org/2001/XMLSchema-instance">..<file-list>...<file>....<alias>sfx-info.xml</alias>....<sha-256>6cbcad3e334a2fcf3d27277f31d7851af2150f0501f2eb5d42e05bf7a76c82e1</sha-256>....<offset>1422406</offset>....<size>722</size>....<timestamp>1697546854</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\edition.edat</alias>....<sha-256>e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb</sha-256>....<offset>1423205</offset>....<size>2</size>....<timestamp>1697546854</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av\config.def.edat</alias>....<sha-256>ce0f73cea417942afe49f0f902d85ec18ac16a7ed5d3ae758ae825ffb0f7c152</sha-256>....<offset>1423287</offset>....<size>7052</size>....<timestamp>1697546646</timestamp>....<flags>1</flags>...</file>..</file-list>..<file-mapping-sfx>...<handle>268</handle>...<size>1441080</size>..</file-mapping-sfx>..<sfx-cmd>/silent /ws /psh:92pTtVrLghU

                                                                                                                                                                                                                                      C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1441080
                                                                                                                                                                                                                                      Entropy (8bit):6.827132320938308
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:XHiwCKmgQjoYRhooooE3IMjRIOpMIIWY1i5uh0lhSMXlhrc4e4R0VQ:XbCvo2ooooE3HkIIWY1C7V9e4aVQ
                                                                                                                                                                                                                                      MD5:3817B172EA2CEF28D73F746A40F3B275
                                                                                                                                                                                                                                      SHA1:947D370B83F6A7B610D71FD160BAD8DC20945AD6
                                                                                                                                                                                                                                      SHA-256:C9AA60DE460979031467C0C33B4EB2D93AD822280CAAE17A39F23AC8699E8DF0
                                                                                                                                                                                                                                      SHA-512:BAD56A45B06D43C02CBFBB257517BD4AD6CDE5E189B91C0BEC569600FF3EB5F2D99B67E08D52B033A4E7EDD9AF5C5D3F0DAFB286133CDAB4F24D5CD2DB374FF2
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........&"..GLE.GLE.GLE<5OD.GLE<5IDQGLEK9.E.GLEK9HD.GLEK9OD.GLEK9ID.GLE<5HD.GLEu)HD.GLE.?.E.GLE.2ID.GLE.GLE.GLE<5KD.GLE<5MD.GLE.GME@FLE.8EDyGLE.8LD.GLE.8.E.GLE.G.E.GLE.8ND.GLERich.GLE................PE..L....&.e...............$.....j......p.............@.......................... .......*....@..............................................r..............p)...`........................................@...............p...,........................text...z........................... ..`.rdata..............................@..@.data...p...........................@....didat..T...........................@....rsrc....r.......t..................@..@.reloc......`......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\asw.754e841b27ded488\ecoo.edat

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21
                                                                                                                                                                                                                                      Entropy (8bit):3.422577995321604
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:1HRcMK:5RU
                                                                                                                                                                                                                                      MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                                                                                                      SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                                                                                                      SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                                                                                                      SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                                                                                                      C:\Windows\Temp\nscC342.tmp\System.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11776
                                                                                                                                                                                                                                      Entropy (8bit):5.6557532861400945
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
                                                                                                                                                                                                                                      MD5:0FF2D70CFDC8095EA99CA2DABBEC3CD7
                                                                                                                                                                                                                                      SHA1:10C51496D37CECD0E8A503A5A9BB2329D9B38116
                                                                                                                                                                                                                                      SHA-256:982C5FB7ADA7D8C9BC3E419D1C35DA6F05BC5DD845940C179AF3A33D00A36A8B
                                                                                                                                                                                                                                      SHA-512:CB5FC0B3194F469B833C2C9ABF493FCEC5251E8609881B7F5E095B9BD09ED468168E95DDA0BA415A7D8D6B7F0DEE735467C0ED8E52B223EB5359986891BA6E2E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\nscC342.tmp\nsArray.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6656
                                                                                                                                                                                                                                      Entropy (8bit):6.182754987468525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mUODeqedh6EHFRA5sX7d7KnnpOKxX22v:2qqedh6EHFRksp7KpFX
                                                                                                                                                                                                                                      MD5:82D49C227928741F6F09C5CEA3BDE9F1
                                                                                                                                                                                                                                      SHA1:B0904368A5E94026D0CA5760D4577236F796051D
                                                                                                                                                                                                                                      SHA-256:8BC5E75BBFA5A8F10526AEC2AF441153B2883D6D288726ED8F7C9AF12A1EE02B
                                                                                                                                                                                                                                      SHA-512:D4F588E3613886E3DAB58330CD69CE7F24C39BE2C4854CC8EDFCEF98E1324926FCDE0D79DF1A8FDF5E2BF9327B17F22A9FA1396568C0ACE4E46D4F548FDC7530
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0.....................................................@.........................$.......X...........X..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

                                                                                                                                                                                                                                      C:\Windows\Temp\nscC342.tmp\nsExec.dll

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6656
                                                                                                                                                                                                                                      Entropy (8bit):5.140229856656103
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:J7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN738:HbGgGPzxeX6D8ZyGgmkN
                                                                                                                                                                                                                                      MD5:01E76FE9D2033606A48D4816BD9C2D9D
                                                                                                                                                                                                                                      SHA1:E46D8A9ED4D5DA220C81BAF5F1FDB94708E9ABA2
                                                                                                                                                                                                                                      SHA-256:EE052FD5141BF769B841846170AABF0D7C2BB922C74C623C3F109344534F7A70
                                                                                                                                                                                                                                      SHA-512:62EF7095D1BF53354C20329C2CE8546C277AA0E791839C8A24108A01F9483A953979259E0AD04DBCAB966444EE7CDD340F8C9557BC8F98E9400794F2751DC7E0
                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      C:\Windows\Temp\nseBCA9.tmp

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3659567
                                                                                                                                                                                                                                      Entropy (8bit):4.400113174339978
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24576:HoVUUoniTTIpCDHYzVYfL00+3JGqlxCsKEjzOE:dUSiv0CD4hF0QssKEjaE
                                                                                                                                                                                                                                      MD5:D280811549F71BC02FCBA3917526CEC1
                                                                                                                                                                                                                                      SHA1:15AE615BEE877B86679495F51B5DDB6C356A50D7
                                                                                                                                                                                                                                      SHA-256:389F0127F008AD843A077A3796010B6B40800C1EE7E1F3D1F343133165538366
                                                                                                                                                                                                                                      SHA-512:9FE7760368FA917F5360E3574CACFAE7EE1080F3C3D9AB74548E4615D9E5C4F3B55E253F90A5587373CD224ABF303A428E3A1D8A76BD564A26AD44A23C8A565C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview: .#.....,.......................@.........#.!.....#.........................U...i.......................z.......2...........................................................................................................................................................................G...J...............................................................................................................................................................=.......................................................................................................................C.......j.......T.......................................j.......k...q...s.......T.......................................................................................................................).......................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      Chrome Cache Entry: 1696

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1697

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7792
                                                                                                                                                                                                                                      Entropy (8bit):7.957547694501328
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4oslhI+LOsFiIK7fIyrjdZhwQQS3xsgyexmZfMAH5nmH:4o4hLKv7f1ZhwQQS3x3BAMAH5nG
                                                                                                                                                                                                                                      MD5:95F1A035553233A5E180029B1B0F65F5
                                                                                                                                                                                                                                      SHA1:25BE78FB490100F24F7578025D0C41D02B9DFFD7
                                                                                                                                                                                                                                      SHA-256:3D7A1FA753173819BAC6B5082C05C8EBAB468511C9CD13515A237A272B64C4F1
                                                                                                                                                                                                                                      SHA-512:072617A15CC6F41F8212C0C09C399B2A25B7FFE65277F6F336CBF843E617DF4287EFDCACB597D814238BDF9533C1CD75B92434B295A5290EF6876ABDDE35F35D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..].T.W.~4.....G.c.'.d4.13.NP...$.$...\0.....! ...FAei.F.......f.Ev.....~..~P..T/"...Y..TW.z..{......RZ!..\Q<.X..P...Tz..[..(}.....r.P..[.JoW..~F..I..tx#..`~.M^C...?..WZ.K.R...P.<..`. M.HCQW...SC..W...K..+...WCE..y.J5L..*.....jA|uE...A..k-Y.J.l..$kd...g.!..R% ..r...)#,P....g.!.a .j).Z.?.x...|...UC6..g.R.A..5..=..$B..H....B..0..`Pf....R,.0..q... $.q\..8.c.&...xQ..6... ..=....&Fx..e[)|@..*.G.@Y..W_.S$.L./...".{].p..g)..TI..P,......}..v....;;.......t}.q.Bx...[m..UV.m.fgg..;........`..ij..*}...j'j.'...zzz`D......#.a./.X.!....3f..@.f........&..z..~Ev*.022..`ff6JV._Y1..}}}...G..D"....;....d.6......_.....V..R..*...$~....p...Q.FF.X,....B....d.....R..~...BH.k5.iy.v.;h,H......055.....6.4WVUV?........YAa..U...s..1d4!....o..6.M..z..1.,.g.....m.c`....Ej...v..z...H........Rx.X,:^<.O+..`!5..c.|4.c.Cn'^H........R.......U..D...............R).....5.K...27T......*

                                                                                                                                                                                                                                      Chrome Cache Entry: 1698

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11027
                                                                                                                                                                                                                                      Entropy (8bit):7.977399822217327
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:0zUV8dI8d3ardOvelygrYbShDM5n3ceVaWHhK04DxhOw3Hmivq4C:0zUEzd3as6kmhQ3cekYkxhb3G8hC
                                                                                                                                                                                                                                      MD5:C165DCBD210C0857ACA011610228D365
                                                                                                                                                                                                                                      SHA1:3C72AF7EE26588332A5F342279EC0A482E7816B6
                                                                                                                                                                                                                                      SHA-256:28632D192AE969D2F2F3B0CA91CF65E26953138278D8254C665C0FE639FD5E99
                                                                                                                                                                                                                                      SHA-512:7267639858BDF55BAFEC6ADABD2E3D171BB2A6F98B42C522050C9DC3BAE14120DB144570E5898287E3050DC84ECCD327AD7FA8687BF2BCA8732286AAA292A5CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..*.IDATx..}.X....p..W.I....E....bG..;QP...n..^Q.cLl.Qc..wE.+..............>....;..ggfggg.....T*.....*.B.P*.P.......^\.u...?.|..r.~.d.uM...T....'.WdRI.....e%C..f.[.~._..q...g/.....nK.V*.....H...........eK..L._.n.q..G..].Un.(......90L....,...sE...q.nT.%pa.:.8.#Gcs_.....UKVn<t..[..75.P....J...a.>.Lr.B.'`z..../6...\i....Vz<k=cG6.....%..xb......\....Z....g....[...x..EA.........-.(...%...t.o>.j...56.q.m...l.......K_....sE]h.t..".A<d4.!e..C_.i .2.y....g.X.n.ICGO..;....)..L.^!..A.....W.N..qH\.....,......./...)..h.`.<..Z..G...y..{3M.8.....j...}...L.]R./......D0].~....]B2X...o.z......G.j..8..iH.%r.<tr)...BO:|.R.#3o}.;.[sM.}"2jf/{..).M.|?x....K.&....m........O.m ..<9".:...'[....j.qPDm...$.=...\....q..>...K7P....;...E..qa.....l...;r.<..&.."*H..I..8....>....=tL.I..'_...y..G..#,..GO..._...A.......EC.p.>...yp.^..h..y...Qa..t...". .$...T.$J.=...5G..W........o....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1699

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):17634
                                                                                                                                                                                                                                      Entropy (8bit):7.9857227868732465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:tIe3PyyM8I1+QDTh0HYSz0p315Ka4cMLKOag:CQM8e+Q+4Sg14adeag
                                                                                                                                                                                                                                      MD5:5F660AF0519228BA44838AB9388CCC96
                                                                                                                                                                                                                                      SHA1:E141A15215ED0A5722941CE278C85560BFA9494C
                                                                                                                                                                                                                                      SHA-256:EEB19C3A098D5B42AA42ADE1FB8326455AF2C755577349D4B13447427B595F91
                                                                                                                                                                                                                                      SHA-512:B600EE4C530D0EAE705B007559D8B1CECF8223679180DAA1C6AEAED9467E960A770CA2F92F15044AF2B2C444205419C908A797DEB8CAC6DB4E55F8AFD4E6FB69
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/retro-brawl-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.D..WEBPVP8L.D../c...M8h#.Tw.q.....!......(.....r...l.}.Z).)aB..1p..Fg7@...a.....m$I.....8.L..m..D..))..i..N.sL8.....8Nm.U...%X...`......q...`4....R. ...z.d....i.....6jT.i.h.S.E...m#.Aw......HZD..p.@....Q...P'.4^qs~........g[$f..<%0.3c..<........10.V......5..P..cl....3.\.@o.5o.e....u+nE...$(.+".......m.AN.....C....]YWb.BI8~....R...r...u..M..]...oJ....u..G...,....m<.m...6^3....U..JUf 3...].s....x..H..[.....Al..y.ef..y.g=.6p.......x.,Kj..33"<..J.l[..1a-.Q.5r.....;....;.;..b..cff...s.......Zk......Q$I.$#......af..,3.......23336s1&DF.......i.!K..).$I2..H...a8....g.;33.nAfF...$I.d.%..U5.Z.wd7c.y..n`..X.@....4.k...km..6..jK.H....p.3.....ix..b.F........m..$.$...n....x.K.q(p.F.v.|oxw../.M.... .X<..x.6..Qt@....m...N.H.z..!..D~.....q.w8.g.j.zM.%8..=~...l.)..z...c.0G%Q....;K.i.Vv*i..(...G.^.........>:.i.)..k...L>...$...`~q.7...x.b?.ow...q:.....n.~..a..COD(.........l.TcR.V.(....!...A.8.[`..?....H....>Q...+{.'.thKf.f,..R..e...6....T.Mf....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1700

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9417
                                                                                                                                                                                                                                      Entropy (8bit):7.964736630002873
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qyN4YBJQrz0iGlvInjh24UDYQ50/pJorD4G4c1UcRtloDwF:qySYMP0iGlvInj15r/perD4fcRtJF
                                                                                                                                                                                                                                      MD5:3017653826B1D5CA16EDF9C9869466DC
                                                                                                                                                                                                                                      SHA1:CA38B9F905DF5391B10C27E72DD8AD4ECCE3618C
                                                                                                                                                                                                                                      SHA-256:CABD818BD8F701AFDA9A08607D5FE2EE702A84062F19A3D1EEBB9CA50777E0EB
                                                                                                                                                                                                                                      SHA-512:78CB5C1FC059DD16442CDD74559973902E00E536A7E695ECEA46A1180F95FBE4E51FAE8538869E6FA6B29E8A3AAB90B8EE27CDF77A4722B31F0A6E14BDDC9971
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..$TIDATx..}w.U..Zk.s.C.BG. ...Q1.1..5..4..S...K..%j.%.... j,.".5bCD..}(..m......;w....!..>..L...}.g..j. 3..x13"23.03!._..W*.....\W......fWSsU.....).n.x^...-.!.o(\Z...+.....K.F....'lY....hfDD..Y..Ea........&..NU..|.{.?.m}.b....T..7.....7...u.+.f.GB....9|.1#FN.<xPQQ.p.r.1.(.1._..`.......%...........n.H&AJ!.%.".H....u#2...R.. ...3z.q.>h.....Dc...ffA....X.5.Z3.Q.u.U/o.l...6nhmiE..Y. .FH...9.CwN....F..Qi....n.(~..O:..9c.L.0.(;"J......2K..JkK....;*..^.....w....PH...60..6."DA.(..d.p.._.?....6\..J.".%..L`.."...X.U;w....K.7l...B....>`F.r..h}.u.R....<..Kf.6t..c".._.V.<.,..%..]..kV..B.l;kq.$L..."f<O)5....C....SJ........,c:8g.....a..u....m..W..)d...<D.YR...O.h.Q.9.m._!Y....hfA.....g.~....m!..{.~F..@3{JI..'N..3G..+....=...#YF...5,Z....>SQ_....n...*\L.......3.v.aH.u.'..d.../..$.p.....W^F@).1..y}...(..W.8.sN..v....zrw;...?.8{4....Y.m......Z.~4..|`=].zLBJ..gM;..9.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1701

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4688
                                                                                                                                                                                                                                      Entropy (8bit):7.937629484887233
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:hCr9GwwBkgr1iQRbcpBng8NehRpWriQhUzNYT3lgqA74MDJutU:hW9WugE5ngG6RYriEUBYDU7BstU
                                                                                                                                                                                                                                      MD5:EAAFFACBD7D51EC97B9181A4115C7671
                                                                                                                                                                                                                                      SHA1:D6070FBB93CF68D45D4B7F834994C9AADD2A942E
                                                                                                                                                                                                                                      SHA-256:F12452882C86BFC13F554A01C0E6FF4F35574D22C306DC92DD2D1CC50C5CCCFA
                                                                                                                                                                                                                                      SHA-512:754637E7494C0930E0590240640B59314A1F134FF21060D732212232563F70433CCE709AD9B748464FF7BA2766740CFBCC4D606EA3825D7D76F01FB29CEFB854
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/iptv-smarters-pro-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFH...WEBPVP8L<.../c...Ua}...I..l.s.9.s.9.s.9.s.9..0...9.S.#.G.'..e..TZdu...#..P..6..hu$...p...[.&..FG.dt&.Uip......vDg.Q....Tj..y.54...Q1{.Qi.F.NhU...XM...Y...2*Y.K*.N.V...v...;0..U.4............../....=j.I[ZV..zd...'...;..3/........*..F..F2q...Y..l.^.t....@.(g..........4.=.m..m;.v......j._.....D.d.;F..:...j..ZE...G.9.y.lH0.gA..3dt.....S.GW.....]...x-.....~G"........acQSm....../../.........._...o...G.s N6.I<..U.5..a...^."$......Y.......o>@..*+..i..X........o.9..e.<..,T.b..........i.-....H1@d.....<.%qZ.`.pGq..._.dKT...:...`..h....@./.$?..p....P..C..A.....H...C..'w......y6.w[j..'?..7..?oo....0Nc.5.;.5..|...C.h.y.......D..u.S&?.Q_.....B..C....X.j...""....R.7...".Ou_.b|.:.......f......w1...I....FS9...G.R..X.../...j...d.X.c....d.i ..a.......C.Rk.....%RV;.U.....c........T.n..E..;....S...\..........-..e.*....+....Z.(._H..wKtX....D.u .u.....@.l+...f.......*~.7....$.sz[...N.+.c..Yd.k.....TO.A..1.U....j.s.:n.C....q...4....;.!N..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1702

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):23674
                                                                                                                                                                                                                                      Entropy (8bit):7.97710176666318
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:YNZfbwz2TnTAsMiTXRvu+iKoUPWI8u7VZJer1E/g8JwNcvhgiQqVzT6:qpbBnOqXROiMO/wSvhgiq
                                                                                                                                                                                                                                      MD5:96761B75B516653CB482694B134642A4
                                                                                                                                                                                                                                      SHA1:3C482EB575BA4CE35AB76F2567EA14BCEF5E60A1
                                                                                                                                                                                                                                      SHA-256:7C3AD1119093B87AA1C2BA65BB335B6E14C2C6C21DE884A653611E3E348BF51E
                                                                                                                                                                                                                                      SHA-512:9630CCDA48784776D4538F0F1D0F115A257CD6825B6153CE3E6DE2529E50CB04BE5061A9BDCE901089E61397800A07ACC6A8542A3F223BC345A1A5768EDC4E44
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........6...................................................................A..z...8H.8HP(.0..m.:...Y...1."..f7CF'..B5....6...3....\....E..i.E.c{\.h.M........SL..4...v2Q11......u.._=9&..j..]b/+U...*o..c;Q... ....`..P.Q ....B.h0p6.(.hPI.}..F.v].a.2.E1Me.i......R.bN....t..}S.\.6....,c..R...'.-..R.K..,...2.h...n.M.....q.g...(.5..#..A.%.I3#..Q4. ....A.p ...........f..Ir..e%..d.@..8.i......>.;NR...9u.....[{.L].SX"....f........Y..k..<.V....I...@....Jz8s9...9..Y..j...7.a..jMD.. 0..F...h...../Z.sAh..@.%LR......1..P.RQ6.Zf.'..>.:f..4.D..Th_...E.L.....K..m..o...1Y~.:.n.s..<...s..h...H.iKI."..`.....d.M.<M....f...L.&..w)..5.x..B.)L...#0.*......!.K.:..[...&.R.+*....h.......U!#_?.ky.V..y..z.d.{.+/`..]3.:9......f.m2.2.m.......x...6`...TI..`..X..O..k.u.z.........F.......k....!..+.S...7..WG.c\.c..W..s_..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1703

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16898
                                                                                                                                                                                                                                      Entropy (8bit):7.954143577415124
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:bSVfu8S/6iqTe+oN1Pgx6d+MlfAfHNSeFn8EU5MX:GVG8S/n8vo2ujlfAfHNp8EU5y
                                                                                                                                                                                                                                      MD5:C21BD2DB3590EF443649BA280620D2A2
                                                                                                                                                                                                                                      SHA1:E47CEB6500AF189628BEE593F1036E90B5B88825
                                                                                                                                                                                                                                      SHA-256:8C55022F5ED5FAF256D26C0D314C81FF0244E290D3A553420468CE126631AFF5
                                                                                                                                                                                                                                      SHA-512:8F68B80229DEBD97E1B29694B6E34705CE363235ACA96AFEDC70C853E9864850BE47D943F3929A735E5A1EA822F7E32EB2E5A5E7C21564128FD1D79AD8F19743
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..A.IDATx..w.e.y...s../t...9 ..r"..R$H....,k.D......Z...,....L..HQ.JZ...$(.. .....8y.3.....{.9......g@.vkw.....7.../.....~.KAQQ.....P.u..........d.{..E@...A@..R.|.-...T....>...W}...g.....#(.?..T.]d.......~.7a..,,}.{..F....E..o.........c../3.W.....1|.>(\f.....W[................z.S.....r.yz ]..*...V...k"P...G.....T...ye.ar..^........6)...4K....&...@A.~.........R.R.........!qM....2.|.}/...\.......&5.....G....Z.a..e.p.i!.(=P@]?H......T..o...=.....W...A./[&._d.J...T..... ..\~.....U.zC_.[Hi._........*q.T...w8Z...[...[..WF....@.L.....T.Z.T.tM7F..:u..AP..Q..F........ ...X...K...U.|G...2?3...E.u?.kj..A.^...@.*....r_S...........>.{.Z..TP.r.|....X...\..z-..9;.t..?$2..V.@k..k...\<)..*..^;.6...SadV.....!.z.#...#.W.QQ.u..F..G...|$"....")((...W...2.........j.].....L..S;..UQ..L@..{qRP.D$D..^..]...UE.@...G.s..qm...k..K...(P..E@U\.?..H"Q4..!......P.Q...6..>U.1.2"...R.v..UG.Y..!

                                                                                                                                                                                                                                      Chrome Cache Entry: 1704

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (19986), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):19986
                                                                                                                                                                                                                                      Entropy (8bit):5.253227111919225
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:XrqR6Q0npafIm4rKi/BwEXN1w29mItq0W5i6G:Q70nBrKuB0Uqti6G
                                                                                                                                                                                                                                      MD5:DD1D068FDB5FE90B6C05A5B3940E088C
                                                                                                                                                                                                                                      SHA1:0D96F9DF8772633A9DF4C81CF323A4EF8998BA59
                                                                                                                                                                                                                                      SHA-256:6153D13804862B0FC1C016CF1129F34CB7C6185F2CF4BF1A3A862EECDAB50101
                                                                                                                                                                                                                                      SHA-512:7AEA051A8C2195A2EA5EC3D6438F2A4A4052085B370CF4728B056EDC58D1F7A70C3F1F85AFE82959184869F707C2AC02A964B8D9166122E74EBC423E0A47FA30
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
                                                                                                                                                                                                                                      Preview:!function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n||0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]]].join("")}},944:function(e){"use strict";var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)||"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var n=new Uint8Array(16);e.exports=function(){return t(n),n}}else{var r=new Array(16);e.exports=function(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),r[t]=e>>>((3&t)<<3)&255;return r}}},508:function(e,t,n){"use strict";var r=n(944),i=n(343);e.exports=function(e,t,n){var o=t&&n||0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e||{}).random||(e.rng||r)();if(

                                                                                                                                                                                                                                      Chrome Cache Entry: 1705

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4412
                                                                                                                                                                                                                                      Entropy (8bit):7.929420876470746
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:dQiC8g9SoUIN+SHoqL3Wstg6hQ2bnCnGeoDLfH/lpO/H8rcpj9PXu5O:eia9TU4+0Ntq6h5zCGe6LfH/lIUrEj9D
                                                                                                                                                                                                                                      MD5:7EC0CC641C71ABE06D1C822199D57ED5
                                                                                                                                                                                                                                      SHA1:FD8729EF0D6CBB118070626E20784C647B19B29A
                                                                                                                                                                                                                                      SHA-256:507EDD4BEDB8E780A7EC80E5FBC69A02D079583BEBE41C2A9F062BE1E7787468
                                                                                                                                                                                                                                      SHA-512:C96FFB679F1ADBB18085D87FD084332FE93303C96034C70A07DE39BEE32333B7092FCC38D56BB8CF1831C3F6C30243EDDA1ADA7346F9B3BA211CFC22C48BDD03
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/intesa-sanpaolo-mobile-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF4...WEBPVP8L(.../c...U....d).z}......}f......Lp.....m......s.h"...-..U..TO.C...8d.. %..F@d.r..:8d......k..-.p....]3..4.p;;XG.!.....l.F[.{H.z5"......U."th...f+!.9..J...h....MF....$..07[.........w_...F..{....4.."\'. .`.I...au.)..c.3.m.. .`.h..k.6.m...m....O.@.0?.0.....0..k...O?.l[.W..K..B........FCG(D.%D....Ff.o.......~...v..b.g.I..0..0.C..$.Q......pHj:....G.....n..L\..V......Z..?...K...........\.5..........l.J!U...!,.`...D....(.[.a.....(..h..9.P.o....h....hS..Ow.G:c....`...0..." .R.......%h.$.i.%.&M...$.Uz.../A.....2......k.D@.kR.U.$...o.A.k.C=...%.*.G.....$!.*Q...G.. .9..H....`a.Y.'*....5x{.xNP..tQ.Q\..[9...).>?M.......1..1.cN...i....4...P..;G...ka.T...D......A;..0.F;..."*+....S'..._J.(].....,...u......&..<.dw......D.8..D@ .$..r..~..v*.<..s.V%...A2....a.i.m..<.K..5..2..]l3y... .C ...5/.l$z....o.S...go.~[.....{..2..C.....O....m....m5.)6.V"(B$.]5Z'mI..D$.$j%Me..`......4.v......[....!4....[.....b...T.:]..M(0.|r...U.....+.q>..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1706

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5954
                                                                                                                                                                                                                                      Entropy (8bit):7.959488331235293
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:6nV3Q+eHojparE5RzwUBC8n2N2c05KcO6032SU0xuTQ/YXf2113btzYSzYcUX:6nV3Z1jpEyRznTKcOUSinvehYSS
                                                                                                                                                                                                                                      MD5:6F05BD2B6C05CDD768EF718B8438C495
                                                                                                                                                                                                                                      SHA1:C211F3D98E591236463639B38DD2395B7F7E3B95
                                                                                                                                                                                                                                      SHA-256:7DB7DC308FE6382D07F502CCE32D8E00BA6B4BBB5ABE6310B6036F28924E13C9
                                                                                                                                                                                                                                      SHA-512:4C952E634A0632060B60B6B8C5C83FE65456D77EB73D003A67C9C942739FA1CAE1F8533AB3BBAE4E6A8DCEC64FA6C3D5A1F300A3BCBCFFAB3C07194D1FD7FC52
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/taptap-android-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF:...WEBPVP8L-.../c...M8h.I....[....b.....^..Z..Z...N.mc.o...".rd.em....F...Q....m}?Z.m.I...T.J.c.{'.....4...............*...n...S>.P..*.!.........M....!...K .@..@.o.........R....Dt.U6."..)..gQQ`."i....w.4.,..:.... ........!.......%.k.....yYu/7......A.q....S.......O..z.Y...*..D^..l.".v~..nw...`...>.03.af.L.3>n..j..f.H..|.3.JK.Xa...ZJ)bNj..t ..[#.V.7[V....6.A...*.L.5..0M:@..C..~....B.m..2...3+....m.m.K.(d.2"...-I.%I.m...C...V_.c....Hv.=K....At...f........+{..Fa.:.....@.!.......2..B.'......zU.. G..cyzF....X.l.Vz.....0>...|a s...m.@.......1... ND..I.D.f..?...p..-Y|.=.!mG@...-. .C.DI.i..%..>.o.0G....I.hDgF..BX.d....3.br..8.R......d.T]6.!.,...t......e.K(...2u.....;..=.}.q.u...]..vK,..AI4.e.;j.;.g...j{0.."....-\......P.P..k......x....5.x..e....H........7..\.C.X.......V.a...*` ..5L.t......6..1v.#...)..;@..T....>7W.2.D.L.h[...y..0....y....{..l....3...Q..#...s...:1y..............0s.Dg.KR..q....zT.![fG2.H<.S.....@...2.0/...681....h.^'y.X<

                                                                                                                                                                                                                                      Chrome Cache Entry: 1707

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17595
                                                                                                                                                                                                                                      Entropy (8bit):7.972097415200727
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:pFce+DfhV/4f85a6vnqA3Li4cL9EHdMfNKRk0:H2P/pFc4Eo+ND0
                                                                                                                                                                                                                                      MD5:6B3E050C41FCB5788E715763F97E2D40
                                                                                                                                                                                                                                      SHA1:B74A8AE144FD1873B53702EC01FFFCFBB1C5005F
                                                                                                                                                                                                                                      SHA-256:8426FD91EF7F38AA310259F57775E91F5D2D4136E4E7FB5CC5D1FC2687DF2892
                                                                                                                                                                                                                                      SHA-512:6F859BCC648F2C7DA46707ACF0C862DADF1E7D3C8F7D2A2453875C6D47F42C9BE5CC487BEAF5465E6D9D1BB66C54493CECF7A7DFF525008F3B1D52D985043827
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..DFIDATx..i.\.u...}.5...3@. H..@..%J....eI.,+.h..-.;..{-'.n;.IgXIw.qb.l....c..4p.H.....1.$...o...{....[..HII..P..U........\..?..v.]...p...y.L`U#b.}.Q..;G.....(M.Z..v.9..;2s..p&`G. U. .L.h.DE...l.(q.p)........$*03...""0p..`b..'.#3.....b..MUD....C.....S,.....A....LD..(.&"Q:....i...` .....IPVBT.39.2.......;..'>e...\s.CU..TY.B...B& #..73..X..2..p....53...H..dL.LF$d.r.d.......!F.Q%....I.R..G..Td......S...X.V3..96*.FUU3vD.<3.R.#..Sa%.'.1+..8.x.........8.H=..J&@T..1...,..........T...e....z....Lb4...(...X..,..$*.3.XUc.0.D&d0S0H./....I.43.g.r.T9S4..#26!2g...b(jXY^....,+.\...!....%njjz....t{fff....z..I.(..*..c#..dDbp...l2".`V.....2.i.<..H....H...,w:++._._X.u;E^.*..1'.....$..k.V.Qo...&2.;G....."..\....y.$.w.13...Df.."".L.T-vWz..s....N.....s..K.K.A...y......V.95U.mz...c..w.{..\..:#1.a.A..F/L...03...t'...T....h.V`0V...D3.....WN.:}..Sg.t:.n....D%.$i.&.$m....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1708

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12807
                                                                                                                                                                                                                                      Entropy (8bit):7.972446739749784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:w9tUN/3GYOif/qal7d2h0UJ1S8RyvCFGtFIQDIvXJ:w9tUNz7f/qa72nEtFIfJ
                                                                                                                                                                                                                                      MD5:44B5D13ED58CCA46C39900EDC42F0750
                                                                                                                                                                                                                                      SHA1:BB6524367EB1780E5252AECF1014692F80D07A5D
                                                                                                                                                                                                                                      SHA-256:249FA6029CAD032E934A24C3A98714B6B2765C881EE923C2F75E9B6651385487
                                                                                                                                                                                                                                      SHA-512:7A8CE6F98F4A8AB76167B6D5C7F902892C639BDF79F0CFF5EA57B0746326995B90C2267FEE12D17E1835982E182BE31129B85F5AE9E753D2BE5FCF6BA8A53B18
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..1.IDATx..{.'.U...}N..q..}[-..%.....h[..BH~.e..6..``.b`.....$d..3a.`.BB.q....1.[1...@.8..&.8..m......q...~Uu...sNU........K.]...:u......w.....|q..$..d^.../....].5}..@h..I..0...?..{..E.%..$!.......B>HZ..`.4..C>..i.{............G..5..%/.v...d.0.U..)?..Y.Y?..3...!".....B.V...8G2......;.....2>.t...Y...... |.1"b...:...f1.T_...".i...y......_.../?..~B........G....&...b.jU.H..B...B......I......k....\}.....Zv......m....".PDc.......j].Uu....?...;....'.[.....R.f..........[..9......B...I.;J.X.....J{$....z.m.(..+iU....*.z8.....if1...w..~.B..%}....z.J..._.}.?.w"........jW^.e......<@HF-".Eh4B$..x...x...O9x0.X..).M...E.... D......t. ./.F.LOD@2FQ..8..:......h1......}..{..CU..T."N..TL....#.e/a...J....`:....s....y..v.>..2..]y0F..{......V`....`.G...S.1FI...Sq.......fJ.0.f.h.M-....Ko~...x....rv.Lu.H......-{..8....f}.M.mw...IR..S.0.hvC..U.#...v....`FFu..?M.........ZU.f...(

                                                                                                                                                                                                                                      Chrome Cache Entry: 1709

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9653
                                                                                                                                                                                                                                      Entropy (8bit):7.919748117440208
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:SikLy/cAj7+NsMotkCBE5m8ga65yaFUO2FLvrfqGOtij4PwE5O:SiF/F6JotkCx8ga64aFU1fq1tjwEE
                                                                                                                                                                                                                                      MD5:80445F2BAA040C26994A25B8AE3E4C05
                                                                                                                                                                                                                                      SHA1:984A5908A2EF1814FCB063E1BE098EA459B238D6
                                                                                                                                                                                                                                      SHA-256:12ABA82EFA1AB6A4D20D7620AD55DAD4CF9AFE15F180D067ADA57DCF74B04361
                                                                                                                                                                                                                                      SHA-512:2839606EA910D1616FAD3E9E1D93645E45931306E33F098B949F631F9466A25B572458C67A2496504C0DA40BCDA82AD8C69637E72C2A62F916427B61FD344CD1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..%@IDATx.....w~......=.9.X.K.d.f:.x..x..^..$.A. ...Ev...*.E....$. .;...b..Z..H.d..^u.\......H...RS-R~.d..,.X".bt....9....4.n..y.~.....0...a#cp c!.........0........0.XJ..h.h....vr~.&..].6..zC.~P.//.AP(.d.16.....c..U....mJ...._..g....|o.x...k].|.._..+...?..2.;..A....d...w...6 ....'.......5]y.N.,../....'...oO..7..........`..A`.....U...@.a...<.....:Y.....npS2....=O..;...{.......C. .AX`....@`$6.3.....a9I@.D......./.NN.G..,.-c2..]2b}-.........R..........@<f0........g.|..b..46......9~ok.*55....B..0)[....?g}. .....`a..@ ....@|NB..... .E....H.......z...8.. ...... `bo..k...o|.].F..,R$2.d0....`0...H..F.K........WmH.......+..En(..SvP........|4....Z......`@<f.1...2B.@X......B"...$.<z....|2.D..@<$.$..g~z|..7.2...2.....a.!..OcpBB.....M.... .].B......z...!..llc....lu.......(.L.Qd..<b6..+.$..X...$l..6...k?.s..{.D)...;...$.:..u.p.....<..........qA ...!....@.x...l....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1710

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1711

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10462
                                                                                                                                                                                                                                      Entropy (8bit):7.972670918564868
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:D68a3bccPQNyy4H2zD9er2Qk4GI+4n6hd0fIdZU3:ZaUa2zD9eKl4S4n6/CIg3
                                                                                                                                                                                                                                      MD5:3CFC08EED85F8DAE1D7B26788302D3CE
                                                                                                                                                                                                                                      SHA1:48CB3A5FBFF3864153360175D164907AD3899EBF
                                                                                                                                                                                                                                      SHA-256:C398A1D12D1F10E137A682A8A2B138E57F4CD8944BCF57139CA693EF1DFB9936
                                                                                                                                                                                                                                      SHA-512:5B8FFE3DA108580E37B29D15C5153209C5681DFF7F949E997FBDED65167E3BF2975E19E4B33D8D18FD586625895210CC4667B367699E0022D2FE835666630BBE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..(iIDATx..}i.e.U.......7...Z-[...K......66.0.....$TQ...@*...$....R.!.)6...$.-.b.5X..BC.....7.w.=g.V~.}.=...^.d...t....{.9{.5|.[k.C*.W.../..]..*....7._.t"........."@..!"k...}#+R...AU.a.%!l.k..U.... ......K....(TA.......S6.0.6.b"....|wa.g..^.j.oW....%e...?z.C....'.^Y\. .TC.FrV.L.D...=.K....#..........iV...ac...?......<.v.@..k...L....@.....~f...........^{...<&.$.h.Q.n...O...'.\...3QQ....k....6...'...7....H.sjX;...0vr..wBt.`"_.])..j.?....^U.W._#..z..s..3.8........([j.L'...n~.......J.]...B.;.$_.. ...BX...(.d.1./..........:..5.,..*...W..G...O....!......g......wI[...L;...5.....]...HCA.V.......GN.[\..f.?...w.......l..E.%..1...G>s.iL.B..........tW!...Q..#~.A..Q..?l..............V.^K.\TT._b...@D..%..E..Z.~.-..?:.. .....y..n{...A.p.....}.m...eP...tn..p.B...B......LL....4..I.">.....|...E..Q.?T.W.*T. ".... ..>....... !H.t}x...'.W.>.to...Qu...Rz..r...tG.d..\..~

                                                                                                                                                                                                                                      Chrome Cache Entry: 1712

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6112
                                                                                                                                                                                                                                      Entropy (8bit):7.945572073899934
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:nVScMAGMZ20aS+ZAVcE4co8AXwnJ9WAxJLbMObK1HuT2oTc7libj+OaARrWJYQmg:V9MAGK2kXqcY26Azo5OAmaoCuQmc52lG
                                                                                                                                                                                                                                      MD5:2C9292680EFB0713E9A0FB365D47DD16
                                                                                                                                                                                                                                      SHA1:00C52FD5AEFB352DE3212F2C3F7F2E1068F84003
                                                                                                                                                                                                                                      SHA-256:6E0269F4177CDC35123393291F6D2964EB8C5B22D01CD816E258648460FEBEC2
                                                                                                                                                                                                                                      SHA-512:20C24C0CD6B9141971452BC8FEA902759EB6964153803B6B4E5644024E5B318D7B8CBFB26F152D636C097AA5D142C4BE6A45E945478F26EB5307F20E1E14BE5A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/pdfedit-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M(j.H..7...".?.|..T.. .d..+.....9B.....F......D0<....d;Q.1....$..(..ZYWH.6.u.....@?..CU.'.....q}.6pa.N......\....... .!...D.....T..T.~....."..c.O!.l(Q.f.f.3..B..B...6.r....mS$....E....13.333.Z...U^}X%f,3.d.H..Dw.r37R......L.2.6...m[.H...~.Or(....3.`...Q.].......333Sb.m....mm.=.4......Yr...7l..#76"L.D...dq..23G.....>....Ir.>.dh..?P..Z..G.....{... 8.....J.......`...@3..t........o.|*..SJ.U...z.@..e.%..9_.D.....sYt.......krx+.....{.P.l.S...s...g.....].^..a...........=.<....s...X....B`.I...xv@.~9a.Q.90.)..?.+o.a{...Ox..u....<{..{.q.e../......Sw...".f.*|..uP....1.K......l......fy....(Bl.&.d.R.C............."4Q......M..Cd.8D.@...Q..B...C......"..uh.Pj...!iQ..+.z=8~B...J.B..z......f.....;3.V.;u.....p..... .T6.'.....!n...t.IJ..".T...E)$.H.8...Z.....#^_.&.A-.j........J.!G..h../.E..|4..........N....4..9.......t{.G..,.......&7.=D...P.....H.<.....q.ya..3=3....Y>.'.....|p.kd.EeG.q..r.....S.@Oz...i.y..........~..{&.....S..T..A).7.s

                                                                                                                                                                                                                                      Chrome Cache Entry: 1713

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8278
                                                                                                                                                                                                                                      Entropy (8bit):7.965448747260539
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:gHqZQuB7gsHj9B4YDmIKX//9oYblKYEnOVHSLyAY0eEx5CDb:gKZQY7x5bu/l5blKY4g3Renqb
                                                                                                                                                                                                                                      MD5:2217190101490AA218E76C0423D26751
                                                                                                                                                                                                                                      SHA1:DC0D36A726F86C00438144E39B7F0C71C1590AD7
                                                                                                                                                                                                                                      SHA-256:FA4473DA2F483EB709AF0E15E456DF462F7E07A6BC8ED45B3A43B2E7159AB490
                                                                                                                                                                                                                                      SHA-512:7F8A9300C16100449211B4DC8AC0373BFB655532B1C6AE369B51163DC96C54F4A55BE24AA92847B325511A13F676F62069801BF719026DFC4A75D7E8CEB375BF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}k.eey..~..s.........".A@h.DiPA.1..8...2SVR.#5...$.gR5..IR..gb.J..*F.....D.A..AQ0t...};}..{........[k.s..Z.N...o..<..^.|..q.#.@DHR)" .@......o..z..$..@.......$..k.+]x.?F....U...9......J.._......hI. .FA. .........p..I!..#..,...p.....%...?L..........\R.j5AR......t...\Y....X.%.P%...$.+I1k....S.#...F.........H..K.2I..Bz.jI*\g..?.o.+.T}..t.+."{.......P.M.`^.".p......XC... kI..h....K..%..M.Dk%J"....x.T!..dK...d..#S"X4.*...#.....k...8...G.(.Z...N..dG-.2Q.."h...:x..J..H'...).\p..s...).N%W..=Z.....G..DIE.G...W...$+....[...U..k.x_c$.W....#1.xo......... S.P1...V.I.mI%.:......L.>....b..1..m.`...6....S@JaY..O.l.2.2..EC..I!*..1.v4.2..RK..E.<w.jP....$a....=...TB...,...TDB..q...:.o..C...Os.........%._..Fm.pz...G...Q...p.k.\t.AR0.%...E..ZF...@z_.]^.j..XI./..Z......c.>LD...Q..+..T.1I.S.c..Y..S.B..]..|...;a...".:.........."...x.@.>.$|.....X}....k..!.s.....#.B.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1714

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9033
                                                                                                                                                                                                                                      Entropy (8bit):7.943502828959969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:DmtCtv7/CFon3YRv4DHaP+2veL/aTvFSDMXNZoT1BynDE6D726rbD:D6CtjaFf922veTWdSYQTQA6D7prbD
                                                                                                                                                                                                                                      MD5:0F8C7AC0665D430BA099DD68A1438609
                                                                                                                                                                                                                                      SHA1:B31979EBD809A0ED30FF60CF484D585228F5B703
                                                                                                                                                                                                                                      SHA-256:56D73ACA1A6A65EFD07717BDF7A225D62784377F0C2E9C32C38F0AF68F325E77
                                                                                                                                                                                                                                      SHA-512:837D27445706A303DFB1DC13DCBEFACFF9D1C2630E7F3EAD51D82A146241E468753632D6C6EAB8D2929A9A47739ABEBFBCD02A0CEFEF524F0093F0B52115D731
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..".IDATx..|..\U.......z...t..Y..*.Q.... ...D..q.....#.BX..J...D...*j..............U...9....KuWg.......4......o.}..4M.4M.4M.4M.4M.4M.4M....;.......=...\.Y..~..F&o..i...hZ..P.!I.A`.....0..a.AH..(."I..`..."..P.. H.e. l6..b.q...<.k...*.#(....$k.*..A.(. ..*.H4.L..b.?...N.d .p.......\....t:\N'...c. MQ.....Q...=.. .. .$.(.0.K...qlJ...x ..lll......_a..e..t:388..'.....X<.+...\..... ... (...P.Q.5.^'..VUU...TTT......P(..z....n.Fc###.d2.L...Hdtt4.N.s,..*...S....H...$I..v.'h..H"X^..l6.q8........(..K.....E...D.P...t4..D..D..WQ.UU....|...,+.H.a.._^.EQd.`M..........:.f............d2...x,....q.B.#t.`.6...i.`..[0....A0.04M._.A$.....2x'I...,.&..B!..DS...i.D2..E..|..4..h..n.1..].PU.E..0.E].....z<.`..t..!....y...d..q...[.n.$..fa....8s....jZ'..1U..}.....c..A0A.6.>......a}b$If2.x<N.....i8...0..(.C.....d2...r9Q.UU.e.5..`Y...I.6..n.._#...Yz.AIJg....z.....H..o. .K..(I..q.l6..d........<.v

                                                                                                                                                                                                                                      Chrome Cache Entry: 1715

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):210580
                                                                                                                                                                                                                                      Entropy (8bit):5.470536325169631
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Wq27nItFVerLt1hgpeKo4joS2k4OawyiVrMg6i/i:WFDUALt1ipeKo4UiJs
                                                                                                                                                                                                                                      MD5:86A37C359B238F8C198EF0452886AFD3
                                                                                                                                                                                                                                      SHA1:C0DF761A37144B866DC8E6F4736248832B5377D6
                                                                                                                                                                                                                                      SHA-256:63492DCF8FA2FB817340D17D053ADEF3FAD08E3E6A851749221C62DD632C6AAE
                                                                                                                                                                                                                                      SHA-512:C55D0B7029F76A4B5F9811AA4753DBDAC43756B52C637A2C28B18A026D679A405B64C763838629C3A2A13362A49E8DDD952588F94F211D9585614F9E80CD6B70
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://spn-v1.revampcdn.com/publishers/downloadit.js?modern=1
                                                                                                                                                                                                                                      Preview:(()=>{"use strict";var e,t={2131:e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}e.exports=function(){for(var e,n,r="__tcfapiLocator",o=[],i=window,s=i;s;){try{if(s.frames[r]){e=s;break}}catch(e){}if(s===i.top)break;s=i.parent}e||(function e(){var t=i.document,n=!!i.frames[r];if(!n)if(t.body){var o=t.createElement("iframe");o.style.cssText="display:none",o.name=r,t.body.appendChild(o)}else setTimeout(e,5);return!n}(),i.__tcfapi=function(){for(var e=arguments.length,t=new Array(e),r=0;r<e;r++)t[r]=arguments[r];if(!t.length)return o;"setGdprApplies"===t[0]?t.length>3&&2===parseInt(t[1],10)&&"boolean"==typeof t[3]&&(n=t[3],"function"==typeof t[2]&&t[2]("set",!0)):"ping"===t[0]?"function"==typeof t[2]&&t[2]({gdprApplies:n,cmpLoaded:!1,cmpStatus:"stub"}):o.push(t)},i.addEventListener("message",(function(e){va

                                                                                                                                                                                                                                      Chrome Cache Entry: 1716

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1717

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (7268), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7268
                                                                                                                                                                                                                                      Entropy (8bit):5.789594772972352
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:hJ5oNEi1dubKFJpK3wbtbUZBvVoEqjK5MsXGmYmXWstMmXGW+e7sTtu0cJasb/N9:toNvok9VmRIrRuDToWIN4w3AFGYUyj
                                                                                                                                                                                                                                      MD5:26AD90DF30FD1C2DA5C3F4351F14DFBB
                                                                                                                                                                                                                                      SHA1:702940857AEE4E202C5F515118E6FBAE2BE22C04
                                                                                                                                                                                                                                      SHA-256:EB53AA5310941619DCB5847A2C01D0CC42F428D4C951123FA8670591763DD940
                                                                                                                                                                                                                                      SHA-512:91099A542216B475C35C4E61A9EADDD292255A671B393EA5BFE42437CEA19774A4A02478780BF47C872F0699F839E25F79200EF4E7E8003F25045C8E55D75128
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://download.it/cdn-cgi/challenge-platform/h/g/scripts/jsd/c359bc3d/main.js
                                                                                                                                                                                                                                      Preview:window._cf_chl_opt={cFPWv:'g'};~function(R,g,h,i,j,k){R=b,function(c,e,Q,f,y){for(Q=b,f=c();!![];)try{if(y=parseInt(Q(272))/1+-parseInt(Q(201))/2+-parseInt(Q(253))/3*(-parseInt(Q(259))/4)+-parseInt(Q(231))/5+-parseInt(Q(274))/6+-parseInt(Q(263))/7+parseInt(Q(212))/8,y===e)break;else f.push(f.shift())}catch(z){f.push(f.shift())}}(a,974445),g=this||self,h=g[R(208)],i=function(S,e,f,y){return S=R,e=String[S(220)],f={'h':function(z){return z==null?'':f.g(z,6,function(A,T){return T=b,T(217)[T(243)](A)})},'g':function(z,A,B,U,C,D,E,F,G,H,I,J,K,L,M,N,O,P){if(U=S,z==null)return'';for(D={},E={},F='',G=2,H=3,I=2,J=[],K=0,L=0,M=0;M<z[U(219)];M+=1)if(N=z[U(243)](M),Object[U(235)][U(223)][U(285)](D,N)||(D[N]=H++,E[N]=!0),O=F+N,Object[U(235)][U(223)][U(285)](D,O))F=O;else{if(Object[U(235)][U(223)][U(285)](E,F)){if(256>F[U(283)](0)){for(C=0;C<I;K<<=1,L==A-1?(L=0,J[U(239)](B(K)),K=0):L++,C++);for(P=F[U(283)](0),C=0;8>C;K=K<<1.7|P&1.58,A-1==L?(L=0,J[U(239)](B(K)),K=0):L++,P>>=1,C++);}else{for(P=1,C=0;C

                                                                                                                                                                                                                                      Chrome Cache Entry: 1718

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13109
                                                                                                                                                                                                                                      Entropy (8bit):7.940318825066472
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:1fmPHVYBzqAw8+8kJqXFHT6RDJ95xJjKYyCT+FINrgxSk9niCLtnQwXSwVr:1f0oGaz4DJtJjhwFINrgVhtQwtVr
                                                                                                                                                                                                                                      MD5:E9D73BA6F131260AF16F4403F2EB5D4D
                                                                                                                                                                                                                                      SHA1:3F1D11F3A996F5013D8D17EB8D4B3C6381A1E34B
                                                                                                                                                                                                                                      SHA-256:E449922455FF0CBE7A152B17F8A4DAB02C555C8FC1307D7B49557519FCEFDDAA
                                                                                                                                                                                                                                      SHA-512:087667C15E1EEDAB04426065CE18DD9117C8F735FF49957D601A8AA3A635097967F7171BF2C098729C606B46872CD8C1E4F71FF9ECF434DA9AB620854DC5F8A3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..2.IDATx......y......=.]C....f7I.....B..)...9....a.W.,@N......$'J...d9.DK.)k .dS=wUWu.{.{..}.s...f..%....m~..ia......C.yL."....$.).Y........mI....A..%..r.B.B.... ,..').S.....)0........#B....A.BH"......a..al....N.#J....lK....4.-.-......`.S.......@.l..#.4.....;..........W...6..(d.BX.....!.S.......a.R.s.k..v...|.....~..........@....+_.G....m..Z..$...!0`.....IH.XH...f.. .eY...a.........w..g.....w....E..0..2.`u..S...........9.NX.tQ......X....c..`I....1...,...q.A.........I.).,..1|........k..~...9..I.h....RU ...7.q{........9F...@....8...@.%c.W..w#$..}3...<0.T.E.]=._..?.?_.....@.......@H..(.ef...;...k......+.ZOmu.U..A...h...HQ.@..)..a$.2..,d.#B.B....!."."..........P....[..J..(.4...a(-...?x...A..+..[.]......H 0..R.%......1....2...xJ.......B.s:Yy.......zp.....9..Gl...I.[(P!..L......o.?|......s..s\[....$$..[.Z.a..-.Y.B<b.'.x.G.x..$...e......7v?..Oqf....Xr..Hx.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1719

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1720

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20317
                                                                                                                                                                                                                                      Entropy (8bit):7.951765052210209
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:ZCuDp9gW9Ex9WqiVxTAVAP0b3IuKa1yxP8oLcuk7nshGKvKwwcNMrYggx:Z5DbQcxTIXlQbLcuxwcNVgi
                                                                                                                                                                                                                                      MD5:704957ADE568C8A2B5EC42541775596E
                                                                                                                                                                                                                                      SHA1:1E52A5B80315348506E3B151FAEC8E1F972F19B1
                                                                                                                                                                                                                                      SHA-256:BADADDB47577B3E6830C59DCC06283658B8D098A42D0174D2AAB8B7A1AA23A43
                                                                                                                                                                                                                                      SHA-512:FEA141ABBE1209076314711627FDDAFDA2E6E0D1B6863B2D265E558E26EA54AC57244709F39696E536C813040523FE693A6EC5D949D66FE225777C30E5C76833
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..N.IDATx..y.m.q..f..}g.....z+.{.. @....2)YR...e.'<.g"&:..3.....vD;.m.....25.(.DQ&EQ.A.X.<,.....~.o.?.....Q.Uu.s.|_./...<.... "3.Q..h4.t..o.y....`0....Z...DDDJ)D..(...A..D....sZ...,...f...:.B."...D....Q..O.`.N.D.....F...1i.(..8...T.EDT.@..J. . .8....Y...6J.XG".e.........v..n..1.l......5...KD...\......}.{/....7. I.cL.$DT.H.6V.$Z..`..v.,....V.5..G.!)UU.......p0....i>.M...r..P@>.=...............9u.......~........6:....AD@......9.|.EJ+WV.l....h.B@...s...Gc.#K}..>..p...h....?..o..o...i.$I...8....I.DQ..b.z.._.8...2....{gcwg...[....o.)f.*. G.s~*.....?4.. ..... .....Zw:...~..'.x...?......{..D.........B.Z."..HE..f3 ........,.|..s..u...2.Y.Df>.z"...v...........uY..i....e.1Fk].R...j.iZ.....,cf......K..^.x..|V.i.!h....G'Q_F.a. ......F.8Zm..D...RJ...s"r../...?..?....1eYX["..(.B..{aQZgi..I...........d8....6..'.|ruu5...H.S..X.._}.............,..GQ.n.[...YkG..l6C.n..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1721

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16477
                                                                                                                                                                                                                                      Entropy (8bit):6.017516353711027
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:/RHxb6V4sTVmA5Ifcy0VnJl0/qQZH1++ddWxyv87Hh9CTxv6:/RHxuesEBcdtJl0iw1X7hv87HEv6
                                                                                                                                                                                                                                      MD5:0F7F65D27BE97ED444D03914BE77BDC6
                                                                                                                                                                                                                                      SHA1:507B05C475244118911BE33C7CF2580D6801B490
                                                                                                                                                                                                                                      SHA-256:CE742CA8D52E8D808C63B23C713581A8B67C7E8923B68A5DF8F1A0BEBAFC2D76
                                                                                                                                                                                                                                      SHA-512:45002C3BA7E2CAE2C643773DC0A8D372A5063B983DDD3DA3D547E31A2A9D671EA9C31E2B0E4CC174EA049D4A2E7A80EBFC7F81FAA8A5703BCDF41AF18B88DCB2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"sodar_query_id":"t647Zc3hAcaKhQat4raQCQ","injector_basename":"sodar2","bg_hash_basename":"mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc","bg_binary":"TYV9WCo47B9trC5MB1Mjx8M4fa6E+6NfbrAq4O0sNkHasyI2pgBg0go3cCODN9p8E6JXdcLAA08vuA14dUrCq8YsF4u+2PmPIt+ajIJZWYXqPUnDaPK/K9RU2Ok2eNJoL1hyFj0GZGWFahuUOc33n8TGLO+zVqqEL7kmCG8UWgD7Fk383Smx89h48dkVPzExq82Ln8mCI3DlK1SP4tjgGSgcMLeoo0Q138y9q/E2l/7fYxD2mESOmN9rqwRBYkvTfbFhCrR3ojrCmHhoYitbj/AbgJloBFPvE/gM9d/1kXXp+ektHG066vWQESsNB+HM6BG8BQjCOETCMKB7FA/9eib8hCU0T7BfsSWdtxEobIv9M0GN7gJFvnD5oXGnyJMDjj/WTzlA4v8c9rYSrTorC/40Oj+YcCpAiogAZwHlD0K/AB7YjP2qZ9HuIRepJXM+/1O6epjnFi5y2c4h2GtZOO7dcCRwKzQJUYZr7s8fisCEeVnCBmKCQURZjdtBT+ElQNIRLgoppfMdHL6g80r56KjG9bwArbbSdD79PevQcsk1O/4OMF4FOyDyGGE8t2eHy5T2FzBEGT1aIaRSBzBYnJ6V1bbAb1wYKMQU5R6+MHKD23G4IQyBAupVy0lLW8VkEtIWszhHM9p8vPYy0updF1PkxC2qg7LJw49mRVQGyv5yjWPE/VV8tx0utSbTpcHbm1swVIjlubh+1V0n2GR5bJo2Rfs1EYzt4UGwiuVdNYobjy39RaPfkV/WQnl8qu2MJsNAei/FLO1YqO6OBT3dRckMZSpLTu/AdGIkXlAWY1cCD5oAnhAKGeNgGd1Tp53JS0tYhl+eITh86AdA/y

                                                                                                                                                                                                                                      Chrome Cache Entry: 1722

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8038
                                                                                                                                                                                                                                      Entropy (8bit):7.910146202472024
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:uajoc8uPHW2QCsnxt7JT8+C4mO8H0J37ZM/mEJw7JRf:ua0NH3dC4mFH0JZymEJSf
                                                                                                                                                                                                                                      MD5:DF0590204A40D334A6DBE3DD300F4548
                                                                                                                                                                                                                                      SHA1:7A0489BB3280726C91686DF4E48B861CD99E851A
                                                                                                                                                                                                                                      SHA-256:58F86A2A4C025967457FB4C42E21DFFAAFF7C0B217115D1AB10E925D5696D7E0
                                                                                                                                                                                                                                      SHA-512:71A324895ACC0CD47368746BD817187230C539B3EEED704CDD73220347C21123D78352EC546A56CDBA0411D9B8F134C74913B55E7BD3F7E26C3D752DF93BDBE9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/mac-notepad-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF^...WEBPVP8LR.../c...M8l.6. .........3D.....$j}.g..kF2..j..t.Z}.-......6.#....$U...a.(.$E._...v...$.m$IQ.g.`...'.@.6./y.O.'.W.....T/0....#5-.5}!..=5.E...T7553...p?...H...L"#.....l....:..js....m#Iu.....@DL@F.;.$AG&..A...e.r...#I.Kvp133s.....>..f...td...o...:b..1..d.V-I.....1a..Z.....w. ..s..........]4y..}..j...m#..$........;..$I.$)R.....l....... ).$...YDd$73.<1..;33.TB.....?..$.$..E.#...~.o.n.D..$I..j..3.s.......0.-[.X..`a!.. ...!.FB#..L:k.#..3....m6..@..._.B#.......y&z.@..8..t...o...9........|..t.y..n(..`r<.L.g......b....E...'%M...."L.(........{.#..[b@...#...'..0@..A......#...L...^2.....@..s...YG...Rx... .i..Ld......0.3...o.W.....8.Y....A.LB......_.......I.%.%....9...xf.F..*.`.....L..`.P.5. 1...(<......".. .......2...S.F'.h...x.D.....bD........g.$.E.H.5..W.7..93..`g.8oib.....(.t.....',.g..X.....-...Kvxn1<..\..4o....p?.@....v:f...........,..822....j6B.....C6.B..Y??......c.!.u. .....0.....x...|i......|.......1.^.5.....\.6a...Bx...q..l.4..-.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1723

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7306
                                                                                                                                                                                                                                      Entropy (8bit):7.474727169635241
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lM1oT57UaViKxYv+fHCX8fdwWmnGJcmTdh:xFgaViaCsf6pnGJcmhh
                                                                                                                                                                                                                                      MD5:0B7AEF6A4E1E9F2688C14B95F37EC837
                                                                                                                                                                                                                                      SHA1:298A3907815FF39CBE7E5B23586558BDA092902A
                                                                                                                                                                                                                                      SHA-256:87DC286C6979BD56C0B0AFB2C1801065ACB7F2A26E6C6FAD02FE034B40C9D677
                                                                                                                                                                                                                                      SHA-512:0D2913408AAE248295F41D66FDC5BDACA2BAE2441BF475CFE465518EEE5C5F251E366C4FB54C7F52171553B28EC0F7E540FB609229CDB340C607D6C4DEADB5AE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx.....-jC..............2.....h....:.N..6+.....@!Q4......x...........{..s...=..v..[...j[Umq....-...T[....:.l.l..m.mK.Ue...v.Ykw.k..m.1nUa...^.f.....z.?.~...O....g...?..}./..'..}}?..u..W.T........@b.....B. .@........l..F....|~.....o.....w..>........h.0..........a........`...............l.....n.}.>=..._.......[.......Cq.k..T............P. A.((4.$..aw.$A......h3l3.9.>.......>.qo..z...NC.P.l........$.eAJ...P......7D..s..........l.@.:3'.....y.......o.Su........-.,....P#.f@.... 5,`1.m..&h........@P.S..cG..v..u_.....P..0.....3.2B...0km..f.... .C.i..5.m.&.6iVUcvwi.....x...XZ..^=.].X[.\..`.Y.s....@1.Z3 `Y...Z...t..t....@. .....Y.S.^bE..$..Z...m..l.`....[2.)....#...2...!.d.........ll...-+..r!...$6...3...6.2.......h..``...l.........6b.....B:..sY...3.Vm.@.......H.0a. .. ... ... .@....T...XK...uQ....j[.m.%UAE.@..j#..mJ9.-.V.."v..!.\....e.....R.n........h

                                                                                                                                                                                                                                      Chrome Cache Entry: 1724

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9176
                                                                                                                                                                                                                                      Entropy (8bit):7.970220101372775
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:VA92IcJrAWysjlPKg3XgR7tpNq210yMuoH:w2LJrAWlPKN7lyyMZ
                                                                                                                                                                                                                                      MD5:142ED5C2079703418AB9109166198B9A
                                                                                                                                                                                                                                      SHA1:BEBF40E3E81C11BBB4E2702489BE24960BBEE0FF
                                                                                                                                                                                                                                      SHA-256:B428FD1CC7ACBE925E7962A3F11632F42FCB5425DA84E76180A054055CC850D2
                                                                                                                                                                                                                                      SHA-512:A1685C776307CABA705CC25E5727F3FE80DDB119D685233251DE15EB12F4B31FE40798F8C03385BD854F77F3B33E50C7A5557139336FEDCD52CB6B293BBB3601
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..#cIDATx..}y.%U...qN.vWWw..4[......;".(....n..fp\F..F.y.....DA...`P.......*C.....{...9'3oUuu7....K..W7+.q"......^xl._0...z.X/...c.`......^0....O|(./.k3-E.m.....K....n..sg.iO)-"z....[.[..~U}..E....-....[..[p+.....y...yv.z.....O..*...d........Q........|2V...`....]....B.....A...;3.B........w..Z.|.Z...-L.......>..DY.....q.+`I..<SL.....nN.J!....0...WN.#v..l.aR.Z$..@e4..~../...S.:....73z...fy..D..D@..O.b.........z$.B.6....*.P.jx.."w.3Lq}.TAD.10.}n...JD.J.E.p...P......r....u.U.H`....O..).1..1p^........g.....C......J`M.E^....V...H5..`....[..........2..c..Rh.........H.d.<.~..7o...a)_.....~..^..1T......{V.rR.d......%.t..0.cd=.`_.&..c........!...2T.el....*...7..l... ........w.....\[.V...A^K."..d.....HHv..EyP..ia.C.S #.7......9."....J....3V7K.. a.sc.&.*..*@."f6..%QH0.R.;... ......}pFT.........KS&.^6..W/..!.g..(.T:.!..p..K..X.Z...T/.zr...N...=...r.H..%Bo

                                                                                                                                                                                                                                      Chrome Cache Entry: 1725

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65324)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):127616
                                                                                                                                                                                                                                      Entropy (8bit):5.074372300728969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:C7pIJNT4kyEIA1pDEBi8INcuSErOY/uKFq3SYiLENM6HN263:C72a4GMq3SYiLENM6HN263
                                                                                                                                                                                                                                      MD5:4A06316BF34E208892E55E080848AAEE
                                                                                                                                                                                                                                      SHA1:069AE98189B1A33C3EAA923CD8A8EBEDB89C8C37
                                                                                                                                                                                                                                      SHA-256:E3400E3EA6C68192EAD1F3ED3B73ED718742596E653370E25DCBF279DFA4E8AD
                                                                                                                                                                                                                                      SHA-512:DD7BD1828B73D5D29620805F11AEB2A79C23FD5681F43AA51C1212D78F4829E3D5CE3454131384ED743518456BB70D1343FF66B36063655793CC6BA23687A552
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/css/bootstrap.min.css?v=2
                                                                                                                                                                                                                                      Preview:/*!. * Bootstrap v4.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 The Bootstrap Authors. * Copyright 2011-2019 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace}*,::after,::before{box-sizing:

                                                                                                                                                                                                                                      Chrome Cache Entry: 1726

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11068
                                                                                                                                                                                                                                      Entropy (8bit):7.89000662153038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4sSokgQGGSRXdbILGUfuMNrIIsJeUMVhjfSL6ZLNyqHGDAQZxjMNZ2G/VcHiATuI:lSzSRN8yUVrWMVhKeEqUO2GqRu5DcyY
                                                                                                                                                                                                                                      MD5:0470DABB162011AA9B2861983301EF39
                                                                                                                                                                                                                                      SHA1:F17A1B262C4F244DA27FD3FEA070A14BBDD80CBD
                                                                                                                                                                                                                                      SHA-256:A2FC770895191CB47AA748222513ED545014EEE613CFB1D241DC47DF3B08DF0C
                                                                                                                                                                                                                                      SHA-512:6B50D2B5A17413DCB76BB4E63AD16D24CA33BF1EAD88AAB360EDE00C7493D8504180D56D173F23AE1DFD32B882E98D7B31E89530B8DDEF4509A37939B8BBF9F2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/flappy-golf-2-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF4+..WEBPVP8L(+../c........M..M....v...........=.m...S......o.....u_..n.6s........."...kW...........I.......^0.$IJ....g.W...1xP.6..r.0.!.=r....k.(...<:..........0...7...D...0.&...HD G..s..1D...+od..1.....H.qg.Y.!....:..oTC2......P...?%r.C..jj......'O..*f. .../".W...../..E(...6..?..{.D.....B.)...T.`.mN*.k..c.jI..:.}.bffff.....@U.J-...... %3.....-.{..E.<K...m[.QJ........y..f..?`....<....0y..c.1{o..R".om.m..S..x33..*..uF...l.v`K......Q].Vo9&..m.$m..u..="22..utU5..>m.m..h.m..a[.j..R..o.z..l...m..z.d27.9p13......./.X......8....$....Mk....p..y..;.........m_6N...{.9b.$F..HRd....3..3.U...1..x.X....!..]..}.....}...f....Z....s....z...K.l""...........`L9........r}'w..N.&.... ..).Y..O.>2Z.....@,..".@D(......7..~...w..$1N..EA..D. U"".`vn\....*.....@`.."@.L...u.w......Z....(..A.....02..$F.=.}.Wgn...V... .....E...<......A.ilH.IS..........T.T..R.}.c}h./G.U.;4....;H...4..]...$.F....Ts......%.......%.DI"u.{...L3...v.........J..u|...P...(..@..C

                                                                                                                                                                                                                                      Chrome Cache Entry: 1727

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):160
                                                                                                                                                                                                                                      Entropy (8bit):5.15458805244323
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:U3yGqItEsRGD0twQyGnyaDgeDQggp6ngQjMHIGfYjP69LBgpRf:U3yGqIt7DtwjGnyac8gUMbfYO1gpl
                                                                                                                                                                                                                                      MD5:DCBD642F259C6F45EC1A2BDFA9286BF7
                                                                                                                                                                                                                                      SHA1:C9320D9138BB29677C40884737B4C99F5AAFB645
                                                                                                                                                                                                                                      SHA-256:33949E102D222316480736A4E8121FF411F2ADC3D05BBE2D41B033BA294B2D7F
                                                                                                                                                                                                                                      SHA-512:EED46146EF4EAC9550194584E0D1A6A9C920DB1A81C496072161C1B4177699CE319D9321A210C221CCC73756B1F94E6C3E9512B4E15746DAFF75DC8D4069E334
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://rules.quantcount.com/rules-p-NckurUNbznaCm.js
                                                                                                                                                                                                                                      Preview:/*. Quantcast measurement tag. Copyright (c) 2008-2022, Quantcast Corp..*/.'use strict';(function(a,b,c){__qc("rules",[a])})("p-NckurUNbznaCm",window,document);

                                                                                                                                                                                                                                      Chrome Cache Entry: 1728

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):153156
                                                                                                                                                                                                                                      Entropy (8bit):5.313184589772049
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:PpbrUzacicmSKzO9R0cFMX/kC7dCqGjHlUHNaVcZRxRBA04VKsuntF0dTGgQ18u5:Wza1ke70eNaVGAvkF2kl
                                                                                                                                                                                                                                      MD5:2630B3D7AD4A41FAC67742216E506D83
                                                                                                                                                                                                                                      SHA1:DDA36227690CB7C9EC74DE3667DD595D59FB8EEC
                                                                                                                                                                                                                                      SHA-256:CD5EB76033D96219A0C4FE45FB0DF10202E1FEBCB4D086FB1305F1B3304A6B1A
                                                                                                                                                                                                                                      SHA-512:DF4BBC981FDD148A6EC0E97CBCCB16B66C9054EB144A6055EAC76A2B34FEFE071617E6AA00338A7D2C990ED7D521BA1FB95D086C20B4A37BB95C0820C9B9124D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.datadoghq-browser-agent.com/datadog-rum-v4.js
                                                                                                                                                                                                                                      Preview:!function(){"use strict";var t={log:"log",debug:"debug",info:"info",warn:"warn",error:"error"},e=console,n={};Object.keys(t).forEach((function(t){n[t]=e[t]}));var r="Datadog Browser SDK:",i={debug:n.debug.bind(e,r),log:n.log.bind(e,r),info:n.info.bind(e,r),warn:n.warn.bind(e,r),error:n.error.bind(e,r)};function o(t,e){return function(){for(var n=[],r=0;r<arguments.length;r++)n[r]=arguments[r];try{return t.apply(void 0,n)}catch(t){i.error(e,t)}}}var a,s=function(t,e,n){if(n||2===arguments.length)for(var r,i=0,o=e.length;i<o;i++)!r&&i in e||(r||(r=Array.prototype.slice.call(e,0,i)),r[i]=e[i]);return t.concat(r||Array.prototype.slice.call(e))},u=!1;function c(t){u=t}function l(t){return function(){return d(t,this,arguments)}}function d(t,e,n){try{return t.apply(e,n)}catch(t){if(f(t),a)try{a(t)}catch(t){f(t)}}}function f(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];u&&i.error.apply(i,s(["[MONITOR]"],t,!1))}function p(t,e){return-1!==t.indexOf(e)}function v(t){if(Array.from)r

                                                                                                                                                                                                                                      Chrome Cache Entry: 1729

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2310
                                                                                                                                                                                                                                      Entropy (8bit):5.297015910664458
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:cnOEaV/JOEaVdRVc+oDOEaVWN0oAnOxMaV/JOxMaVdRVc+oDOxMaVWN0oD:cnOEa3OEa9Vc+oDOEaMNcnOxMa3OxMaG
                                                                                                                                                                                                                                      MD5:2B63CD96A1B830EAD309E7054E930658
                                                                                                                                                                                                                                      SHA1:8290234B198C9AF1AD77C45D11F1DBD186A34334
                                                                                                                                                                                                                                      SHA-256:38E42A9A323FD44FE86F0DFE5F7695590E6D4E4B3C016E30031DBBAE5171DF33
                                                                                                                                                                                                                                      SHA-512:41F7859CFBC9D9A1150FBCEC276421804891A9857848DA069B7C273CD615F3C15C3ABF39688FA4A9DB6559FE016E081CF74495C7157B443E780C42137516E6D0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://fonts.googleapis.com/css?family=Dosis:400,600&display=swap"
                                                                                                                                                                                                                                      Preview:/* vietnamese */.@font-face {. font-family: 'Dosis';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dosis/v32/HhyaU5sn9vOmLzlnC_W6EQ.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;.}./* latin-ext */.@font-face {. font-family: 'Dosis';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dosis/v32/HhyaU5sn9vOmLzlmC_W6EQ.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./* latin */.@font-face {. font-family: 'Dosis';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/dosis/v32/HhyaU5sn9vOmLzloC_U.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152

                                                                                                                                                                                                                                      Chrome Cache Entry: 1730

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12872
                                                                                                                                                                                                                                      Entropy (8bit):7.96021268619456
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:FLppudpdqWE9OwNxn5sC6wjxdwk6BYgDhNoa4ONsmGCJZ7+Y64MEXdUZ/O9N:tp+ptiZsCrVdwNYgDg0GCfS4zNCm/
                                                                                                                                                                                                                                      MD5:0F596BFEF65BE038EC40D0BD774E2218
                                                                                                                                                                                                                                      SHA1:9DAD19EF9976DD076BB820BD4C2AD9976B3118F3
                                                                                                                                                                                                                                      SHA-256:99A58B50D87D0F72231A3BCD3071A25065939BBA47EBF6B4CA8CDABF57E03B74
                                                                                                                                                                                                                                      SHA-512:00EB9FD72DB13AD3D4487F35B13F5D8E8C83E01144570BC04C2EAB0D471F926F95CA32C3BAC7C8A39967FA41AC7C5F016F8C5261675C9BB3B1272BE7EA92D13C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..1.IDATx..}g.\.q.u.7]...~.C.I.....E...V...~..~.BbP...;...h[].<{.F..41........Bw../o..'oQc..p.1.Rj.A.7^qOB...7^z......C...o.{....,I.<.1.R..jz.K/.../......z....[...........7....,....,..,..8N.......\k.y^.R..pc.].E...Pg!...Y..+...?.>.H-.F.....,/r%U.di..]...Z.....Z+{.E1...,n..9.....1.k.s........_..J.f3.....k...R...PJ..J).q....TJ...z..n......-.......a..e..G..h........q..].i.^..[..F.........}....Q..l.v.4.,.k..5...R...=.K...r..OeML.J9..\.-.JI..EA.Y....9+.b:...s....._c.W.6^..q...v..y._5.>p}...8#.b6.W_....X.eGGG'''.Z....1.Lx...<..Q._....Y..^.6P..q..O.q.J.....F.ZS...I..R.y..GxgB$Ib..B.E.....|~||..*.J..<."k.....<.Y..M&......m.h.%c......xnh;\ x..;./..k...PJ].%.$i.6%.......J)..S.T\.UJaTB..y^..............1f.X.!.4M.$...y./.....<.j.Y..!.....u{.S...K).{....R2.0..5_?mn.|...q.8..}...........iQ..(.q......................,+...?{.,I...H.Q.v....(]....].W.K.q]..7.<..}.-.n..~Q@.%

                                                                                                                                                                                                                                      Chrome Cache Entry: 1731

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3378
                                                                                                                                                                                                                                      Entropy (8bit):7.94173308913584
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:jZrsQRm47R+jG8UfLEQKuE0doKihUcXeXwC:TocRL8UfgQKtKTcOXwC
                                                                                                                                                                                                                                      MD5:B00CC83F16E52E6302ED20A3D2451894
                                                                                                                                                                                                                                      SHA1:1A9CC10DFF8C93DA29ED6B6961458B4A375740C8
                                                                                                                                                                                                                                      SHA-256:B6565925B2A5971A84EB22D895015104F78A77FA4CA305866BC02571C4CC2FBD
                                                                                                                                                                                                                                      SHA-512:FF6B34AB290BE50D9C15E85785C785E80D507F0D64CBB4CFFA7D2AC65DDEE3F8689966A5CE9B1FBBFEEAF642EE997E304E525FA337A68BF8AC22ADA014CC439F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/microsoft-powerpoint-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF*...WEBPVP8L..../c...M0h....>..}e....._C.......X.'....M.M...5.`....|..m$IN.D.....3Q.?.....$......'..m$I....-'..&.L.........H@^.R.....I..B..H!...:......7..Wtk..Fo. q.u....<;...o.,......g8.*...ARQ`G.<.W.W....".../.l....v..eff.Cz.._..32.).......3.,.4T.K]...^........8...}.........mf.FGc}M...u.gv..Q.'4DGT...g.yt%.. ).....C13..rF....Bo=.a..2.r$I.$..{1..h...v...D..!P=.w........C.'HD.H<.'.."....G.f..D..F...CY.i.|.D.'........b.P.De.n..-.9....;6...8|;..,..\.M.....O.Y...X.K.@on..)''..yO4.\...+u.........]..Nn.n(...I@D1....~r..c.G...o[-.e..W5.X........k7......9+......l>..{...[...?Q....e...d...j...#..O.S.m#....6..;.P....I*.|..@.8.....&.......uT.&5......TW.&(...s...P....m.I.".....W.\.zg..W.F........m...l{x..5......&.P.B.>I.i.n.f$....4.f..u..B...v,....x.. .....{...3)B.Z...._T.\.eO.)Z.K..H.:O.b_..0N6..H..j..#.??.....P .0.V.M.YeC..pP.r+...FU.TbB..].vb.w>.x.0...W.....K.._RD%`Z.s.]/.V+.%1k$.....>.6........$b.4.].;....i.fp.Z.,.n,n..c....[z..W..V.@v{.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1732

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (416), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):416
                                                                                                                                                                                                                                      Entropy (8bit):4.865117647678812
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:20uhQxidQTYVIUO83Z1nYxtQ/R16Rp3P2Nn:2PhQxidMYVRJ1YI/n6An
                                                                                                                                                                                                                                      MD5:A8911B3362BF5935C0B8942FF31E21D8
                                                                                                                                                                                                                                      SHA1:D1BF600CFB85EA668868C3FCE3CBEA54F6D80855
                                                                                                                                                                                                                                      SHA-256:EC47E6472651559CA723A66EF956E8B17527D80EDC59644BE04633ABF4516786
                                                                                                                                                                                                                                      SHA-512:A95ACECA86AD4DE49687A5B08A2B35CFB0A8C0761CDE58D08809E89F293F5AA698AABBAF6031CF78944596A4B0DECAD3F6C3E95309673D8CA617C7ADD5D06268
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/js/search-header.js?v=1695907987063
                                                                                                                                                                                                                                      Preview:(function(b){function d(a,b){b.stopPropagation();b.preventDefault();a=a.val();1>a.trim().length||(a=encodeURIComponent(a),c=c.replace("search_placehodler",a),window.location.href=c)}var c;b.sheader=function(a,e,f,g){c=g;b(a).each(function(){var a=b(this);a.find(e).keydown(function(a){13==a.which&&d(b(a.currentTarget),a)});a.find(f).click(function(a){d(b(b(a.currentTarget).data("inputselector")),a)})})}})(jQuery);

                                                                                                                                                                                                                                      Chrome Cache Entry: 1733

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=LE1_OtIRXO1LuZJBl9PiDpoQMVI&google_push=AXcoOmRH8XosD-8iVUIVVoRfYp3I1tmR6aLIpw0IwYdy1ip8GgialU0A23pyJrMa6XUSirAdUWhGfQojtYJPuyfpujwEzrVT1aNr
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1734

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11753
                                                                                                                                                                                                                                      Entropy (8bit):7.972801201850515
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qD6QJxl1339GN5kRiE/TfFhL3cgWIVLdw32DiR3piYM3FCpdzLaBI6RcSp3o37rr:qD6ID33FYAj3WIVOGDi7ir3FCpRLb4JK
                                                                                                                                                                                                                                      MD5:C8803CEF274836957BEBB23E53C1DD84
                                                                                                                                                                                                                                      SHA1:5F37D65F2593FDFC2D37DCE6633399AC209538C3
                                                                                                                                                                                                                                      SHA-256:4B16E804BABA0CC6271897BF82A4495A7A7276964CFEB121551CFBBB13F9399F
                                                                                                                                                                                                                                      SHA-512:28FB0D02E2544F0CDE2AEE4DB79F2CB726523153432DF09FECA40BC822E70495CFFF850C7484B6A24CC7849CAAB192BDE378178BDFE8DE8AEF3D284EBB35FAB4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..-tIDATx..}i.$.u^..:....>... ..H,...H".YTX.hJ...#HK..v......b8..;d;..d."A..."A.)P. ..op.. ......v....<.Y.....gvA..........W/.....L.R..y\.A.4...z.Xo..................@......;............5p.C.x....u..eD.{j..s.0l..5p.*9..u......,.-H.t.s..c.R..c.F.$x.)......2.#......k.i...1..fM.........B.qlY.....B...i.....3....eY.....8x..=~^....g.F)UJ.....jr...~lcc.u]J.Hr0..Wa..j.N....+.J.T..J).(..^.+.l.V.9'....Z......l.ZE....AP...8.....R...m.F{..n.[.T...S..A9.=~...W..:.C...0.R.q.n..hD.U.X.,...+...8...f...m.I8.B......i..<..\._t..8..c.R..l.......F..ns..n.....I.iKy...q..j6.B....(.#.aA....B[+....^..R....~...{.Bloo..4..yx..n..n.!..T.G..9.R79..p.EqD@..u]t7BH>.......m.1f.f.E.N.s..l..N.?.y...N.....~@.........72..x...i....0...i..(...a..RJs........}|.RJ.0&&&...;B.J)c.G>11..C.J).0.,....8.|.....Fa._.....coo.u.0.1D....a.Q..j.(9...&..?]z.3.....F.!..s....a.....8..........m......r.nvvv0+....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1735

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8646
                                                                                                                                                                                                                                      Entropy (8bit):7.82591434636054
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PFOVSHgIvuBDzNtI2gWq+0LaEHwqjiOwIiHiviXRlRE5N/A7v7uR4:d4SHgauBVtI2ureEHnGOI7v7ua
                                                                                                                                                                                                                                      MD5:923FBAE61245079717232AB1C5709D18
                                                                                                                                                                                                                                      SHA1:9BBF4F8079135797A1E96B9F0FA03AC7086CD19D
                                                                                                                                                                                                                                      SHA-256:6DAA98A3ADC2C54B547E864CB8B4CF52FC1834893C75F33C2EF28499F8009873
                                                                                                                                                                                                                                      SHA-512:36AC082697559BEC22266E33A6F542AF6FA6BC057CC5A6C388BC80670E4FFEC4F068C8B86EA4386AEABA60DA6953C7E1B0173F69D43B5E48E9A87DB03711B2F0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-funziona-gmail.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........7...................................................................../..................................................................................................#".........................e.Y.>!.L.Yz/$.k6N..[.td.yv.2u6wq_....]X...^....z..F.~. ....................s.C.|.s.Z.o|....@.]j..:...\..>..:^.........................%Td......o...[...-X......iF.24.../h..cP.;o9.}..w.!.[.~.Z.t^W.>e..-s....Gp.................,o...Z.....~5.=...wY^...y..?K.8Z..........K.T..8.....j..>F.x..hz...s.....)...b5.0................0..v....^..6.........78d<G.MG.k....r...>...|....@..t[.{...t..e.>v..K..../t...~kJ.Y.....W.y/n.].................'M8Y./..}..+M.zo.;A.ou.........1~.....}J.S...M[q........V.|..<....t.r....L8Wv...(lz.!.E................!..........^../..].t.w.....]...\..z..x....^.>.....X.#C.z.5.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1736

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15259
                                                                                                                                                                                                                                      Entropy (8bit):7.973682020388709
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:pW1+buJqxCE5Nu1/YuOMbNfNNfCMkEesJw:NuoYFYubbP8/EesW
                                                                                                                                                                                                                                      MD5:EAD6D91C34585909FCF4F725BA726EB5
                                                                                                                                                                                                                                      SHA1:21296AB924D4E235E1211D0C537D22AD2855E5CD
                                                                                                                                                                                                                                      SHA-256:9EFA2ED0A06D4D37E36E285A0E29F67F5C5F3CD31DAB8765249C963D9802DD55
                                                                                                                                                                                                                                      SHA-512:AF91452A3A350D4ED41D22F300303B1D08FF2075AB4669159E932B3EEBBBD79641CA7867578EFF8017784595C9E394E476247D9B70BFADAADFAF16E867CA60AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..;&IDATx..i.].u%6.Z{.s...:..{..).#%.jl..}.2.j$..{~@~A.H~D.@2.%#.U...c.\V.U%..."E.b.. ....6..{.|.....,...5.].f...5.\.t..W...0..."......;IZ2..W0@...'h.....c.8<.........K..........A..$.w...[...?.Y.o.'.{x@.`........|..~...;..no\.n]..UT.3... .....We.Ld....t..N.......%..;..\....FN......t(\.wW..f..m`....tr......w.....l.&.RB>:<....o....m1H.....|...38......rH......iu..~y2?L......f!L..6P..R9......!...s|...`..@...p..N..1`.....v....>..(.{).w.;.v...<8.V..~.....I...wf...K~...=r....}k]X9....T>.....80Z2.P.........2...M]5...R...$O.......|.i.Z.R;..xv.F.t..$..m...X.D0..0LA.<}..H.Q@...ZhD...EZ..o..~....A.:Fg...:.$.3.......s...w..w.....t..$#..Nq_...q.,.1O....]..[j......wUm:.C.Y.$9Yl4.T5..j.].!.y.l..\....D...q...*<.4.{..R..C.!8.... Hwo.[O{.. us..<.]..o.?...4:=5L..%...-.A$..cT..=.4o.................`..C..x0g. ...}..g.f.*..vw............>5..24....77......;.s..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1737

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9166
                                                                                                                                                                                                                                      Entropy (8bit):7.95616991875281
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:XGSBxPCkW4r677jijGLveiYwxLU704sKAMx3Ay2utAU6hp/7POS137:xBx6Ld7qGveiYwVV4sFYEjp/7Z137
                                                                                                                                                                                                                                      MD5:9BCBE5DFB93034FE338F2C2E6D2667B5
                                                                                                                                                                                                                                      SHA1:AA4B4768B4E3D18D64C59C7A914E86BB4BFD29C4
                                                                                                                                                                                                                                      SHA-256:0A6D461A0FE5520D10CC76D975C12519A1165D25A8E3DC322D0022A9B228A56B
                                                                                                                                                                                                                                      SHA-512:F91981115CF99DF14C0326DCF1C5E32AD82228C8CB6725C018E59B3EAF1951E216BE97AF8BABC4E3ECE8EAF0C3C8E069F90A03A67D1B90D88965A86D94499F0D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..#YIDATx..}y.dg..9...uky.^..z}.m..;.ch.`.H.......h4#.Pd..)R"...!..@.D..!%X....<&#.`.x..6m..6xiw.......wN..n-..V.z..C....[.;....\...p.#b..D.......#G.<...O>..k......E.....[....7...k`e...t../.8>fq..M..-VJ.J.....s.=7.|................s^..f.."ZYYy....o>.....HDD.O.Q...?6b.o.L......w.}...n......:....V..)..y.}.k.>..1Fk.N.....\.r..^......Q.....F..C....?...LOO[k.R...7.e.@.G.y....g.0..k-3;...Xc..X.....1.B..P(|.....>.o.>.4"."..lYi..C.}.s...ja.v.3W..$V.N..?..vWv.....Ddcc.......o.>._..+ ...?...>..v.].T.$....<..8+..(6.|.v_.'...4M.........0..W.233..........#.>....J..q....{......o..A...+99.....W.<.33s.X..3..T*w.~.".".Q.x._<....OMM9../P..<....o@.'.....q...y...;.."..N.tjj.......5........?...0.....oK.'_<.J...hvu.P...3#....7..o.Y.....z(..b.8.J.Jg.#...e...}..0.......@..@...Q.QD....a....?>r.>z...O?..r^F..lK...+Q(W...4...Y..& .%.A.@.@@A@.z..Z..G..G..m6...9.0..&...Q....r..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1738

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4686
                                                                                                                                                                                                                                      Entropy (8bit):7.780853505458436
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:nmR56dK5Hw61rFbqfrthCMs6cJa432gbsV/OiZy8IoAm9:mR5BHw61Zwho60FsOiZy89
                                                                                                                                                                                                                                      MD5:8849FDCBDF01479261F73FFA8BE1852F
                                                                                                                                                                                                                                      SHA1:22A005CA09AEB189DC3322D9B378B88D32449F4C
                                                                                                                                                                                                                                      SHA-256:EC62CA908D91020AB90E23EBBFF4B79B0B72624E9EEAFEBB3C0992579825CB06
                                                                                                                                                                                                                                      SHA-512:CB778827D7B9C13CC88CA6B39BD7A9D532388F87FE1ACD1CCB6DD8C2901C1B3BB607E45D692586994260CAFEEA4D87A861270E6B9F0F45F9411CDDB596143600
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/carbon-copy-cloner-ccc-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFF...WEBPVP8L:.../c...M0h..2.=...w.....V.&..4..Y.H.5.(j.%F.`.Q..."................8l.@.m.*<......S......X..p.hH....8.I..."..S.A.C.".tD.([.&....m....U..#...!....x]....'f..3C.cf.X...PwW.....F.f4...(D.$I..b.`....tO.d.%I..:_f ...'Z....`..d....@......2.r..7........E....0 ....F...F.................#.. .*.....4.........4..F.......o......C.gd.6..Q0....a.&... zN.2A.0`...0A.f~..xk.SgB L.1FT..(.X#..J.'.t..6~......L...x1cN.*Nq..f......b...300P(t..Ie....?.@f.s,p.....y.O`...0`.......;...q.......<'x*.....0f?........D>0Of...1.L.<.|......Da........B..0.-......'y*..<..>...;...:;..n....]q.....c....4<....P...x.?.........0C}...x.IT.L.tLGb.%`.........\.*..\a.8.HL...S...$.....1c .@b....D<.a\,..V..T.*"..U.d...!.......@......c.].....].,..jR.uT.>.H..b...@B.....T......Qq....#.9..V!..;G.1....T.......&...@`L`.b2.....IL...D.L. @......".%...*`..B`...E.W...,0,.).....MH.#..:e.".&0.........X.DT,..h.9F....h..b:..j...d`L.b..@`.1.'.....N.0C...8..K,.i..@0P.9.&c....,.T..X..M...f9..h.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1739

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9389
                                                                                                                                                                                                                                      Entropy (8bit):7.974490661582072
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:/n9/l4xfDtvLa5GngcvMFDWIOsif0T96YMbMVQf6WLYvPRw8AwutX4gaA5APm0:/9t6hDaMgnFDWfsuGNmt6WLYHRUwuS9N
                                                                                                                                                                                                                                      MD5:560B6D61123F06D9E8FFAA3A813E6DAA
                                                                                                                                                                                                                                      SHA1:16FC37BCC44E519FBAABB4CF3FC8D02688CCF934
                                                                                                                                                                                                                                      SHA-256:8188B05FF243AECEF2C700C58BC16E9DCBBC701290F48F258F1469D554A62F5E
                                                                                                                                                                                                                                      SHA-512:99B504CF7DDCC897B235D30A14DD79F5122D042955F369E8CC3467BE7D8916DBD2607C8AC10B90F5E38AE8F5D6BE5CB44A5AE0FC87C06117316AF425384B0D6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..$8IDATx..}.x.U...M.e.;3...H.".(U.........|..A....;..).HI... ...!..J............4@..y..f.vf.y.9.9...n..!.jl..T.I...[a .N..`..C.|.N.E..N..d.:...+...?<.~.5.B.@..,."`..aO.g..X.".+.g.......aY.d2...v.0.L.V.........S..I.'..O&.+....*b.)...O.l.C0.>......r.Ru....m<:.T.....m.\Z.M..l..NEU.SI.5.............p...#..].~..O?.4..=....8x...}.....M.........A...... 1z....}|......`...P...Tm..O.ekh..2.L...X........wwwQ....i.....6....a'v..i.t*:..u._l.M1......l.L......Y..OB.T*.H.@.%.!...X,..E.....$..D".>8.......n.J..iP...8...d.-....F.eY....m...w.Xt..w.h..Z.i|.yp>...+.S#x..[.,.P&..l6.@}}.._|>t.`..x.....'.....M....Se.......A.eY....---_|......q..R.....C".I%".T$...!.r?r..!.I.......?.].C.X7.ru.\.0..R... E..*,4L.4....\&.H....H....C,...+.%..L&&.`.t.|.D.........K.....[W.X......d2.....G........3s...d......O..?...dE.....\...l.i..}..Ri.\\<..L*.J1d.H...0...T.$...`...(**.9b..;.L.%GB.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1740

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):33
                                                                                                                                                                                                                                      Entropy (8bit):4.35485207383835
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YJH/eig2IK:YJ/eq
                                                                                                                                                                                                                                      MD5:B87D12557156DAECF8040372F8C4DD49
                                                                                                                                                                                                                                      SHA1:190581EBF6C1F30A087D3BA24EF221D3EB6509A9
                                                                                                                                                                                                                                      SHA-256:F3FF8186A7279D03FCED45C1A62EC6D912BDA30B1B668B2B91227DAD60E0FEA4
                                                                                                                                                                                                                                      SHA-512:D676564096C66D523E3F2964CB2C964EDBA9847C603AA608FC4ABECDF4B4B8A6AAD65194886860A101342E2268FE32C6B713D7A6F901DBAD3437E0247B6409A6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://lb.eu-1-id5-sync.com/lb/v1
                                                                                                                                                                                                                                      Preview:{"lb":"8Y0SJQSv4GAXJZ4IQCGmeQ=="}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1741

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5771
                                                                                                                                                                                                                                      Entropy (8bit):7.567559413357578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:emfPJjqUcK1ozVNg3jhp9+dxfJ2zVBwa3DHhRboc61aWL1k0RguoNAT3yR:9FqUqzVNgTdecB1rhuclWLwuoNATe
                                                                                                                                                                                                                                      MD5:BB94D1B5CDACAD862D1CE68EB1E71D3F
                                                                                                                                                                                                                                      SHA1:A27FA1FBBC31F416A8CF9E4349C73D496C6EACEB
                                                                                                                                                                                                                                      SHA-256:4A409DE6220135EFE2A8A3BF7CADB079A2357C1D19A7CF66BFF0CB2049EBEAF8
                                                                                                                                                                                                                                      SHA-512:A09627BC370D037F52CAB22B9306372A6E812D0C59A5B7E28F97A5EED51D43BDDB84E82D0CBB30DBC41C7A8067F3716A22CF86934B39843A2F70C0A1FF09D8E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-usare-aruba-pec.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........5..........................................................................................................................................................................................................................|..w8`$.......................1l.......9;h.vDV.cR|...e+...\...w......................{<vd.h'g...Ueq......>hxY.-I..R..<9.e...........{|J..H....................v.....s^b..{V.2..;./2SH....h...*...kv...2........:.........................I.y..S.z...-.;..c...uj"..>J1.Yb]..-..............................u..y.P.t.w........u..F.......-....n.Gh.........................Y.g.|....k.........................S.WC.. ........................H..l....,..Q.+...8.>\N..m...c>..k.......NK.t.c.~.*z.....................I{f_f.}...s3...U..c-.L.>...Y..J;?{r.bV'6....@............................................

                                                                                                                                                                                                                                      Chrome Cache Entry: 1742

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (21914)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):57513
                                                                                                                                                                                                                                      Entropy (8bit):5.07702711242518
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:Xugq120spmYjfsSqxHowWtsSvURPQH0vE6YxkDda3x1KxuCYOjF4kN:egZ0AOSyRPy+0Oh
                                                                                                                                                                                                                                      MD5:0A54E842E3E395E6B9FCF6893283A105
                                                                                                                                                                                                                                      SHA1:E96D27E9C036DB495B6FE00CFC8A0371D7AADD74
                                                                                                                                                                                                                                      SHA-256:472C7748607B5B76986BB54FFE3FE79EA954F61705AABD2A0FA80D13B2EEE46B
                                                                                                                                                                                                                                      SHA-512:700F20720B5827E258A947BE8F625797A2778DB6A670C41F3DED093A64060DEB1C77ECEA5F0C209DE0F39E239DDE4F0F70EEC4B535BA8C0ECBE01871D37497A0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/js/flickity.pkgd.min.js
                                                                                                                                                                                                                                      Preview:/*!. * Flickity PACKAGED v2.2.2. * Touch, responsive, flickable carousels. *. * Licensed GPLv3 for open source use. * or Flickity Commercial License for commercial use. *. * https://flickity.metafizzy.co. * Copyright 2015-2021 Metafizzy. */.(function(e,i){if(typeof define=="function"&&define.amd){define("jquery-bridget/jquery-bridget",["jquery"],function(t){return i(e,t)})}else if(typeof module=="object"&&module.exports){module.exports=i(e,require("jquery"))}else{e.jQueryBridget=i(e,e.jQuery)}})(window,function t(e,r){"use strict";var o=Array.prototype.slice;var i=e.console;var u=typeof i=="undefined"?function(){}:function(t){i.error(t)};function n(h,s,c){c=c||r||e.jQuery;if(!c){return}if(!s.prototype.option){s.prototype.option=function(t){if(!c.isPlainObject(t)){return}this.options=c.extend(true,this.options,t)}}c.fn[h]=function(t){if(typeof t=="string"){var e=o.call(arguments,1);return i(this,t,e)}n(this,t);return this};function i(t,r,o){var a;var l="$()."+h+'("'+r+'")';t.each(functi

                                                                                                                                                                                                                                      Chrome Cache Entry: 1743

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7613
                                                                                                                                                                                                                                      Entropy (8bit):7.952350864667237
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:r7G5rqxC2O06jKH7vLBKuctS8PX0HRLiqHy5MivOYyObk:rq5rc7vLBKVnPklikimabk
                                                                                                                                                                                                                                      MD5:5B71C0CEBB2ECBDF17D1AE5B415BCFD6
                                                                                                                                                                                                                                      SHA1:E42FEFB264F4D43BE7284B519378DE66AAAD9D2E
                                                                                                                                                                                                                                      SHA-256:A831FCCB2060A0791BA09C08EB7E09F46DE0326A513AB0216AEF97AC9074447D
                                                                                                                                                                                                                                      SHA-512:CBDEE6FBD309933D78146D5F7846260220CAF5C273FA941B19774A236670D9702BE2ECB94A9F9DD338A8B442EBBF187A4D89849C539560BA8A98BAD8CEE9EF9A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...HIDATx..}{.\Yy....so?..kVZi%..6...q.8.k...I.+q..@*...$.*..q.c..8)."I91.].q*...v. $)..4...]..+.J#i4...|_.8..=.#.F..........|...;...|....f "fz..;..........t'....a0.if$.,>..../,^$H....@..~..k.....=.&..5S3....5........z...,.|....._~p..|.$.B1..k.U.W...B......u...........&FI.3"....a..A.......~...G.x..+...x*...I......j."...0.$..n..Dx...}..#..A. ..;U5J.D.!u......>..9i.GR....FYawI..W!..$.g...M......v.\.....N........h4Z..:...k....w..A........4.]Yg..B......E..%%=..\7.%......G....../.."WM....k...O.M.R5.........2.*..-..).$.X.YX%K.un)..N...{..Y.Q..4...G......G.0.H...A.g..K1..yQ.....y...q..R.(..m5..^.7_..x..<..b...l......^.&.i03.,.f0..f.).w...]._.....Z......wsI.3..=....L..._.......h..?&D....7. ..F%.].Yu..\...BF......=.....=u1....E./-...Z.m*....`.3kQ..2...K*...J....".!:kj..#._}n.......g...m{W..I.UI.:I......Y.;.k}.bff..PD.I..O>..s......K...f..3Z.nUL..;".\..D...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1744

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5776
                                                                                                                                                                                                                                      Entropy (8bit):7.925802405249894
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:8CMcirQQ6t9Qufs6QZ5UYa6Q2Rn3JQowDFl5xfYp0eAW3U+Q3kUP28WWqYvNo3:locVt9w6QJaoklfDeAWE+8RWqg
                                                                                                                                                                                                                                      MD5:E14056074BBDCDA952ABD760AF8D15F6
                                                                                                                                                                                                                                      SHA1:898F8A2DD224E54CACB27E51DE936522F1040782
                                                                                                                                                                                                                                      SHA-256:BD8C33C73412A416A6A93ADCD4474F98A77C82057DD334D85C13EEB66206899F
                                                                                                                                                                                                                                      SHA-512:9E6CC0428E957BE44776A313CD712B2FAFAFECC3FFED6504BC7B20AB3CB21C02EBE992E5709AE47038EA00F0B53758A5AF65D4B0E15F3C03ECCCF0F49E7F8469
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/wine-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L{.../c...M8h#......?...".?..#Z\...9..]B....u [.~.v....wi7......O..x.L.`.I...._.J....<>..Gn.9. n..3..i..$I.........%>..O...'\.9e.D.b.e.H..T..q...&.,rZV..%.....mY..0....W6%!..e. ..$...r{...M6I..3|.2.U....T..d.&.R.....a....C!"&@.q....b.I.O..E....xS.Xk..6..~?....,{f6.T...[.....-l.9:)K.....wC.~k.Vm...Kmc,f..........u2..J..H.#I2...N..5...J.m.n.u........mF......a..$I.$EjY......f.t.a..r@_......P.m.m..........j0k[e.Y#.m=_.hcaV..m.i$...$Y..j...W..{z=.f....,.=.$Iv.....`...O*@)q.(..9t.o..tgD..S..L...i.....;.7....V...Wc..K..B............ZVY.......2...``..P....6(...}...;..<.K..6(...S......!.PV1.@.3.Es6y-.Fx..! .2[r..F&`..X.j....J.&.zs...d"#.!lMR. ..G..sY.(....*F..(0x.T....<A.P.E.....U....%.....4.i.D6.>...Z...s?.F.b....&..$DO....2..yFC.f.....b1d.F).......@...pa.L.....@h..p"... ...A...5...t:..Z.v\Q...$F.0...#\...g....".t...".@.#E)..Y..8uL.P. ...1..`.... .....S....2S...Q...../..+..l.7S.0.J.a.v...$...1..r...~........w...T/.J....S..&.q

                                                                                                                                                                                                                                      Chrome Cache Entry: 1745

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):894
                                                                                                                                                                                                                                      Entropy (8bit):7.594651440372845
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:qJQxhA9FU1i7mNkJXed7doEhSTcvilNc5AlxY:qYhA1m570kilNc5AlG
                                                                                                                                                                                                                                      MD5:041B4DD3BFA1658C5FCF50EFD1EFE239
                                                                                                                                                                                                                                      SHA1:10F26FDE6C6C12B5605C653666C55F3CB01BE01D
                                                                                                                                                                                                                                      SHA-256:2D5E7929C137274CAFD733B9F1122D2D940CDF71858C493A7786DB8DFEED4B30
                                                                                                                                                                                                                                      SHA-512:3414C50C9769765A032A088CB7AB118AC8C59AD1FC1E605C498BC9B55F37739BE990FD8503218AAC0C6C7D89C8D3C98F7002A92C8697BA86CFE2F0BFE2FB65AA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...WPLTE.................{T.?..<..=..^1.x............s.K..A..>.......lB.D..c...k......T....IDATX...v. ...Z.*.Bm.}..\P@..e...t....I.YY..A..V...{.gr..6.....(].%g.)^m-.i$..y...V......@`....a....U..z. ....}eY....#.](V.,.....W.,....e]m./.`.I9..o.....Y..k....:_3n>.[{.{..^....x\uF.;....g..1..f..0{.@d.f.F.d.........e..b.dtR3......E.....%h_....N..!.@......$.q p...J...#9.3.H&...@..N' .#M`A.1.F.@.'.......+.. .$..`.c4....p..b.{.............%..Q2..B...w:..~Oq9.}"...W.<........c.QW.i.t...........Li....'5.,..O.h./..Q.$.)nu|.B..V.k3I...k...g....J..q.....u.....'./@n...n.t....Z..W_!..{.A....v.~B.F.(.......D.:.c....q.Js.M.2...z )...n.du....z.t..(.#...2i.G4..~8...0..y.y.....8.{..\......?...S.)..:#._.......p...Y.....FgO6.Z.....,$f."..o,.7..3..x...K..W<..b....aG:Oz.....IEND.B`.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1747

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22151
                                                                                                                                                                                                                                      Entropy (8bit):7.970069258106336
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:KGSAe9dycwtf9c3hqU7x5ep0L5aZBzZVaJ7OVgO7O1pNDd4Rm+zhF:KGSAebwSqUdQZBzZVy7OVgO7O3NDd4RR
                                                                                                                                                                                                                                      MD5:68FA337B9F72CF92F1BC4237C8B65D19
                                                                                                                                                                                                                                      SHA1:15F369040CEF5B8A2BC53704DA7473F7AEE46C12
                                                                                                                                                                                                                                      SHA-256:F129887AE0B4E23103199854B5095240D14E794494CC30423F3EFCDFE2E93C73
                                                                                                                                                                                                                                      SHA-512:DDF6A18623AF1FCF80497D2151A65CE4620EA40E39755BB1C3DE1ED15116150EA7D2A3018118BB04C334CCADC1A8EA8C8014871720C283D411C99CCC3F36BD6A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..V.IDATx.m.g.m.q..ffU-......M.....h...G...(.N.%.B...h..7.)...(^h^.Cq4.G..$.....a.t7...{s..f..*...A*b.XgG..;.......B/.....$ ......."i%.H.(......o.^...Y.:;9..x.HZ0Q..hU......U.....,<9w.....).Uj.&.2.|.}....E........`@.d./Rz(I<.'..... A...j....\..PD.......d.eu...@...!.b...'....Kp.!..x..X|!..4*.J.H@...#...........@f!...,..t._.........j..p....x..........Y..C`.!(.....&.WO,.,.s.|.VJ#z`.-..2....................Q.d.....(.L..<.G....s$.....(..n..io..KW.....z.d.{hf,.......4i.a... ...G6B.A...".........+...y.{.n\^.`.."e4...Q..&...........kp.N..8...tu..wX.bf...>;..M...J.......s..^.....H.B..C .xP.q....g....z#.3....w1.KS../..c9.(...B.....Fq"....~M..$z.....@t....@..j......p.N...(..*z.{#../....z....L"..I..H..%....jR...*.5....H-.l.U......j,.{.N..H...Y+..H..S......@!.. .....z.B.F ......7..9...}.Z.$..t}.>?...."..kr..$H....".......s;.._....O.`....X%.D...@D...hU.."...HH.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1748

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvc6q4alMvSzG96pTFhoFZ0paR65FyO-qgOcTYTKUrZOT0T5QDIvISk-X17nD4dXWnYNw-q9bsGtjnFB73BVO9RtZlnYH-a0527efGA_a2BgnigWecfGA&sig=Cg0ArKJSzAoJHiI-I4TCEAE&id=lidar2&mcvt=1000&p=110,43,360,1023&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20231025&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&vu=1&app=0&itpl=20&adk=1334063969&rs=4&la=1&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D&vs=4&r=v&rst=1698410189203&rpt=1439&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1749

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12606
                                                                                                                                                                                                                                      Entropy (8bit):7.96973610128864
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:G9SlcQwysccOm/9XlDu/sV2EIpse8EvTtevX9HqeAm6EfiUXggsXW0Py7AxwlpT:uaZscc99XlDu/Ns0LtoX+gKl5NpxwbT
                                                                                                                                                                                                                                      MD5:CD064740BE2E54EA7D3930DA14136539
                                                                                                                                                                                                                                      SHA1:9375345A72E299B7CC97F62CAD2D0EDCFBC9BDD8
                                                                                                                                                                                                                                      SHA-256:7647EBB74000399884246D42BC695BD83F8BA677426C6B88FC15D4C04A980756
                                                                                                                                                                                                                                      SHA-512:8261DFDC42CB143BD7E7A124D9DBA2CDA7FA3A915BEBEC81E7770276E6FA11EC80E738B3E2816A60AEF515B9C698ED8DE8113B8327E767D6C7D2A84AD6D86333
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0.IDATx..y.egu.....s.7W..gJ...I...d..8..:...v.mb....v.^m<.N.N.:...au...`/L......`..HHH..JU.yP.o...s.....;....j.z..}..........}.f...@S=.....>wv...!.I/..........@R...z.AWUI.0.......|...........Z?U..f..O...0..OX..<,~K'^..k...,....A......T..'..,<.7..........^DL....N...o..U.D.....R....F...1.j4.M\..L./>....+S.L..6.mk..X.].Kv..~p....s.....A...c...+..... ` !Y.).q.~Su. aji/......@...?i...ZW5u..p:.qfF"|.......0.#.6..-..g...!.($.q....~`.(0..@..q.....c.Yu3(...j...........(..Y..x~)d.$|H.q2>[...wE.d.hq..v..#.V!\6kK5..4...G..M~..l.68..;.......n....!7..qa....P.n8(4.Hq..R.9D....:.I...Zg.".. ....2...Ea}.C...._..e._.@..p#.2......[-X..f.L!.K.<[.'/..K/....6..zS....[......t..C...."..B.q..[........Hq.........Y[m.......c.6G;.n....d.0......._..ye\.H...:\..@.4...B.I..(h>/....3.8....?...:i"........)$M=..f..(ReLV.(.j.?+ .^.....q[.5.o.b..A.B.:(....... .....EV...K5XiF..K5...b..g..A.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1750

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15523
                                                                                                                                                                                                                                      Entropy (8bit):7.971859449277462
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:xiFRI2hdPzZykjsG9LdpLsuckkt21WBkX:xiFRI2L9ys/L3cBt2C6
                                                                                                                                                                                                                                      MD5:D3F609FFF23947AAFFC84F93B3F0ABFB
                                                                                                                                                                                                                                      SHA1:FA9DD52CB77BBD94978407AEE210062C13D8E8A5
                                                                                                                                                                                                                                      SHA-256:A5B5AB43D7196051825E79229C8D696CAA57793E10BB89F174D4BB79E8472A3C
                                                                                                                                                                                                                                      SHA-512:EAB349773ED2EAFD4AE3868594F0CCE7A9210B444523D2B9D22E03579EEDBBE0DF3E7D5C16C683D4DD7C7E8058E2E54F304D7A7959BD9E93F9E33D9CD4993400
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..<.IDATx..y.e.u..;.|..t..u..g....`.H.K@...QT$S.c..%....J.+..J.RqlE.%.b*t..(."..$H..Ab_g..`........|.9........[....=..w...}.whk..z......Y.D ..1..c.C......F.....b8B.P..U[....U ....:...a...0oZ@S......`.@.a.2......|..D....nx....V/3#"3.u.....G..J.&....d"..l03...o.0....|....`."..............18"..`...La._.....\w...^.1....T...#v,.GB.....4...?...0..;&&...0...&0...,L..00.@d.f.1......F.2f....T....,Wz.....BV.3..<vi{.a.OD....._..V...3.@f..1.)S+? E.#..`"L0...U.0.....#.b...`.....+$.y#..8...o .<~.~d...jz}...v`.[....7...<.^....N.`d.U!.......b.....3.A@...f.O[.B.@. ..4a8.....f.f.,,fZ.......@ o.bq\..5..A.0+..`L.2^......U..n~........A....#D......4.B...2.!.v.....#..@LL.D.%2R...B."g...)13.....L..E.:x....."##Z.;.1......zc..q#".....[$x......AE.0!U.#.E.....?..k..H4.Q"..Y....D-"H.JYc..1...!.V.+.@....2.d... a.x.}C..%8...Fv...Ov. ...7..:...p.YLP.A.D.,.."....A\B.2%..3..'."&B..'.8.....s...S..b....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1751

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7478
                                                                                                                                                                                                                                      Entropy (8bit):7.949713132803118
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:yrfbj6DC0KQYjk7os67GuckVfe1r8eYcvkQpTVr40+gC:Yfb+DCxQYjA67MkpE8ilb+V
                                                                                                                                                                                                                                      MD5:7F7C3E807940B8ACFE06B41CB35E1169
                                                                                                                                                                                                                                      SHA1:B524B0A51E885C33EB10A37CDC017433CB6C02C9
                                                                                                                                                                                                                                      SHA-256:CE78CC6DB6BACF4B0B970E3B0E7FF39C737E92B8419F1E543D2741695F1E4798
                                                                                                                                                                                                                                      SHA-512:6F5F6954A4B7B7DF2BF2D83E4042BE2FD28433C30B4F435393E4AEC3DB327CC9EF5F38A2C9D6054D956DDDFC0AE8BF16F0A897B386E5A565EB6B963EB774FC0D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/procreate-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L".../c...M0....}.....".?....!O.."s ....!RI.MTU..Q..?.!...w....{B..u$.J.8.G.'E...vkCp..........Q..._..K..0.$IQ..........W..2fx....!.5.....h...9..z...]!.v......~..%..v...4...Xu.bcG+..h...#.g....?....]_....+.?.G.....rqV.@."......CQ.r..O...m.0I.........4.....bZ.LU.U..RY..+..m.l.*..9m.3..ff.Ef.[.....0ly..q`f.......d...-....$I.........m....O^..%[......(^..../.dm...W..0n..]AG.m..m.....>....6@9.m.m.....wsG......Z....H.#IR..&3.....{.7..p..n.)Z..,.|...M....wGDf..g...o.......m/.w.X|..m.......]....om...M..-.RZm.s.k.m.w...`....mM.9.pgU)~.mS$.......<".(;.....m\....m..Bi.Cb..1)".../.`....X...m~...9...4@...' ....0F.....Flc.`..p./..<.{....#D.........w.;.....p>....c....7.....tLD..>.'....S.......e..7..A^...1..1=N.W|.....:..*...@;..7.y....0...../.:......i`..#.l1..........Gl...8.!.B..Y,.:....-.........K.`:.v.b..+;..XjF.O..Y.'.q..}....<....S.c....5b.Xc...R.j(....l........+$.2z.c...h....J.E....PUu...?o.}...._.........8C.........a.a9..2.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1752

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3979
                                                                                                                                                                                                                                      Entropy (8bit):7.934890489712718
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:6+6bzpdQelf0eD8LF4ikjZTFdhyxfPAGehgsr+rZ+6p:2bdBicm/XYpo
                                                                                                                                                                                                                                      MD5:42A12F31D26C2AC5AB875FF6B679311C
                                                                                                                                                                                                                                      SHA1:30E869CFB042E71A927C6247EF0A1365B1399A01
                                                                                                                                                                                                                                      SHA-256:C5EE25B2E79C4A54EC49296AC1929CD264B13B2EF4E4F85DD0C0E2E8D278B329
                                                                                                                                                                                                                                      SHA-512:4A19884FA825AD64D873FC1512C8DF8606F492C2D41347E97367FC60C5EFA3351548C37530DCBD5828AA6274BF2E1C61741D39742C6762C42F0875B610BEBCCF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..W........l..[B.oB....@HP..NY.U.Sq..[..VeZ.sv.muvk..K;k.[.V..k..:..^.....%. ..1t..q5....;.7.....{.....@.+>!..8...7V..........],....X ,.v.@X ,....&.....z.?~.;v.@NN...8..*.zX....n...hD.....P(...Ghh(~.l...9...N.....}"..65a.....J.C$,,..V..w.~.....7......../...D"..Rt:..m...a..d.......P.....H$.@ .A...o..h..]c.$77.......K.P.UX.~...C.....}..x......3`...c........F.....P^R.ns7.d.....2..R%.HTH..b.DE.<./Qa...LI(f...%U..X..q.....b..,..`..`......!.z..+E.(..../..$.r....<..."0#m...:....a........G.r.s.75..."..........z-V....G..b!5kK.,......2L.in...}...F.7..5.a.r..B......w.@..#.cd...4L..:./..".......t..h...=......`..`[..]e.......)..\.c0@.d"..8.{{.jjj.3....../..E..v?...c@/...k`...^...@h.&.....$L...Q]UEkg....b.......%..0.v.S0}p.f...2Z ../!!4..mF.N.:.c~!.~..;...sR.'...w....z.Y c.._."!fG..r.B....p...hK.L._z...._.29...Z#Sb.P4:.t........`Y..:K+..[X&'...C...N..`......Y90.od

                                                                                                                                                                                                                                      Chrome Cache Entry: 1753

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:exported SGML document, ASCII text, with very long lines (41451), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):41451
                                                                                                                                                                                                                                      Entropy (8bit):5.396284661968126
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:QeJJDCzlLJ1kiV5z5Nj6HVdMWuvyziOdCtZvf+ZD/UMd5Q+MX:NJ4FNu1dMWuvyziOdzzUMd5Q+MX
                                                                                                                                                                                                                                      MD5:3F8FAA5CC5D9B321939884C5394B0150
                                                                                                                                                                                                                                      SHA1:AB4E7514EA3998F215C0BA9E049547852E4E4F74
                                                                                                                                                                                                                                      SHA-256:9B6A7CA7428363767B92F9CF0EBC6DC31C5228022E2D2CB5016C0D9493021D1C
                                                                                                                                                                                                                                      SHA-512:48BEC69740678BA2503D288F72209E9088A8E514977947A31F08FB8192D5B59DE81C20CE19FC9B5D0404DEE7D0BF87DF72239229DBE8496E7591AD5574078445
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.statcounter.com/counter/counter.js
                                                                                                                                                                                                                                      Preview:var _statcounter=function(B){var N=!1;function se(p,Y){for(var C=0;C<Y.length;C++)if(Y[C]==p)return!0;return!1}function xe(p){return se(p,[12225189,11548023,11878871,12214659,981359,9560334,6709687,9879613,4124138,204609,10776808,11601825])}function ke(p){return se(p,[12908464])}function Ve(p){return se(p,[12893815,3696903])}try{var p=function(e,n){Y()?document.writeln(e):V.insertAdjacentHTML("afterend",e)},Y=function(e){return e==="invisible"?!1:V===!1||!V.insertAdjacentHTML},C=function(e){return se(e,[4344864,4124138,204609])||e>on},Pt=function(e){return se(e,[204609,4124138])},Jt=function(e){var n=!0;try{if(typeof JSON=="object"&&JSON&&typeof JSON.stringify=="function"&&typeof JSON.parse=="function"&&"sessionStorage"in window&&"withCredentials"in new XMLHttpRequest||(n=!1),O("sc_project_config_"+e)===1&&O("sc_project_time_difference_"+e)!==null&&(n=!1),O("sc_block_project_config_"+e)!==null&&(n=!1),n){var t=P("sc_project_config_"+e,-1);t?Ce="good":Ce="bad";var r=O("sc_project_config

                                                                                                                                                                                                                                      Chrome Cache Entry: 1754

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2946
                                                                                                                                                                                                                                      Entropy (8bit):7.930869215224874
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:HtSflQ5C4lq0C2B2b9JpTI2yGbEL3Ic0+1M2zBNKtOlnlUVsS:gJ4Q0C2YjoGbELYc0+3zmwlnlS
                                                                                                                                                                                                                                      MD5:66197249B94D56B6C1D2146840AD01A2
                                                                                                                                                                                                                                      SHA1:70BF02EB2E8CA5437998CE8EF2B9E94ACD25D11F
                                                                                                                                                                                                                                      SHA-256:460E99C8D5A870550542520677EFD92CCEF5CDE48FD4547FF72462001DC2FC01
                                                                                                                                                                                                                                      SHA-512:92EDA2AAD232410EAECCAE01714A405332FAF84149616D176431BBFEB9324978702DA9BA498AF1735E765FEC2C72BD0912EF68E44E1961712161BBA262522B2E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/wps-office-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFz...WEBPVP8Ln.../c...UY.....a.{...{...{...{...{.....9..4n....C.1...}....,..5..0;t;,s.(/..1..$4y..vG.N.6L...^......LO.....3a.........6......=.....C....y`.i.u`...ta..6=W8... !s.....X.....L.a&.X...5...c... ..@0.m;.m.m.m.f...m..?.'M.!.m.H.p.|..0.....\.<\......4..d.le.5o7..E.|Z.#B@.Q.....*..........[%...lAF."Z.|..xH.a.pj..p'..i.|.a+...e...6..!..iT..,.qHy6.NZ..4/#.Z..j.....).A....U...*...........9..K%.6....!..m.3A$..[..^.U.......okf..!k....V.Z...C.........)_...^.m.y.U..yu.*...R....}1...... ^..{K...5[..Om..+.j....V..>.........(..S...i(ahOfe...L4.1.f...X2..(e..%.....r.~.l..-..Y.t..M.....x....^3..9n......7Y...;Y..[..'.=.9.S5n...>z..zS.22.-..........._J...@.z:%.=.B..z..@D8.u....;.....@.Q.ZD...+.F./l.......p.A.n..].N..z/...58..u6...%s.....?./...E~[.)5............j-HQ*U.-.-l.^..$z;.8R.....s../.F..b.v........X&qv".....N.f....2....$Xx>e...[......8H.9.+g.....p...OZ..%v........C8A2.t.K|..W(.-....b.o....0..*..dJ.I&.....5s..W.I..X.OD..$..%R...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1755

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65297)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):95282
                                                                                                                                                                                                                                      Entropy (8bit):4.912464084997809
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:aBCBMi2fLf+Ef7BTDUMREkJZlCRvC1/+mxUqBiBN:OfLf+9
                                                                                                                                                                                                                                      MD5:766244A6EA3ECB9C1D502E2C03E088CB
                                                                                                                                                                                                                                      SHA1:F4B638B73F95EA6E1937B5CE5792918F9EBD39C4
                                                                                                                                                                                                                                      SHA-256:73E0BCEE3BA93B5A2D0F5239BB2C55EBC5A648B0AAB48A0D95C1CB5EDCCB093D
                                                                                                                                                                                                                                      SHA-512:72CC3431AE285C202077F7789D3729A04A33E2762FBE7936D5AF1503687677384F02F8DB5082BA577B22EFF83F1DE87076E9EAA96D7C4700892A90FBACBEBB5E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/css/hover-min.css
                                                                                                                                                                                                                                      Preview:/*!. * Hover.css (http://ianlunn.github.io/Hover/). * Version: 2.3.1. * Author: Ian Lunn @IanLunn. * Author URL: http://ianlunn.co.uk/. * Github: https://github.com/IanLunn/Hover.. * Hover.css Copyright Ian Lunn 2017. Generated with Sass.. */.hvr-grow{display:inline-block;vertical-align:middle;-webkit-transform:perspective(1px) translateZ(0);transform:perspective(1px) translateZ(0);box-shadow:0 0 1px rgba(0,0,0,0);-webkit-transition-duration:.3s;transition-duration:.3s;-webkit-transition-property:transform;transition-property:transform}.hvr-grow:active,.hvr-grow:focus,.hvr-grow:hover{-webkit-transform:scale(1.1);transform:scale(1.1)}.hvr-shrink{display:inline-block;vertical-align:middle;-webkit-transform:perspective(1px) translateZ(0);transform:perspective(1px) translateZ(0);box-shadow:0 0 1px rgba(0,0,0,0);-webkit-transition-duration:.3s;transition-duration:.3s;-webkit-transition-property:transform;transition-property:transform}.hvr-shrink:active,.hvr-shrink:focus,.hvr-shrink:hover{-w

                                                                                                                                                                                                                                      Chrome Cache Entry: 1757

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10140
                                                                                                                                                                                                                                      Entropy (8bit):7.976262385586934
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:xLsCZibGqlPq3LAmzRfYney2Zk8xkNx9jqNkgcyf2Q7fvYXc8eE:aCZiiqlPWsmzRfYd222Wl6kgrH7HYXPf
                                                                                                                                                                                                                                      MD5:F4A5CAB36DA3189583D1C3C6241B4AF0
                                                                                                                                                                                                                                      SHA1:79FC411F132BF46D30A4D18778919B936DF0D5CE
                                                                                                                                                                                                                                      SHA-256:9AF9B6139520121D3ABFD0366B7F278AC8AC24239668848FA79940F4791C6FB5
                                                                                                                                                                                                                                      SHA-512:BCA7389498D5F72842E24DE75787061D62D62112DDC828DF47C0FF14324FC41F732A81A80EF9A11BC6D656CC73B4FDD469B865C83459FB04FAB3C1B438C5CC9E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/live-sports-hd-tv-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.'..WEBPVP8L.'../c...M8...,.?}../.......6.M..._..:.Zc.l....."..4{..6v..V.D.$$)z.>[..m[U.Pq....8....$E..>....2...\..*3.. ..@.,..`_......E... D....w....v..U..g!.;. rv...5o....`...]....m.......Hd........... ...8.7.A...Ubc96h.A@=t.2.I..s.g......r.1".........@..... `!....=."b....10\0...]....m...C.kfffff...#.v.X...U....!.3.t`:.9szk...f.{..5..f....Jz.j6h.j?3[.cf...m.m...~..+..G...T.....t$.vm+Y...b...<e....l..v..]k.9G: Y..R[d...6.MaffffffffNC.eff......w...=.....j......0X...jN..N..g:.09...x...$......HUuW.V.v..m.m.~.G.....Y{wl...*.2"....m.$m...qFDFeuu./..c.n..m.9...=z...m.}=....8.=& .<.`...{..{....57..ti...d1..[...;.~;.._.n8..........ey..=..k.............Ml.g...v.....W.^.5..0W70..$<&.0#. ....4...lo.kw.......z..,@Z.$Swx$..<."."mU2R*....#.4..wx..3...{....?....tc`xrR.l...3pH.XE.p.....fc.q..r3.Q..u.K^a..hw..iH.sb`.wp...d....9...m....%f...V..nJwK..$..J..C.p.%...Z..u.......\c&'!..R.5.....D.@;....7......@].u.%U[..f..j..p....{.ze.U.*."...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1758

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6259
                                                                                                                                                                                                                                      Entropy (8bit):7.618574840765371
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:/K5TAtgQp3lS9383Xay86IYl130gDam2G:/uTQgY3g4blt0ji
                                                                                                                                                                                                                                      MD5:C2B2A9132AA89708A697ECFBEC9AE65D
                                                                                                                                                                                                                                      SHA1:B1BB24D8FE8FF73CE43C6CED5B4AA714538805DA
                                                                                                                                                                                                                                      SHA-256:C1D5F7621CD90C3AB5D0310C0ACB6ACB039862528CDD8F77C7CCB8867A16DC1C
                                                                                                                                                                                                                                      SHA-512:FA36C011C1A1C6EF271857FC2CF1ABCE851102E979DE083788613B0F1144F37C58216E9880315CAF0D784A628C9E0BFCA612564266431A586F3A305AE600A479
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........4...................................................................(............................................................................................................................................................y.b.. .b...V..........3..c.L...sd.............b..<..WP......2.;?@p.........3.....m....m.....~L..Z.....%;!..^dn.7 $.N.u.|..2.?\f.`.m....,^..{Y.-.sa.{..6.&..yz........n....-...#.y^....<........D.....{o[.o..:.qQv%QY&.....b..*>{....."...X.6.-~kT/.".k] .;.y...k.........Y6u=p.g...............z........E..+..m...~..}.WP.l.......|.G.2...........DbQ..u.hk\n[.7UzEW.zp..f.T.y.;r......wh..6me..^....].$...{._6Z...Z{.ca>t..I6.2.I.:.DU.....m.k...JKc..c...x.8..k..wt_^...kRu..;.Qv..f.....N..^W...HG.........!.N..$..........=.W.8.h..^.C........G..%.....{...|...l.s.....{[Z..,..U".U"

                                                                                                                                                                                                                                      Chrome Cache Entry: 1759

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17240
                                                                                                                                                                                                                                      Entropy (8bit):7.9843474298820345
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:b1vHvBH+SlHGf29O9UADw+Ufq+DG26UcwpRIqp2R:RHvBeSdI9UADw+Uf16AZ2R
                                                                                                                                                                                                                                      MD5:39976100F056715674BF571B6E007F1B
                                                                                                                                                                                                                                      SHA1:50760D81CEA8768D6FE567DDD12296D69C45FCB9
                                                                                                                                                                                                                                      SHA-256:4C1B3E15CA00C403FF43A66756DDB1583B3CD1191137AB769D019B4A8A05A25E
                                                                                                                                                                                                                                      SHA-512:1A1B3D50F9D977497666F839BFB9A6EFC7F8A8FDDC0024DEA7015AB5BA348AD346D6F8CD4F074DF14BFAAC1418D004183EBC77957655AEEC23279E63F69BA387
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..B.IDATx..}.T......b.-..i.$..Dc.1.&vE...{U.P,`C.A..w... ...m..:.S..-..Eb.}..s...73.3..{..>..=...3T(.~*...`0.~|>..J...P(n....B./.Bq..........v/..&xf.....4..s&.9..8.....B.T.B.Q.Vg.0\.....(P.E0.C..... .. ...j..........N.C....>....g.!-.........H$.M.<.?....a.\...a.......1.......A.r9...u..=..+*..=zTTPP ?v...q....G.S......G....._WU).......^....}0 ........Z..$. .......N..B!R.Bq..T.........rq!-........ @8..U2..B2..T0j.J.'....Z..n..y...g.......R.x.x.x.x...hjj.!...5...t...P).(.J.WT(..9..i.y....cP....x..4.g)).q.......a.WCs..i....33H;..m:}....B.px<.F............j...i....X,..R.v#."..7..a...A]p.X`..@...5;".?+#C39-...........$.bf......w..v....b)4....aD....6....h4..1X..T..*.J..D.{C.\&C.J%..pK;....ZO/.@ ......W..",,...B...p&..C............ET.4..=>"B.iz....4lh|<F....wp.}.......}[.`0.`...8.A0.\..y<-.LV..O._T.?|.(.PQ.hOQ. ..1~..Bn..c..EE...E..'O...;&..:)x..A...|.N.R......

                                                                                                                                                                                                                                      Chrome Cache Entry: 1760

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3872
                                                                                                                                                                                                                                      Entropy (8bit):7.9050433160603975
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:MmiLBfww8LM9ZKAqfskctJmwoCylLobWkfNHWz:0fV8LM4sfPcGWCNHWz
                                                                                                                                                                                                                                      MD5:CCB78F540F1DE1AF0E3C5301C67EFB70
                                                                                                                                                                                                                                      SHA1:7271338666430AC635388EFB29582C1AA4FE4813
                                                                                                                                                                                                                                      SHA-256:064898E8D2E994E23B1F95D43F8DC4536B24A1B1398E053123DF8F719B17EF4C
                                                                                                                                                                                                                                      SHA-512:E8D260251D9BA0B9E4A7C058F793030B59B41CE407865DBBF9A7491F55CC4F836C7CD87C4BA672BA9F0DE2AB23F8A55A79F8D4E04B2311EAD00B2A83EC8BF9F4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..\[.\WV......._.8v|If2.L. ...h..D^@B.e`$.4...../H<...<.H.F.........`.....L....v..n..U.u;{...}Nu....vU\6..J..s.......GHb.v.t.....X..&`M...5.`.....X..&`M..@0.k$+..E.\......d.....!).......t.w......HaV"B.`.L.....P...K..2$.A.....k.......`D%..*O....I...m>.n."D.^?w..^...*J...R....;.u.../.'Y........X"b...]....V...)....k.?.p.....'3@....aZV.....:...!B`L....Uj.7.y3Qw..h.<+Z..j..a.Aa...$..t..A...........!....i.~wiM....!gcN..vI..kY.........I!=Y....b...H..}RD......Amn...>......U..(v*8.."|...}.k`P.B.@..m.b.V..bm.}`.y#....^...@R.$.e....ja2R.x.+..}..Wot..p..!.J..6.w..t.)H.f..iJSX.\.&..]:#.XKP987...*..e..5.)...k....u0g.C..=$..R..`..U.m.2...i%.-..i."........*"....9l....Tnl.?8..zaz....%N...*..,Fv..X.P..&P.e.......So,]Oj..j..Uj..4DZ=..7vw..v@...+..j.gF.H.4...8.."4..X....IR..V."..AT.B+.m."....J2;.DET...,.....e..) .............2WJ..BKFD..$.%.......6M^.$.D@hV1qA.3...Q./Q...a.my

                                                                                                                                                                                                                                      Chrome Cache Entry: 1761

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (7711)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):242980
                                                                                                                                                                                                                                      Entropy (8bit):5.583587612236927
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:mahaU0lduI6+ZUyuoePlNbRtMy9/8aWeuoX51efmBZkUyRCuizakyr:zYu/+ZUykLFWaWeuoXPgmBSUSCuiW
                                                                                                                                                                                                                                      MD5:8A35CAAFC690CF479C968983D256DBF4
                                                                                                                                                                                                                                      SHA1:2D6E7788F911D633ABA62AB203211C0232C579F2
                                                                                                                                                                                                                                      SHA-256:4C4CD26EC76D0557DC6D4670A2AC147DE96B29BC7C7F79BC820AEA80953EC7AA
                                                                                                                                                                                                                                      SHA-512:A263495B9F9E3AE3C4C361119DA7F352CCD121623EA973738D8AF3D9EFACE274056FE94C2EA9B373EBF2F1802104800D2BE1C4F3890067B655F411ECA8DCCB55
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.googletagmanager.com/gtag/js?id=G-XYHRS06G1C&l=dataLayer&cx=c
                                                                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"vtp_signal":2,"function":"__c","vtp_value":2},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":2,"function":"__c","vtp_value":2},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":13,"vtp_value":true,"tag_id":16},{"function":"__ogt_referral_exclusion","priority":13,"vtp_includeConditions":["list","forumer\\.it"],"tag_id":18},{"function":"__ogt_session_timeout","priority":13,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":19},{"function":"__ogt_1p_data_v2","priority":13,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_autoEmailEnabled":true,"vtp_autoPhoneEnabled":false,"vtp_autoAddressEnabled":false,"vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":20},{"function

                                                                                                                                                                                                                                      Chrome Cache Entry: 1762

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8485
                                                                                                                                                                                                                                      Entropy (8bit):7.944923215854487
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Xxnl90njlYZ+VG4QHa9lQSC8EoBVkKwE4b1vtXT38hg:Bl+njm+VpPbxhbrkKwH1lXD8a
                                                                                                                                                                                                                                      MD5:EF64F7321352068B4C88EDAAD67C5679
                                                                                                                                                                                                                                      SHA1:202B0C1A2EDF4CDBC6CD7FBDC4307A8E27EAB667
                                                                                                                                                                                                                                      SHA-256:69A5B8121D01E998AD61F7D4E5E18407217F3C201F8EBBC72643EDC9D6B559DE
                                                                                                                                                                                                                                      SHA-512:A999A299DBBD0188BA45F3D218ED527A1F7BBC8185421B9CB73EA8EAB6F044FA6F26F7C29018437C8F4CD61071C2847CDA23E06D11433E13872F8BB1E53532B5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<.. .IDATx..|...u..k.........Lr.L4r.$.. Hd.....H.......|....$H. ..Kq..r`..$+.,.V..X.....p...M6...^.w....K.=3.X.t. ^W.w.......nA.58...c.....X..:6....ul.cc....X...hnDJul.#n.~....~.Z.(..#.....Z.w.....].#nR{........4.THKr..TC7...AL.`n.....A$D.$...u=..G.T...q.@d..........g.-E...n.9R..kr.I.q.....y.M.w.O..i"..K.X^... .yQ.t.DV..@.9...5..E..[4......3.k.vic..M.,.`L..J)hMC0....h.@...Z.s...9."".J..,.}.........?]];..y..+....|^...?...0..|p.O8.}.}.....U..(...@+..eP_.@S.....%%c.....H..1....#...^..:!......3.......i.,b../..>8#`y..Jkt....~..E..=S....R.s..Q5?.7Z;....*..6.ey)%...B].U........{...J+-d.....Y.0..2.....H.D1VZK)!.Z#........q!...9T)%.*.N...r.0.J)..ctn...s'.!-].......P...3.j..J*.!.@;..Eao]i.}...+.4@.....f..) .s.PJj..F..sP.0..X...<((.t.u(.@.m.@V$.."...i8.k.)...$N'...u^d1.U..a......I.RJ(e..H.2.....RR.iJ..|_).&...a...B.y!......z..x....}...0.4...4Q,.F..A.Q.......j.%...<.....QE

                                                                                                                                                                                                                                      Chrome Cache Entry: 1763

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11223
                                                                                                                                                                                                                                      Entropy (8bit):7.95699233070646
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Ouu1287p3MQ8ziN7Qh8vro4iwO+Ywvh6x/asY5QAFur918+qHABJcZqCCQ3e:Ou2T7p3X8OCUmwOHTx/aeryEsqxQ3e
                                                                                                                                                                                                                                      MD5:0879B0B73B0DFBC1A43D677577CF168B
                                                                                                                                                                                                                                      SHA1:FA2B91BEBBA503EED2F068A03B030B6DF5F8C76A
                                                                                                                                                                                                                                      SHA-256:46AC162199C23135F7E0519D2E4C923B23556916600FD2989C8EDBC553263EA1
                                                                                                                                                                                                                                      SHA-512:A496B4B6382C522D6FAA259D6BEEF4FCB5DDB140657568930A62EB15ED90E9C1C1E26F79521D761E03A25E2AF6412956B68B0143423144AE3E07E8A67F937246
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..+bIDATx..}y.fWq_w.s...uf..hf4.]h.HB.. ...e.)..&N.Bl.....q...*&N...Pv...1...^0....M $...6F.....y...tw..s.....ZP*y.....s........7~.. b.$...!...QA.p.c...~.}....../....GU.....BH..a..ED......]....5....Q...Q.1..."..((.@w=.....@U.PD.9Gd...b}.............0!.......(...:r...c.$.Q.`a.d."t.!."..".......V...k..UEE.G$..Dp...s......PTD..U@...w......-......T...~D5F.PG..!"md...G..Y..UT..|.Zr.?P.{..R.jEL"..,.,@T9Bl....5..>Kk.f.E$2...s...u"{.Z...UN.NQDDDUY........[..8;B.q..]O......?....VU... ..$..=?-{..*...U.v......:E@@5...F..l.D.d.F...[.O"...(.1".'..u...E.......0.........;.U@...Y.pH..+...0.".Yv.I....@XB.@......A^.EX]I..3..'GD..b..m$.......GDV..r\[.+.....*.E......Q.s..WOWS.0.,....*......D..\T.vp...R^.ZX...@...U.;......m.TU..... ........G...?.,<.zl./.:(.. 9..M....jvso....].;......M....e.p@.....=..(,...T.;"@\.9....y.F.......q...*..:.8<...G..>..`....#t....]U...0e.9

                                                                                                                                                                                                                                      Chrome Cache Entry: 1764

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3480
                                                                                                                                                                                                                                      Entropy (8bit):7.908674597302232
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Xeo0+8pAAWi/gGWOlq3fJO2PqP0zfXmNKXIbEi7Hg1nsTKekahhgm:ukYxcOl0zqaXmNjEgHensOGhgm
                                                                                                                                                                                                                                      MD5:938944F979C166E9057CC99CDD35FF4A
                                                                                                                                                                                                                                      SHA1:0AB00D4C91B39BC9DB9C758981CCB1D0D8D4AB39
                                                                                                                                                                                                                                      SHA-256:DA8A8B949A0988325254DD6B65754A1F426FF073FB5A4F87CA51E72C6194F31E
                                                                                                                                                                                                                                      SHA-512:C03AD4E318F68A3911F234659522EBDF8419F12DF1DF45D2CB5A257EEC443B3F9F22C856562F9C5EAEAA8CB68D797106D4795137BB03B41227EA0A87FF04AB34
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...#IDATx..]m.\.U~...;3;....!..ICcZ.)".jH..P...Q."RP.?..\DU.......F..-...RH...B%.eW......;M0!...$M......y.........wm...s..;.}..<.9..R..ca.......5.k.....X...`....5.k.........`..:.F...I").!....S}5A.+...R..MP..u.W.Q..%...`.de.d...wb..r:.-..Y..X....l...Ib...eu........=..{+....t..V.[.n)/..........olx.$..n.Y... ...{.SO|eF.a.KK.H..Z1.(....W...>2To|b...sX).U]....#/...xx.ll...me.,df...".C../..{....~:x...T1..y..].p).T.....$(..*.V.7V"...=..Rd...}.+....%.B.Z.......3.....X....l..[...d{P. ....R:..l.....O.<%..h~&.&Q....J.@i%. .R.@20...Hf6...#.t.?*.......H.'.V.V..3-.X.=.m{q..}....'....f.....g{-K...Z.O.V..F.Z...N$..T<.Ku...1......w^........j!..#...,..~../v......l.i,.j.djtI1z....K......K....v.=...af6....t...K.....T[.$...n!.=.Ec155{...h.q.=..c.E-..F..1..:..P.fb..93I..4.Pe.j{..x.h...Q...G..N..J.....:...{.H.@-5)`..E.....4cg....cV.......!........0...2..C..+VF..P.t.>Q9....,....;H

                                                                                                                                                                                                                                      Chrome Cache Entry: 1765

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12651
                                                                                                                                                                                                                                      Entropy (8bit):7.9762700759593255
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:v8k8I0PGGY+4dec/pzEdFKPQgRAcQZsUgsPBPPTXcASudsX5ECheJbyNt56/lGag:kPDY+Dc/LAc/yBHTXq7aCm2O7SvFT
                                                                                                                                                                                                                                      MD5:B7075D3C03AE207949F32DE5C35AD260
                                                                                                                                                                                                                                      SHA1:F258E28A35A65857DFE5EAF736AB9D8D38CB65F5
                                                                                                                                                                                                                                      SHA-256:0EE253F814B2AC39BD07ED314222EFCF279999A68AAEAD46507EE3DC4DD5C5A7
                                                                                                                                                                                                                                      SHA-512:42AE3E51ABA9AC9D4EEF5866759D4526B170BD7E2B505E0A94B5AF8CDFFD6720A398E7F2E7E87D81BAF29A63D71FE234C58D5985A8DA569F974A05639F15B35A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0.IDATx..Y.e.u...>..7dfMYCWuU.........@b"A."8.R.DJv8."C6.........,..6MR....A..g..A.h.....P].C.]c.o.....q.{.Y..n..)............Z{?.../...!.$..o....... `.o..."d.HJ....._.a.'6Bw..7.....#..x..^....u.$$.(.R....X.R.3..9V....s.....32VwE.V@.4.=I..W......k.]..[.7.{ff.,.....k.....v...<.....o....C.%D...|.X..z...?.c.K.a....^.Ww...DPo......9..R'....d.....b.V\!4{.N.0..x...-v..;/."e $.......Q.NV..s....S...Y.....8.:/...x.n..,T.T.,.c...9H..EI....!...`,u.m[9..o.Dh..>?t. ...N.8.A..]F2G.5..H..:.........k{..b._.J.h].....!.Yp..L>.m....M.!.h4..s....*Z...A..9..(...9$.7.........I..b.-.#.y.....F...\m..B...z.......d..c.1..)yJ9K.I.|y......f...../.^JV'X......b[..nN...e,a[.RL.n.I*..].$3ks...ts....w...(n....=.{zu..... .2D...\K..9~em..z...?sqt.....0X.1. .....P..T.T...w1..L#_~.[C.f-.)....h29.P.c.D..i....V+..q.{.......?08.o...&.}U/.|ee...8M&Y...B`.......=r.....c{.(.F....m<...g7.v

                                                                                                                                                                                                                                      Chrome Cache Entry: 1766

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):192
                                                                                                                                                                                                                                      Entropy (8bit):5.071861532420611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YTX/6ABZH9/MC6ABZxJzqIgTH2ILLg6M5CA5EfMJJJv4+TzKUUaXWkYkWnt39jrj:YbvBoCvBdqZ7McGTHV9zaalgD
                                                                                                                                                                                                                                      MD5:23C7C9601FCEF4D3B7A0156F978F548B
                                                                                                                                                                                                                                      SHA1:59A47FE9EDD6026B0B468628EB3F96B05A010F1C
                                                                                                                                                                                                                                      SHA-256:EB2697B60C526A1D4980E0874700E7C2B4F43BB9292770F71BB4BB972506E415
                                                                                                                                                                                                                                      SHA-512:3D250E9A223259A23F0EBF4FBB20DB3FDE955FDF80A64B9C7278290C60EC2560EBF665764D4E35515F9E69E1CBA2F4E21FA7504505CF3AC8D3A380201A284F6D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://c.statcounter.com/t.php?sc_project=2246434&u1=F0C83E3EAA524F1C620944F37D69B636&java=1&security=5cda6ea8&sc_snum=1&sess=de22c1&p=0&pv=10&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1280&h=1024&camefrom=&u=https%3A//download.it/%3Ftyp%3D1&t=App%2C%20giochi%20e%20film%20gratis%20-%20Download.it&invisible=1&sc_rum_e_s=8562&sc_rum_e_e=8574&sc_rum_f_s=0&sc_rum_f_e=8560&get_config=true
                                                                                                                                                                                                                                      Preview:{"visitor_recording":0, "visitor_recording_unmask":0,"time_difference":"1800","counter_image":"data:image\/gif;base64,R0lGODlhAQABAJH\/AP\/\/\/wAAAMDAwAAAACH5BAEAAAIALAAAAAABAAEAAAICVAEAOw=="}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1767

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2542
                                                                                                                                                                                                                                      Entropy (8bit):7.816513791854903
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:jPt8J9N42D0ILxTiQT0OXgsf6UHvCQvOheJKLTzvf9g6JOu+Ivh+:jPuN4kpLxxwDsfHPCOHKLTzvf9gmJ+
                                                                                                                                                                                                                                      MD5:36463A343164DD054D294B94FF0D9D2E
                                                                                                                                                                                                                                      SHA1:8006B057DB4C9492289BFDE713A4069E5A188855
                                                                                                                                                                                                                                      SHA-256:FD67B7649A44B90B206687AF3641F21CE0199D70C3ED9AD864E971EF93DD0AED
                                                                                                                                                                                                                                      SHA-512:EFF2C024F3A3DAE557ACE8E452C878F3C938C067AD9ABE51358D7B2F552FF910BE05CAF390669880456ADC1F949BCB5991103FCA82BFF9D9FB550F417018F499
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-excel-2016-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0j.I.....Ox.E.........\..z.kk/.'.+..Q.$u<..Q$I.r..E._..`....HR..=.Q...m$I.....=gB.I|. ....[e.....9.0...9.5..}$..~..8...3w..t..wy...Ff........N$..x..p/.;.!.....q..w...k.*.m...0sZ......)..X..Z?0.%..........FoE0.7[.M.)..m......%.v...k.....a.......df....oI.,I.l.I<........... p.....M..s!A.).;A;a......L.....a....;...2;......m....@B.~.~..W..,.....v.\}...G..^..0s.F.W..g......N........./.........\ .G.....W......0.f....x...\.....~....|%..... V....:Z........f..P0wt..iv.V...... .a_...0L..AA..... ..z4M..16..D..0..;.#.O.nU=..N.B3......9?U........N........g..`...a...e..-bF1....B.G.....~xo80...K.2.p.........)*.0..lOxP...~u....K.......tZY..+...BQ5.BA...E5....n..x.a;...?.6...5....6.....IT..AU.".T.TeJ....@X..;.i0S...$...."....bT......U.g....bh..e.......(.>.......j.*.b4lul...P.`.......k.Z....P...^\.Z....Y.C.W....j/..e...>}.y..C..~....p...'w../.V..g...h...D.B?.N./3... L...e..=?..1?....}..}..~_{|_.....u.u.y...[.Z@.L(.l....f..Y.?./f.*...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1768

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4224
                                                                                                                                                                                                                                      Entropy (8bit):7.8651398980188265
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:XKXTqXZcaKvCwEE+5LGhpGfpsp4xupZnBQMFRPcRIfiwqoBNeGi:JZZwEj5LG3Gf5xcn60SIfi5SNeN
                                                                                                                                                                                                                                      MD5:391FF1EAA7DFD7CFB0322678C187CFCA
                                                                                                                                                                                                                                      SHA1:1B931B97FD8C6AE2EC6DE8A90FFCEEBE32F30C9B
                                                                                                                                                                                                                                      SHA-256:879AB766673C92E5E8EF953380991D117C5570E32E2B89A579CA6CB6929C5261
                                                                                                                                                                                                                                      SHA-512:D60D42649418A7B1A4F7F8C6C8DCEA097AEAE387353598AA5F2225FF15F62373B04D3859D09CF8F4D4FFEB16D3A595A96EC62A00F352642826C83584008E8872
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/joystick-and-gamepad-tester-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFx...WEBPVP8Ll.../c...M0n.6...A...N..".?...I.lp4i.....S....&.%.E...%)(...\..m........UfdD|,.i$.........3....Wl.IRT...x.[..O..'..........W..~..9s..x.o..A..x..?..(.n.........N/..../c..o.P...O1....@.Q-TOO....m...{......<...6...s...M.Z.s.s.m..G..1SeVl......d....{.1zp.Zw.}...6.$I.y....G..]a..i.m..o.M.H...h&.X...X."K...}....s.ik^.k.....m3.....Q....m.m.....,{.l[.m.<...3.......{..G.P.$..DT...s..P..C.H.9pl.;c.`...60nflb.d....a....8f..... ....>.M...H..*.Cl*$..%v.+..........L(.........5"....*Y.4..o..=...St.%.=..T..Sl..`G..0..;....FM.v..1;F.Pd...^}H ..%...%F.@e.....R.....H.=&..L.r......5k..9^.7 ..k...f..A..f.....L. ..F..)k..3.$3..R..K...v. -.1...vb.A.`..C.I..6.............h.$ib..Ub.B...]($.g. .....HmU!y.}..@%.-\.4..67B..nBX.6.`F.kn..zk0T.bL'&... .n]..g}.a..`.]...1..4...p.._d..c.$L..I.....K].QP(l0V.X..N..`.0.F.....8....__.G.@..1D...Sz.kU.....N...2.d.IN.........B .1..z.Q........_...@...z(^...<......=..t`jR...j.. .@S...ho/....-F.7". ..c1.M........

                                                                                                                                                                                                                                      Chrome Cache Entry: 1769

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16089
                                                                                                                                                                                                                                      Entropy (8bit):7.961392496527707
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:dc3ZdhEmTO5IEppdP20G5pjyg/aTKQRg0W4h2QoEhQG3j:dcJdhE9TCcg/ORg22Q3tj
                                                                                                                                                                                                                                      MD5:8667FA4D1478DA6C4FC58BDB4F6CF934
                                                                                                                                                                                                                                      SHA1:C70EDB578C536148D3EFBD7FCD0041AE62CF8676
                                                                                                                                                                                                                                      SHA-256:39ACB468B9FB8929071B940DA6758F27FF53604EF725BB96F9F0C202F4A05283
                                                                                                                                                                                                                                      SHA-512:A2B247B9F1700B9AAB3610DA5C07809EB0EC05690FD4F509E418DAB2644CB6EA2714B5E5532CF1257A4E748EA9762B68D0D900A09FE90E91D83319683D54549C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..>dIDATx..W.m.u&6.s....'.ss.\..LE.I..EQ..DJ-.%.$C........6..6..........F..(R.).*V..p.n.P7....i.....>.(...5._....Y{.....c..}.U.~...6...~`......... ...X..#.{x..\..l,....?.X.}Akn@.7....B....?.%.?...}|..$~.?.~&.w?.../..7....p...G.]...._..Y.....w.w{.....#......s...1. .0."&%D..T..T$%.A.(..*"...=..w......D.qBk.0.>.... P)2n...3.(....".....""! .*...|_....o.<...%.... .!.Da.m+...)....D..*.....f.5..)[&..|J)..SLI@..8...y.\. .w. .+.6.Z.""...JHY.....'I1......dc.u.!..Q..JR..w.. ..{......- ...A..4M.<.c."R.....SJm.......O...".....cT.$....t@DT;...|......lV5i>...o.<SEU.@..F.....Y.1.5.X...IE.p.em.c...c.1}?Si].Y..t.!..DE..Dt:.h._U3c.1VU...Du~#.....-K"RU"r.!.3.s.x.-...b.1F.........s$.......y.5......j..&..........|hT.~..O...K.9A.`.."...W...d.X........b5m{.>.i.TD.I...6.5y.z0..Y..*......7..jh..A.......y.mc.A......*j..11...u...q5iE..Cd..4!".......D5)(.n.D.!d.a&.Dd...L5f......4.V.$2}..S.qgk..Y.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1770

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14246
                                                                                                                                                                                                                                      Entropy (8bit):7.977469481864643
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Y7T0CqqEi6TWWu4xN+BDorXH9XBRViCIFw5xB7P5gT:YcCqriSWXQN+BD0dJGFczBe
                                                                                                                                                                                                                                      MD5:76AD754D4E6DC9A6397B5EDF0F99DA06
                                                                                                                                                                                                                                      SHA1:1FAFAE266925E740E49AD04A73A0E430A1044D3F
                                                                                                                                                                                                                                      SHA-256:568D19DDFB315B3B4642734D6B3FCF507DDE9EA204678F5296AA86956597CACE
                                                                                                                                                                                                                                      SHA-512:356798E925D7E4B0E81667E8C362D62C140EC1312F88FFB6543BA09B10B46FC4238590BBB5D2FE71C718E04AA43DBA4704671311EB0A24FCCAD117EF6AA30C56
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..71IDATx..w.]Wy..]k.S.L/.e$...Z........RB.......nn ...J.yI.I....JLs....%.d.d[..>j#Mog.9.....{.:g..pn>...|F3.g.]..S~..y.0.p.....k.1.I!6...6..H...1`.8...*.x......LO$f(....n.....m.{ .Z..!D`.0.....(C.1&%.N..R...'.G.C.z=.....x'....=.b.6.6..B.+..%....1..J3W...."!.(..m..,.....M@...........)...1.>..b/.......+oi.I.X..`[.....-9.<.|%Ve.L.r..%...(.|Sk~.*......:u..9.1.)0. D|..T....x.P.XS....(=....{.{...|.x1.......,U.bM?.+G3........N).!x.....L.b....5.y.....'.. @.oP......\.!...h.Wl.........!O......b..!..DJA..F..C..J.2B......@Xu.:j...1..........AN.H..0.o..h..o.(\c..*.M...?.:g.c..qS./...0|.\...lW.W....Os..}......V..1<"...G.@x..>...u..r.............".&.LUP..5.VT.rL.CT....wm!......E.^d4.n[\.J....?....].B..{.S..i.-...y.k."......E.'.\.....!.0.u.L.n....z+.:.W~V......5.]...i.bu.7./...']0.9.....1...S<./......!...0...d<.%{QTU....*m......._....Y..g.+......H.ltm4....?.......m3

                                                                                                                                                                                                                                      Chrome Cache Entry: 1771

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9466
                                                                                                                                                                                                                                      Entropy (8bit):7.956199775217202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:LBWCAf5oRiPQ3g5k9N3D2sfn8EgGwYSePfdAUiXk8w9baAy:LAlWiP2g5cNr8Ebqk8w9baAy
                                                                                                                                                                                                                                      MD5:1B3AB106FA0E3F800519FD4685F9A071
                                                                                                                                                                                                                                      SHA1:DA33C77C82D69DD9997093E367CA5D0DAF182CFF
                                                                                                                                                                                                                                      SHA-256:1385BD8779EB0EE2FE8FBEB3CE6E3DA07DA5488F70BF3D2DA9A81EE4EEF81F14
                                                                                                                                                                                                                                      SHA-512:1B4E38A3A3EE5BB0AC180F685F7D13A6EB76743B225B6E60A6F160BB2CD645A604D73EF4FE0AFA08F92EDCB2F57A4D07735BFC02A13A8A3F38784F2FB62288E2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..$.IDATx..}..]uu.g....{.{I^HBH..HL......"VFZ,...Z...Dm;J-.........A....AEQ..e.8JU....K...BB...<^................a:ge.us.=.........(:.NUUf...... ..X3..7..f..73"...q..qz............Y.f....X...9.yc...#33s..###...<.s.;.e.9.YU.A.={...mo.7o.o..o...;...^.pc.n.3.B...l..eY&"..n.w..i.-[.8..>...-.{...*3.9....x..?..7..!.,.......vo../...W]u..._|..W...%z....9.c.....!Q.s..0......4.9....Iv...$%.x*..W...../...5k.|.c.{.>..O.x."..O..+:..3...`j.s..F..\..C..S.V..f.K/...s.}.{...7...o>..E$}....3E...03..O.....O...f....N.q....B.......h.>..Y..N..x.......~......O...g.N.....G.uI.&...O~rH%.,.'.x..%9:......l6C.......G......k...o....._..ImP.yf...1....%.Nx.j.....!........m..v..2s...q.=.Q..;.@..5)....54.A.P..S......w.C...T...U.).1^v.e+V...[.[...A..K...n..qOf&"..e.).ef....+...e...g..........O~..._.r...%...!..+m......=.yK.=....P......u[.~ .T..S..}..y..#...J...y....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1772

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 180x265, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):15905
                                                                                                                                                                                                                                      Entropy (8bit):7.971874127947901
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qdnLRt5ozYrvHYphF0FuAWChi2ZgoNl0Qusm9usrDfYYr2pSeeoxnAxnc5B1rGpx:w5oUrvmhRAWVo3j7uNk1SeeXx4BhjCum
                                                                                                                                                                                                                                      MD5:D2D64E345409F5405CADB0A600AEC857
                                                                                                                                                                                                                                      SHA1:F142579D64E1D3DC766093E0C2C4477127EE9105
                                                                                                                                                                                                                                      SHA-256:13C963A4C10C76EE0BB223C61980DD2034801804CC0FF1E64375F906BF51CC4B
                                                                                                                                                                                                                                      SHA-512:0B307ABCA906A32D01476905136C6F8E15B081063398E69133427B912B91A52B88773B551E60B7826C085DB788F4E3EDDD285163127359A576D975D8DDFC7F6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms//movie/382705/images/poster-w180.jpg
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."..........5....................................................................9^...'......:..m..q.%....F..a......Tt%9wY.n.Gt..qF.S(.xW....>..m...ZYnm..q....s.?.G.2..R...q..i..V8.".....S.%0..r...:....... .|x.g.;.~.w8..N.....k.8.X.]P......!...?.(...r\_.I.}F<.#.....p.A...P.....8.m.....o.a.~..P3..B:^.5...G..A.j.,..D..Z.....].....$..Z....ZR...Z.X......(....1.2..e...=..BI..K.6..?`.D..2......).'....@L.....Y9H.....S.wZ..S.1..z...._..k7......A...GI+..o.K9{[.1w[Yq.N.I]@.3.......4...H[.....J.]f4I.M.....K>8..kw.}........S{....I[.~B..*.W>8LG8@&D..L...q.....W.S..~.-....N.[.c..I.B,..6.[3i...0..J....`...~xpr..h..3\1...C...ZX..W..........V.$..v.|.....C7...(^...3.x.Q.......... b_F...}..v]..gt.iZ.v...u....=...X.%%2.Q{<C..+.5.F.T...$,@.bEa......kA.u.....3.s...@)..78.>.\.,...../*..=.W....xL......V.f...>5...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1773

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (3337)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):191959
                                                                                                                                                                                                                                      Entropy (8bit):5.398003233519583
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:3I2Qb6ctm26Y1PmnXYc7bIndiXVXt7kxqBFbEi8x:429b2MIPdiFXt7kxqBF4
                                                                                                                                                                                                                                      MD5:027A726404A7016EC89D1E1DB84A2C33
                                                                                                                                                                                                                                      SHA1:EFC566F2C53BDC7B499A3D91599B8B7684119968
                                                                                                                                                                                                                                      SHA-256:4E155284926BA010442D774FD493FF925A0256BD427F54596B1244791A3FA170
                                                                                                                                                                                                                                      SHA-512:D58BA74848E1366F044BAB8FD3AF1647F73473F1C62CE916C4815FA555BC9F2B9EFC7692B3AE47924CBCA2A534C21EB83FF07CA6E9EB7094EAA7F82C90384E66
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
                                                                                                                                                                                                                                      Preview:(function(){var m,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),n=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.n("Symbol",function(a){if(a)return a;var b=function(f,g){this.cg=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.cg};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

                                                                                                                                                                                                                                      Chrome Cache Entry: 1774

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12508
                                                                                                                                                                                                                                      Entropy (8bit):7.983050527000825
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:G4Bxx9OxahTd3NNfaWoO3B01X5w4BYsil3hyu+Fb:GszOEv3TiWoWB0Es/h
                                                                                                                                                                                                                                      MD5:422C6AF87A74F8EA087533E28C4E0217
                                                                                                                                                                                                                                      SHA1:F15136719924535227CDB4645A541A9BF9F43E27
                                                                                                                                                                                                                                      SHA-256:0FCDF305D4DA499390760B0CD4E2FD21587C36D3844E40A9B9BAAE6CA85F921D
                                                                                                                                                                                                                                      SHA-512:8CFDFC9492E150BEAFCF7AAAF1271BEC9A40572773CB9B799897C5528EC9C31F8C3C6C7FC90DDED7BF9D0B134F16CA3B0AC9D2356BC658B43EB4C42B8BEA17F3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/wineskin-winery-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.0..WEBPVP8L.0../c...5...m..?..2...`o6.l/...J.P..G1....._f.3..^=>..........r`.;.....^....dV.y...t...2..38=.x...&#.....CnpM.p.&w.k...c.u.2N!...V.O.Y6.s6.[.......w...u.3>..7q...M..........(\C.m.#U.m.m.\...5.m....l.NR..F.$IRd.>.._.....m.G.n<.m..[p/....29r~.T5.y.1.......v.y.m.1..4d.2....03....l.z.mh.n.....>.,..i.I].I.-->.+L.f.p.W}+...>..x.A+..9v8>E..*..,..a..P...N+Gf..9_..w}.e.N+.:..s.Hs..:..`.3>...e8NV.m..4....f..D.=.Ec7...&v....$v.)}f......{......^..wISa..-@.$I.$! ".!........e..En.).Z...<......z.S...^.. .'..VT|.Z.X....A!.0..|......x.....[..o.e';.+.........../<X%..V<.$..D."..Ot*<qQ<u.WtQ<..G.QD<....p..mq..k~.......V..}...........a_....C}...o../..8....c.hO...=..+.lO/.c.-..8vo.C...O.m..........G..].;.v>.....u=..'.a)WX}w..Upj.z.."...~.=.o....{Q$.....U{...B......*..x.l..c..6.X.~.........:l......^.x..'YH...Zx.F2.....+{v....MV.&S..3..!.!.=%"...~.g....}..8.o <D.}DE.OC<*.'v.K#....DX.....?..Y...ZH....8g...]..;.9.=VDBd/.......A.<....`.3.R.M..N..w.7..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1775

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5906
                                                                                                                                                                                                                                      Entropy (8bit):7.956059756993403
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:vXcLQ1ALMeB9zxl0wHUkcpDQwO7Y7BmyJkCqfM6ZET5WWs87ECN/Y/B5TDSc+nV:vXD1SfldHUM/c7Bmy2Cq0iEVWWsaECBz
                                                                                                                                                                                                                                      MD5:08FF75BD3A31C04413BA9A127F507630
                                                                                                                                                                                                                                      SHA1:ABDEB5C19CBCB4F48EB77F03ECF68A2AF576F631
                                                                                                                                                                                                                                      SHA-256:901E24E16A6A743C177B543D26521E193740E862911EB3D2551F22DA112FCE4B
                                                                                                                                                                                                                                      SHA-512:F98E333BF79A981267E6FF6A356702F3A91421BFA69EF26A3F361221D46408BFE5E342FEF9F730F28A558C8ABF544784D992BBDB581061606307B1A630F27E82
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/teamviewer-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.....m#9R6s.....!... .s>...R.._$.s.EZK.q...R..,).{.`........,.dw...w...]e.~N...Fd.~...8..."IR..O.p....,...H......8&.g..(.....x....#tW........R&..!.h.VDdD[..|,.....[.+.I..M...#V<.W..+.#...|..8<^.....Wt.?...h<.V..Fl...?[.[.c...U(6..Up.W.....mM+.h.._\...6"...".......H..=........B*...?.$.y..g......w..V.{.G.K)(.a!....s.=o..Y3f......U..;=.|.Pyi......a.?.|...L6...s.G.G.y/.3i..K............C.....J`..C.`....b...%zCK.g....T....0t....M@)x......N...;**..F!W...AQ.7.$..l.32...a.gjV.+>....cff..j.....-y.l[.-I....'.HS..D.-.P..."$0.....PA!.@...T.hy..o......~.l.B>.dG..HW...:............SG`.7.n_...........(.4$"3.l.....;..2j@C..7.t..+j6.......52 ........+4..E.G...Y..fFg.SmB..ck..D.M3.....N.DEEEE....TTT.QQQQDEEE...ETTT.QQQQDEEE..#tf+......Q7}-.:.M.RA.TTTPQQAEEE.PQ.ZE.PQQQAE.PQQQAEEE......n..~w.\1.=..Y,.R1r.N.s9.v.N.`...........yG.3.\..E..N.a.....N#...z.9N[..f.EKe...(.\.. *s...7|..FE..z3..b.. .P!U....NEA.:3*s..(..\..n...{K.S..|./....@..n..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1776

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65451)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):88145
                                                                                                                                                                                                                                      Entropy (8bit):5.291106244832159
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
                                                                                                                                                                                                                                      MD5:220AFD743D9E9643852E31A135A9F3AE
                                                                                                                                                                                                                                      SHA1:88523924351BAC0B5D560FE0C5781E2556E7693D
                                                                                                                                                                                                                                      SHA-256:0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
                                                                                                                                                                                                                                      SHA-512:6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/js/jquery-3.4.1.min.js
                                                                                                                                                                                                                                      Preview:/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var

                                                                                                                                                                                                                                      Chrome Cache Entry: 1777

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12312
                                                                                                                                                                                                                                      Entropy (8bit):7.956819009644385
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:i2/qaYmIigCxpXmEIHwh5g8ZZm54fWCfWyBvhCvDlGNQJtLZvfE4iN7bDYmixsbj:i+hMiIcg8Xm54bWQvhCLlGNUpfVKbtZx
                                                                                                                                                                                                                                      MD5:C3CA3CDA97925B700E9DA0977E8869AD
                                                                                                                                                                                                                                      SHA1:946584EDF25F06DDA7E72D2C11ED2805A8650D56
                                                                                                                                                                                                                                      SHA-256:9F2AE8CFD8FF828D67BF7D7D7B640CA69A9BFB1940AA6090777D6D2344A451FB
                                                                                                                                                                                                                                      SHA-512:A63CEEAC293364355328DE247AB2FBFA82467A73A7480C799631DBC3C94ACCB5C9CA52CAC0EEC97E4874F5B6AD2543592C247FE4FDEFECA316D793B25C5596DF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<../.IDATx..w.\./^u..s.LO..F..%........X.18...[.........k.mp\..l..,..l...Y....(K3....s.~....i$....y...|.4.{o.[...Uu...'..;.I....Ia...Ia...........@f...o..O..ypS&..j..Ny.P.......G].J..`.E..`"#..@@.X1..@"..-...R./x.w.K.lH8...........%.8B..wY...be.KBT..f..4...7......D.K:m......y..9..j).......XR.2.. 0.?S....l....'#.8.....%l..v..)gCj.?n.l.....7.~...S}`.;...._....zT..o.....U.SA...d..0..El..A.O..2..@b.[OOz...D6`T"K.=%.b..\.W..c.L%R.....R..{.gOm3..n-.#.@Oyx.."...@(f...............1.h.2%.&....gr.M...J..M..=....g...$8..2!FZ.DbF$KHC.B.6.1>}_.-.U...0....... ...@..X.q|&....{...Y ."B.AJ.L.%....+.....Q......`_...@..,$.Jl..e>a........(...yA3..0...........d.i.).->.v3...;.._ ...@...P@..!$r....,!,i!.=.....G..d.?[..../.pM.G..=.IH.`...Jw..bM$.h.%0.+@n..A@C..K..E.|.20..)#lH...y....'....0.k{.~...A. .H.3..C..o?...?.TV....".P ..(3..@.T~.c.......].V.5s...@....@.H..@....!..b...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1778

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14752
                                                                                                                                                                                                                                      Entropy (8bit):7.923806723732759
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:iF2TAWZW91GXzFobQHQeJeBwWpyN5BpkKDIp:U2MWAGXzF2Q9JipE5YqIp
                                                                                                                                                                                                                                      MD5:7713ECE51F15C17488E2D1CCA2516D78
                                                                                                                                                                                                                                      SHA1:5073635A2CFE7EC4DC2B6ED962CEDB5EE2673EF9
                                                                                                                                                                                                                                      SHA-256:B7FCF293068B988A487EACA9D255D186390242AE70CCFF44DD9E95F6FE1B4872
                                                                                                                                                                                                                                      SHA-512:51FB6B7A536A9BE9E746A9CF1098F4382EB6CCEE25F007262807981624EAF9A41EE77C3FED0570AC92EEBCEA5F4DE54EA9F65C2CC97F5241E925DA1652E4F478
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..9+IDATx...Y...y...y....9Tef.=.G.1..I..eI.i..r...>./........)..r(.. LP . .h...P=Vw.s.;....>........m~-...H.,.$...Jd......%).L.....D..vB.....D.....F".....H..IF.....H6....`.Ha......m>...1.b..#..0$&$,..F$'..$...D..I<b.B`....d#!. ..2....>!0.9...$.0'$.. ..B|......,..D.+..@.$$.v......[..m...`....... .....X..`'......t.OHE`R.2..A..9!.3T.3..)B ...a#..`)..$.6tdJ@H-.L..t4.....7..N.Mc.z..j^.Pc}m8.9..(....EY.yaD..........-dc$...l. 0.".S.6.. l...AB...1`.rX..A...V..|.........7....]].}.jZ..Vc[.l..{.K..F-....0.<qas{..?...S...8....9?=. ....l$,l!.8....!..A.A|....2...FaC.4...2......Ct".Qg.X...w?.....~x...{....6.R...k...66.6f..0,J).a;.4......x..{ou<......|...O]....{....".7...R.P`!c.cH.....$.....d._. 0Nc...A.A.Q.&$..r..c..~.......|p...-6N]z....Noo.Z.6J....H!...`l.eo..d.....................v..._y...<.}z.......#F....A`..BF. ~=...2'..-.%...$.+A....p....g...............=...sg.N...R..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1779

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstiexV4-tQ57yp7gf0ucSFjZrU6UsB_EAZSxlsbBILapA9MQ7nJYAKkUCPBxwv63QFynFR9Fjr9kb1j9d6V4l6ZgsPlYDtWLpft6V-l&sig=Cg0ArKJSzNt9hyeGAD3WEAE&id=lidartos&mcvt=27872&p=753,23,853,993&mtos=27872,27872,27872,27872,27872&tos=27872,0,0,0,0&v=20231025&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1791997687&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D&vs=4&r=b&rst=1698410156887&rpt=3126&isd=0&lsd=0&ec=1&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1780

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11037
                                                                                                                                                                                                                                      Entropy (8bit):7.899465800253791
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:NMLE/7qec0pwhWqbLm6/I4Mp9RZkCYd5w2xuZ+OZ95P0YUKo9To786OLhMUE5DN:NMLk77clfH5gp/Yd53xa+OZUGlwxMVD
                                                                                                                                                                                                                                      MD5:24A05B6DB5F12B4C0FA7E60AEF710D49
                                                                                                                                                                                                                                      SHA1:D303C5BFDA075B1B56E3EFCDE16ED4ABB462DB81
                                                                                                                                                                                                                                      SHA-256:66777E5E7D27D820AE6E0C66308720A7E6915CF6B6C6C0872A03A68680984209
                                                                                                                                                                                                                                      SHA-512:B2B9EA23497E5121A2B53E849C50C146C4C27A4ABBBEE9887ECF46FFCC1533C43E6E0B9B8035BE32E7A12C7AFF1A924C41BC57DA9DC7EA6F39D4AA7FBB1F7D7F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..*.IDATx...Y...y....~.w..w...s..'Q..8..8..8.a.9.A.|.|.|...... 0l.1..mH.h...f..fO.5..z....].f7.j.>.u..OI...jb.1@C@.6.IK.H@.."....1 ....."..........R../!.X....<%.../'.r.T.S...?.p.....e.j..%.! $.A..g,.Jr.....;*'B....r"....Z@..:IU.Ah.I.I...!"O-.......r1......`."A..(n....CD.._A.@H...O........=..T..@NT@....L.~.$@..t._.x..u......._.%R...<. `.pc.W......................~)./....U@..&...I.......mS.'..........x..w.~1Q...L..1B.............J.{2G...@<.ST.P.....(RB.,!.(..".$@.....!.t..t...;.!...v........o.....o...W..>=M..R@...I.........v..X..V...@.$%..!.Z...r...j...52.@N.tx.CH.t.$@n..&$sv.N.7.nv.1........{........8.C8.$.<....6..4..N4... ..p..X.........l..M...-..l.I..:B:....H...iB.9{&!...l&.....q8.....{.;.J...O....C`.!....eo,R..Q.DR..*. P......NH.-@Z....#.!.4$.NHB...B.9;!....3.!...1. ....z;.m.(J...<%O-<.!PU...s6[.#.jAn..5.."$.j......Iu.I.$.H.L.M..n I..f.4..I..>....4L..9.t.X)..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1781

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10344
                                                                                                                                                                                                                                      Entropy (8bit):7.964602086074864
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4REsprHfWIO9GnDmW+5TqxF8GOhAol7o141Ephwjz6nnB+rwI0qI6B:4RE4rCsDmx2xF8GAAQ7nWzc6nwrZ6c
                                                                                                                                                                                                                                      MD5:DB042F8A04018679F660809F8392CDBE
                                                                                                                                                                                                                                      SHA1:8F10776F7F27AEDED050C9F5A0B18348C816E380
                                                                                                                                                                                                                                      SHA-256:AEC430A67995D955F40E3C8B22D10483E3F50F1872A69266F46482E9F6F75F93
                                                                                                                                                                                                                                      SHA-512:233DE46E4E3515257A664CC437659F86AF4DF341CE014AD531F961618B0C56D9A6A349F4D41B5D4CF8538E7372C709084F811EF00A5E75A8081F29DCF32D9340
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/purble-place-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF`(..WEBPVP8LS(../c...M@.$IR.].T..............W.De^U@t..:.Wu...D......m.>..5..Tk.6...n.Hr$....B8..1_...b.8.2...$)R.=.....&....$G..I........9.r,3.n.......]h....@Z.38K..l[.f..9...<$.{X,[....l\T.k..e=...u2.kO....0^.5X...Y....|....).Z...@GfBq...k..t}[T....7.:.R...c)..}.=.e.....g...eKOHb...,.....d...C.l..F..,..."./..I..l...H.J..4....$.....C..../U.A.*[w.X.Y..b..6.....#I.$I-{..u..N..TDd..i...m.IT....w.k.m....O^...6R..=......$.Vm.-.R..>....f.q.v.w.......{k....=....$.m.."K.O..?..`........J.y.$I.m..<..X...Ud.gx(p.F..3>...M..m.vFdf.J.-.L.W_.x33..)..."........n.j[..gF<LK c.mK.$I.>.QU#....jf....?23...1."...LI..Y.&G.$..."b..Uus.p..0.ZV.........Z../1r..H.....m.0..z........}!...1..........N...I@%...t.....F.0.Y................@.!.y.....h...d...e.f.eA....V.!hB..........P..%7..@xM&...5...Ls....f.J..PB........@M..}xZ-.. He...dj..C.D...\....IQ...)..pR..v:{..YP.4..I.7....H...\!.............V.............+.t.6.h@3.@......L..Y........Q#..$.@&"KS.q^..od../....I..z.(....wF.P..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1782

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11796
                                                                                                                                                                                                                                      Entropy (8bit):7.964120198838809
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lcNN2oQ6pTG86ffDb7BydKGOtqBpZDZW7VpdVTjA/y3CG:m2oQQTG8oIdzqSM7VpddsWCG
                                                                                                                                                                                                                                      MD5:B7977113A747DCA3D9CE9822208029E2
                                                                                                                                                                                                                                      SHA1:81AD4F47D0C9888E07CD1FC49B134ED54A660BDC
                                                                                                                                                                                                                                      SHA-256:555D2137A9139F2C069661FD19FE3B06225FE8FA77E45486D2903606BB2B21EE
                                                                                                                                                                                                                                      SHA-512:4850F2F1B0B10CACC7E6D3B482EF812EED7ED12C27B8786386BB90A35FD54E947B4DA89A0F8897DC6779046FA4E83F04087A00721E4D66DEBBB3A8ED60ED7D8D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/audacity-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L.-../c......$I...a6....!.....n.mG,..W..k.z...'.G.n..E?Y]..:.W..cf..>..uog<.E..../..r$...[bff).....`...V...G.m..x~.^.~d3..o....q"I..........K.G.S...5.c8....L.L.2...M..w<5#..2./.B...d3.W.%..8...........o2. .......B.{.....S.{.....w.TL..y../xb....U...w<.o..w......v..........@S....K.....h....I.e....9R.".....$.H.*.*..*...WIDD....m.Aq.......1.U...p.P......MR.*7.n....N9.....l.....FLff.......),.S>R....s....i...d.{.(G.d.V<..._..B.Vw.;..%Ir$.-.....3.0..o..uWUf...CI.Y..d.......m.d.z..HU.1..e.vk......s.m.i..i..1YJE.........$.d.D.<..D.....u"0.Z(....{...U.n......$.... ...t.......rf.. .....RH$..{C.#I..l....m;m......R6..Z.m........j..\.......i...n$.@....k....-..$Ir$IR53w.HP.........`......2#..4............. ...B.............iHx..B.....B...@.N1..hlg.M..!K$....E.9....R.5.@.J...........J.%"....s..`,....n\. ....Q...JRI@)%.dR. .d.....u...Y....>gk.......DAb.......A......h.t](...$....y.^.'._q..\...+.5..\.o.q.#.I..VI.....!...... ...%)H.......m

                                                                                                                                                                                                                                      Chrome Cache Entry: 1783

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15341
                                                                                                                                                                                                                                      Entropy (8bit):7.971129212037208
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:8IpOor1FNSYECT32V8O1rDkUIklycvsaQvBaI8D/ZpaUkAtSR1+1Z:82Oor1CJCT32z1rXNIcv5LDehHvo
                                                                                                                                                                                                                                      MD5:84C0E73767A41945E08D5C3AD6FD98E0
                                                                                                                                                                                                                                      SHA1:4D8956C54DBC3949A1CEB5931B6F9D61A18B3C57
                                                                                                                                                                                                                                      SHA-256:9960B1A9C56A55C3E935B55B5B984872EC9B57C2A35B1B29842BB3227E60C7EB
                                                                                                                                                                                                                                      SHA-512:0A1308898D0B3A4E14880DA8437101E3631818026AC37168A53AEBDFF4D361BF9B574003B0745E59A15A39EBFB5A7E616DADD562440336C245EEEB769357B780
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..;xIDATx....%.q&...T.}.s.{.3..0.....@..)."eI.fH.E=6.............?m..........J.$R.AR$@..... ....=...:'.......!.q..znWW..'../......DL..~.@..."r,U)...xT...W....4#"n_B "i...IDd$D.&....0..A."&...w.}...t.c.}.A.....f~.....`.f.[9......t..z..yQ..Q..$.g..'.q.A`b.t!....ia..L..AM......._z............w..0..-..}.i.>.-...b.....11h..i.@......'c.Gb.}.s".......T.`.9a):.=....O>....O.fy.R'.I.).1...KZ&._.....L$..j...WU..[.^x.....C...;u......^...LaF.......2...L..Y.......b0.a...dh.cz.....A..c.cdf....}...T.......w..t.?.......'N.!.AKf+..q..f.0.>G....B`5u"f.C]........U...'.=w....y5.y...rR...gV..O.....1.qzJ.;'<c+w.bc..s..V{#.x.....ey..@.....}..W^y..W/....W........Y...>'.....I.E 0.b.E.}..p`......:z....?r...N.....l.j.5.x....g$.qZ..#Y.....k."._dY.a.\.["#2b....... 333%.I'.Y.<...g.x8|....>................?..;.N.sIgl...5@.j..GP...../.z.>...z....{of....."..$.q.j....v..4......S.,`

                                                                                                                                                                                                                                      Chrome Cache Entry: 1784

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (5657)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6162
                                                                                                                                                                                                                                      Entropy (8bit):5.599076700545423
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
                                                                                                                                                                                                                                      MD5:6AAAF8E11A32FD37FB419E3A4CE9696C
                                                                                                                                                                                                                                      SHA1:1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
                                                                                                                                                                                                                                      SHA-256:468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
                                                                                                                                                                                                                                      SHA-512:748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://fbc7e286a76978d9bf8e054d8b69f180.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var f=this||self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b||"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/*.. SPDX-License-Identifier: Apache-2.0.*/.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

                                                                                                                                                                                                                                      Chrome Cache Entry: 1785

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5196
                                                                                                                                                                                                                                      Entropy (8bit):7.9564435690823565
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:lbUjIV5jVlkIW0TdE0yPMfa2eh2VTp/sOPLhfpcEUfH:lg65jHW0TdE0byhSpxfpcH
                                                                                                                                                                                                                                      MD5:7A8506B7B8D735C830B4196015C1A889
                                                                                                                                                                                                                                      SHA1:1EC17B84B25F0E036DA3C8181BD26FC8B20C685D
                                                                                                                                                                                                                                      SHA-256:57E5BBEBF000DEE883DB72589BF683D91387D5D9C49E92C50799234DB88EA779
                                                                                                                                                                                                                                      SHA-512:E804577B64B2ED83BC64D31261834A37D624B0E57F66CFEE630287256B05ABA566E43253F8892D1E77CCD2E4C9351376B5378A86CEBD1A3CEE188256809C9D84
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/nitro-pdf-reader-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFD...WEBPVP8L7.../c...U..........1.DU.......V..,...z.EJ..hz.l.?.V ....F...%<.A..........".*..n...p.....k.........2...m....#J..<.m..b..C....%[..\...I..$7......-.F.mm..r..q.wwwwwwwwwwwww.25.k.^.:..eg......2......E.j!9.....'...h.d.....a..C4.@.{...jU.....{.;p".S...pNUg+.%.... ...L...Z.Etr..........._.d.}.'....-.....5...:B.)..%&t'n..?.O<a.l......$..c...m.ms.FUXN..w_.. .......{.. A.......m.G....mS....U.F.G>u.Y...s}4.Wb*)..y%!..n...db.>........-.>.|...;.@....:.5 .^M...`j.UP.".D..n.B.|>\~z.4..V.:.J....C..L:..y1..*..........J........].O..K.....-.H.V.]P...|r..1.r...K...t.....%O.,....f".1E.e-G..3v7.q..,.....+...U...I.......=.Y4O.+qN......`..r..j.......0..\....0v..g.?.....R4..iw..gA.o,2..H[..%..."$.\..~..x.{.p..+u.,.$....(o.".......6.F..!....j,....J.V...B.$.K..2m..%`....+........wL....=.Y...o.^....C.aOT....(.x.M...M.y.DQ.....Bl...`.4Y.:N.<@g...k...-..v9s...N....`H..9|......Pc...P/.n..{5...>..(....d......S...Z...Hl..r.*.l.C[h...%...P...s.0K.p`A.l.'...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1786

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):166391
                                                                                                                                                                                                                                      Entropy (8bit):5.7531598777618775
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:POUymJvri6fBZkxw48e4GMyOIXCJuHugfqtsh7ozja5HakPug:PO1Wz9gx3OIdugi2hUw5Wg
                                                                                                                                                                                                                                      MD5:0AFE06E1B08597B82D28BA3294948CED
                                                                                                                                                                                                                                      SHA1:92AF3125D54F8D9E2208B80B4D9F406B01991D7D
                                                                                                                                                                                                                                      SHA-256:40A2C080CD045562FE7931172F844AC764928A260458480EC15C572E1F2AA825
                                                                                                                                                                                                                                      SHA-512:67AB1422BB313EF504C76C1650CA4012889E17C025747EC31DBD1E1DA6F2C97B09649DBB937C3DBC03D0A468104D131B5FD33C2DAC751B24D941D8C039355117
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Second":["html",0,0,null,1,250,980,0,1,null,null,1,1,[["ID=7982da8f2b1776ae:T=1698410158:RT=1698410158:S=ALNI_MZkpIRmixAOlXxq8MYcZbf4IHrjXg",1732106158,"/","download.it",1],["UID=00000d9cf03dc9a8:T=1698410158:RT=1698410158:S=ALNI_MZpyKXcO6XKCxNsVIvcYAO9C81RGg",1732106158,"/","download.it",2]],[138327306428],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CMCkz_GeloIDFZsSiAkd6hQF3A",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20

                                                                                                                                                                                                                                      Chrome Cache Entry: 1787

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6051
                                                                                                                                                                                                                                      Entropy (8bit):7.957816603605018
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:H0N15s+4XCNSdJdSzCFQNHmdammXTwDSpCfIi3lmVFxxgUAYqaqx:GC+4XC4bdSztS5mMIiAd+x
                                                                                                                                                                                                                                      MD5:FCB61F2776D6E3CC46ABEE8F709D9C3C
                                                                                                                                                                                                                                      SHA1:9119DE69FC6E2896B0F63943581758D1B7B23CC2
                                                                                                                                                                                                                                      SHA-256:15E1505588F6721B1753A219D45C1F4C9CF437C20AE0572CF0D7A0285F20EAAD
                                                                                                                                                                                                                                      SHA-512:FBB5E0E2BDD5D76407C74B3F37DFCB8067ECC00283F7BDB16D7548F0C774E44D2DBCE300715E7C33FB3E6EF7624BB1BCD3F212973ACFABC24FCDFD140CA58909
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx...\.....hg..D.....8.{..F.]......&..*.*.....)j..bC....{.....;...(..{...>z....|.7o.......H$...EB.H...6...*.............I.C..y2.H.(H....y..!f..V.3......+..y...o .X..../..).~A(......Z..s...l......=&0`.X2.,.>'.l9}....h.>Kvc...>E.<A+. .!...".0,.U...*.....u..-.e....ly..\..}V....].A.......,...$l.5..`.... ........m.>K.;.b.g..U.....xo.F...W.....c.OCR.../.Q....o.e^..g.k.................4.>K.y....G!..t$UR[`.n.J..lY2...c.@F......`.nQR[.....Nj.9*...!~.....9D.[...wxa...N.5.X.[@R..J.e...X..aa1..2...F\.......K{U)..Q..)=&A...Yt......y..FQP.P..TlF(.At..H,.)...x.,.T].!..:.y$.%.S{.ob3B../..}d~U.J.CM..G7..P....U..M......J....f^cH..*..a..G.^..V...We.`..7.Kf+..c...yt#..U.`^..*hy.(.3.D..D..S..F..=......?..7,....^Oa1.-[.(.'.."R..>.8.v.......~)9...D........rs.....`...4..`..l/`1/Y..w.]..HL.=&..>KV...8.....i....5...`..?.Ba5..o.6.e.^..$`.%......L?..9Dm:......vw...5

                                                                                                                                                                                                                                      Chrome Cache Entry: 1788

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):14892
                                                                                                                                                                                                                                      Entropy (8bit):7.979612382703188
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:7SjMQjVOB+HmgyM7FtmMsTSLF3n0iJqLZDLdQxBhVH3QCBL:7u3Vg+HbtmMseB3BJmDLSxBhVH31
                                                                                                                                                                                                                                      MD5:6CCAE1D6759A086EF24C6B41E529456F
                                                                                                                                                                                                                                      SHA1:4D9DDD9741B4F5F1E47348E118C2BAE99C290E22
                                                                                                                                                                                                                                      SHA-256:498A6E4B44FAEE7E46284BDF994A7F8D53CC137FE89427B9D6671093837FB8D2
                                                                                                                                                                                                                                      SHA-512:565FC18756C90DB5527E462D4E7D8EFD3ABF7D1D87A47C376501A7CEFF47639218F4C76A2F4ACAEC13381A76D15DC1B705D28AA0225CFDF7944A66B9996165EF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/construction-simulator-3-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF$:..WEBPVP8L.:../c...M8h.I.Tu.U....r....l[6v..k....6~.i9.x.?.E....qn...@..L.)..\E^ ..(].m$IQ..?BfFkuq@Rl.R|..q...b....@.Y....H......<;....5.B.C.,)).....dE...dH...8.......m............G?n..e1.b6L...v.y{nu.s..$.N.Y.8...L..P...l.....A...X.....-@..dEH.....a.-.P...... ..bR.8...hl..$B.G..`.."...A.I....BDL....C.K.....-0r.h.z.......k;.m...Z{#.~8..Q...xG..<...8.s....cT3`.a...$.$...<.j.O._Z_...~..7.d.l.v..6.... ........B.#...>.5{0p.HQ..wC.O..m..F....-+.8..<....3.3.{.{..;....v.N...,.*.l..m.VJ9.Rjm.a1....A.,......0k..D.......9y.m[ud..t..!...%s..+.Vh...03..._..Xi.(.1.....iH..[..m..F..=.K.......9...K.....6.1.0....3....#,Y...n..$.$..X."...~....e....H.U.m+"K.},&e...0.Zk.9{o.d._..LR......C.b(xGV!P.U........T...@.9...........d..6.zvs^fU.$.W..7.....mk.Y.6.{nYZR.^......_X...0...[...N9.k_A.8N"@......\:.h1,)@....I.c......l.......v...v.s..I..a..Kp..b...3.q........M.(.)........E....2...!.....r..0@ .....1...D....u.;..=~@....rX.....|.t.I&.]...^q.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1789

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):33
                                                                                                                                                                                                                                      Entropy (8bit):4.536670255656531
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YJH/BTUbkYj:YJ/KbkYj
                                                                                                                                                                                                                                      MD5:6A8D85029D25282348BCF051BF488D7E
                                                                                                                                                                                                                                      SHA1:3962E0E9BC40E3E7122C38232F174AE89FE40C82
                                                                                                                                                                                                                                      SHA-256:789E142A896D8B5A2C8A1B00B5CA4CDD560E3A106F00F3851385FE55EF871914
                                                                                                                                                                                                                                      SHA-512:FD17AF336B5B0590ED6996C902EA3E0F1686ED41793EECF9E00A68CFF2835CD5FBA154F6ABBE377258378919CCBBB0FEC5DDEB7E39B5FFE96C58051D4620286F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"lb":"FxwJ43KLOZ9UtRdZqxsSxA=="}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1790

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7041
                                                                                                                                                                                                                                      Entropy (8bit):7.961167441014542
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:6Cnv1oIyHbKgA2ZMe87rXEGW7zhkaOWwf8Sr2wxLGCKqfeu:6CntZyHbJA2PCrXs7z5O7fbiSaCK0
                                                                                                                                                                                                                                      MD5:FFD1263E56882D27FB092DDF76A946D5
                                                                                                                                                                                                                                      SHA1:2C7350AE1E5FDD84DEB40CCF8BD3E0E7FE2EFF41
                                                                                                                                                                                                                                      SHA-256:6A60EA68293F0F9B73B96729C2CD0DC5277C721CEEEBD22E4C44BE87042C483D
                                                                                                                                                                                                                                      SHA-512:8D54F21323A5552E744BC3EF0C424C5FDC36963BF802B30022D48132FAD6234E4B2861CDE008D0FB4EBC622F2310A778971F3E03D52636949385436FA5591A04
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}.S.Y.....j_.s.f...$(.*......_.5`DW1.*&.......ED.;OO....Ww.8 ..a...nYS...>....O.......~[...I.h..../...o3.o.b........E0.eYVF.,.S...N[......$."d2.8..[A....x..j[...!....,..X.M~...U`X.J.MD.<.....F.._ui..-.y Z...%.r.....F./.%.J{.P.o.....P..<..?....*......7...^Q.e.`1v..=fy..0..r.../d.opw.Z..).. ..,.I>...=..r.O...d.......&.-...c....... ..."\.o...C!S.}[MzJ..,.S...E..4^...<.].H$j.......v.r...'?...UVb.Y...e...M....7..&*.mH...Y.v..!.g.t.||.Z..m..D]..Q...x.^H.T....(*...(..U.M........=bq9~<..?nus?j..Rw..YF.ypa.3.....Zod.?..i....%..As...y..o$n>^....d^?c#f`.....Y.J..}.n..<........|.c.....YH.&.^..,b.v.....v............]...U.9.&B.,..?....K....4.N.6.....8..-/I..........[..Z..2.,+,..x..."G..[.....w`a_..$..w2$.eQ..!.~..U...._.J.c=..z!..Z....E..2..3..BRC...w`=.....]...U..1...dY.8n..4....d.............7M.B.&.W..u...~#bY..<u.,....kRt.......:...NJ.#..+.......h..d'X..\.o..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1791

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):16034
                                                                                                                                                                                                                                      Entropy (8bit):6.018152965717657
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:djPr4VMmiP8w3ldYOdwr+dte5OY6b9YIV8CxSWB47BDbqfQ:tPreMXP84RdtecYQYe8YSWBgb6Q
                                                                                                                                                                                                                                      MD5:0FD4BAFC024532D3BA510BAAC502262D
                                                                                                                                                                                                                                      SHA1:55018742B60E574A0AD711D1B3AE33D534E28B92
                                                                                                                                                                                                                                      SHA-256:C03EED4DEF6D240B8B616C036F4995594A86B7B2ED8A8F99ACF42ED9B61B70F1
                                                                                                                                                                                                                                      SHA-512:7263BA5E2D7E1C4515EE71F9FC819CFC06A798F2DCC2985CF2BF209C1E06EB56EA480A54F71C6E52FD2B0E67EA8CAC2CD0FA96E33126F4705CC79EAF1B4F11E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310240101&st=env
                                                                                                                                                                                                                                      Preview:{"sodar_query_id":"tq47ZdbzF9nPqMwP5oyQsAM","injector_basename":"sodar2","bg_hash_basename":"mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc","bg_binary":"TYVVo0VPZL9Yx810pCXGFz73pr8JPX9laBtispznVGOGXCt/3v5+U1TT+AKct5JqNRUUJjBDDqeavdRiiag0pv8psMfNEr0/BiaBs0plV2lj0Y9KuR8BIlsjTag4NnGowm1hq9g0bxog6rWHDG1lCfkVsJaUi09VZHJHM5wVLjVnKidEMjwowSh5/jKJhIows16DJhr1oQQtorj1U8cvQw5uLWvJbSRhVVAYXHjJMncaKK4SRVSJkhe7ynnEtTJyexpGrK4gQuVaG+52QLEhRJBKQskqzWMxDk4jwOLzBNFXIo7KV3oSg3SWu9uM9tzqi/0JvqR4i6NLqB3IyuEu7sZ/5ASrwgmykd4GrszRef2TOrg5IRcEM8ferJ0/j2kLjQM3byklJqA+5jSJRq3A+Ctnm98GSp2+PSS9X5nZlTqXzj59KVXF+SjFovBzGnKrnAfMnzIh5Ni5Hd1SamvtaD53IxEnvTXXt+giPmFsQZcRVgRCEnMPCrydLhn9M8wpswC536EmJJg9EGKTz6nn7Unecqco7+qn8kDFbibw7kZeXt1VyEoKmeEz5AIlPBowaxFU/2sGQ0o40vmi8Y60ClGsRAC8xLu9HmeKtu7qyjvVQADY+NZcMfu17Ue4rwveLwgenGoQSbe9Xp6/+8f3vlQ+Zbi8O8JMjzU2SBspNNIFE3Fl6wtJs7Wz5KDIclDncVqx7QHDN+IqaJkNiy8shkN3hychLgPtsA3gjUE2Tj1UeQ3rm93zmePzgmK83SQbmtjYTQ11gHhkp5CrfzGlDhB8K9nP1o1RFkVVVQa5kuyrP/ISuLuwHGfJd0FYSoo+EP/IuMxV7eRlIo0gm

                                                                                                                                                                                                                                      Chrome Cache Entry: 1792

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2099)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3944
                                                                                                                                                                                                                                      Entropy (8bit):5.203166106601473
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:TWZ69kcUTC++OIutJxtomlGDWtVAguGUO:TjuPTCpOIutlomllupO
                                                                                                                                                                                                                                      MD5:7E183D0A9E2117A418F3F4622C083F9D
                                                                                                                                                                                                                                      SHA1:66B85D44116D2B3BDAC621384E940D4FDE5BD14D
                                                                                                                                                                                                                                      SHA-256:872DD2215897ECBF5F90259A1E8BB9AEFED872F6D475B6CF7D88E747FE641F7A
                                                                                                                                                                                                                                      SHA-512:6A49C6737E3BDE3E44651EEA7FF2DD154399081B3E91B7F919FC022CE63D444E43D2D2D3C1283930B8629D271BDF8B358636180AD041696BAAC5707E25183812
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/js/mow-new.js?v=1695907987063
                                                                                                                                                                                                                                      Preview:(function($){function loadCarousels(){if(!$('body').flickity)return;$('.services-carousel').flickity({wrapAround:false,freeScroll:false,groupCells:true,cellAlign:'left',pageDots:false,cellSelector:'.services-carousel-cell'});$('.cast-carousel').flickity({wrapAround:false,freeScroll:false,cellAlign:'left',pageDots:false,cellSelector:'.cast-carousel-cell'});$('.carousel').flickity({wrapAround:false,freeScroll:false,groupCells:true,bgLazyLoad:5,cellAlign:'left',pageDots:false,on:{ready:function(){$('.dit-home-slider-more-elements').css('display','block');}}});if(!isMobileOrTablet()){$('.carousel-cell').mouseenter(function(el){$(this).children('.im-carousel-cell-info').fadeIn();}).mouseleave(function(el){$(this).children('.im-carousel-cell-info').fadeOut();});}else{$('.carousel-cell .im-carousel-cell-info').show();}.$('.hidden-crew-tile').css('width',$('.cast-carousel-cell').css('width'));}.function isMobileOrTablet(){let useragent=navigator.userAgent||navigator.vendor||window.opera;return

                                                                                                                                                                                                                                      Chrome Cache Entry: 1793

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQiMc7uGrhv5E-xWjamJ_TO0AML-QhvErnwiD19AxrHs7k04D4F5FIXRiJsFodcld9Ld1NIrc_x5K6TTR6jACORgowx1_YY&google_hm=eS01Rjk3eDhWRTJwRy5md2xtYW9SeXBCNGRQV3dmbmJsen5B
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1794

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=NzZjYmI3MGYtODBkNC00OWI1LWIwMTgtY2RmZWI3NjhhOGIy&google_push&gdpr=0&gdpr_consent=&ttd_tdid=76cbb70f-80d4-49b5-b018-cdfeb768a8b2
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1795

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):734
                                                                                                                                                                                                                                      Entropy (8bit):7.6681955542392
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:wPkzIPI67jqKbun/edJKpAeAwKZFPYIfYVExHOtOrWECGxBrJMzhI40yb3XhrTgS:w8Sj7Un2dJKpSlBYoYVmgiWrGrezhTL3
                                                                                                                                                                                                                                      MD5:94F1D11D3BF119C6303B6C4857EAACC0
                                                                                                                                                                                                                                      SHA1:31FCEE85E016CB0875B99047106FDC9BF63F1B45
                                                                                                                                                                                                                                      SHA-256:270CFEB5DF4C9C74C16B6ADD6CCB87930ED9CAB89AFCA0A91E6DB0B9EC3139C3
                                                                                                                                                                                                                                      SHA-512:712293A99944A9FD8C48F0156047BE5A09AE1D249EDA9738172DDF6F491E7875755E1DDB087A0A8F5FB25BCE77A44F1CF45955A1F5978E107772A19D49D33164
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/microsoft-office-2019-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../?......$...g....m......(l.H...{f.o...5....@...2P.D5.H.VQ+.......~KE...D.b..t...0B....4M@.G........C.d5l.<[O@... ...rH.OW....^u5......x.w..^.;I.~...~X.....}.dX..."_...4R........e./r..c/..|...O#.oT......>..R:=f.b...t(_.=.A!_........+.......-~.....u.j._ ..9_).T...... ....yK.Y....@!Xs.V.p<...w.:......?...N..X.E.c...~.."..7....\.b.........{..."..mIBcz.DKz.D....-A..(.]..S...);.O%..I ........ND..A..'..y. .*Z.|..3..+.#..Iy..........!/7..G..9)...M.g...5i....R.f..:5Tl>J..c..@.D.>r.ePR.w...&.y.z.TG........k[p8..k..}@..|9.5..^...Rp..m...c...'.4..S..._!....H..3..nJ.. .W.....T..........2..5}..H....f....t.B..].O..r..........)oH.....GX.R*t..Lt....r.^s.ow..wB.6....op.}*4..B.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1796

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):13362
                                                                                                                                                                                                                                      Entropy (8bit):7.980703488955891
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:VhRXP78gTKPL7obLKupISb1XaGk8Sfszz:VhRT8gwL76LRpIS+8Skzz
                                                                                                                                                                                                                                      MD5:B813FFE26871DB4240079C4B4AC9026C
                                                                                                                                                                                                                                      SHA1:D7B37F878B1F561259E72FD8273E1C496225E7EC
                                                                                                                                                                                                                                      SHA-256:F7D853CCEDA346303A017661E0425AD6DA0306CCD2AA3555263539E0C59B436D
                                                                                                                                                                                                                                      SHA-512:A8FC8ED32010E473E7A84454B565C3E75CA919A4E1EA817B196A5877EAF33FE0B0708937A33639CA5A1198D73F961437B6C45742EF3876AB0666502AF381FE41
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/minecraft-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF*4..WEBPVP8L.4../c...M0l.6.d ......!...@.<...M..*.....*.mr.j[_.i[k>N...g..,{.33.,x:.@.8.O.J..p....$\.D._....y8.&`I...J.ap..e....7.6..4'J.......$UdY.O..C....O.E....&.I...q8...Egc5..A.Lh.t.$#v...P..A.L......P.\...Rf.B.W.....Gs..b........d,.M.....PVM,|................R.._P......"Y..'..p|..=\X...V...m.:.Y.!"&`.`w..FO....B.V.....y`[..U.7..m[u.u....:r..'w.:..3SdG.OwU.+..w..$I.m./|.....5F..tz.$[.-I............................^H*U|..m..I...C.u#.PFfVe....m.K\..!.k.m..3.r%#C7..#L.m+.$......U5..(.vM..&P.a.Q...[5.fvRU...]K..6.$.....U5n......iO~?._p'7..r2S!..Cd..I.$.~.%....H..c2..S...l.l...+ff....t7R..I..$.l....>.9..bH...d.Ad...q.=k4.m..mIRk}..E..C.`...QaU....fT....{..s...&8.;.......%...%..T.7...H.......&?@....z`...[HPO...)..sc=9..1.#&.ek'2B..G..X..\.E...E$ " ,....&.......q.q..z.2...a.......*`...T3 G..8..h.P......N(.... 9D....`2...I~......\..s.9....U?.8.v ....T*=.~......9A.......0..^@.P....65.uFH.....$.bRRx....~.<...W.y.cI.8........N.._......o.~.IE

                                                                                                                                                                                                                                      Chrome Cache Entry: 1797

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12530
                                                                                                                                                                                                                                      Entropy (8bit):7.9757969142430785
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Hz1jQuKfucFAcv83zl2DfEPvJsLH++AkRc7xgTcTW1xCSR82Fb0Gmldz9U6+FEYo:HlccR5PGLHYPWxfR821gldGBuYc48V
                                                                                                                                                                                                                                      MD5:41882B5A291D538C3C667D711D0A9E26
                                                                                                                                                                                                                                      SHA1:21F481D3DFFC00880C7AF3DD93B407E54218D1A7
                                                                                                                                                                                                                                      SHA-256:B8A4A7CFD650C0F9F1D4D35B9132C3B368917836C09FBD439953EDE5665B0B68
                                                                                                                                                                                                                                      SHA-512:0D12E2474A6EEE6B5A708DB39522F2FE6ADAF8123CEFED94C185CAE91F2A26065B9D50D2FB4DCE0EED9F4FE8C78975BF4426F91C620A7669435F57CC9D4F2A0B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0}IDATx.}w..gu.s..~.L..43*V...*...l...MI.J.l..KBB.&..l....IX`.l.$$.d..C1.....`c..E6.eYe4..hz..{.s...kwf$.......r.w..|.>.9..U~).@-/T.......C.'....M.O7.f..~.e......{..4...Qq..G..T(y.....jz..Z.|".]<63:47t.6tx..d}j&....N..E1......@.ORg.z...4.....`.Pz+.!X.g`=b..A.K.q..S..P.._*,".?........j......}yla$f..wL....t....*.."=|....Q.ZP....U.AbK.'rt...(r..BA".....E...:%./0..l....4.lP.(.R:5?...S.....'g....Ls...R y..;..g4.D.T..doH..XU.~."R(.........I.]UY..hP..ke..x*...$..&*Q8...5..9D...&...z.........3... 6d....<...WV.....E.,p.$..U.a". ....0..y...@A..D~..T.iU.D@..9=Zz...D..Dj_..3../........|w.../-..oM.....`fG.m.3...V.a+.S.$L.BAaEa.;.H....T.27.($T..T.H.uM.E[.J.....;......`.*.....'G.}.....vx.XCk.&.DxZ.R.RI.E...%.j.D.d..P6..xq.$*6b/.j.. 5...)`...'....b?...(...Qj.)o.>bQa...|..^.L....'.:r..#.4.......>I.....G..2C....4.. ........J..PXK"$...JJ.D$..j5.~@U%...%..Sx..K"5...VX..wC

                                                                                                                                                                                                                                      Chrome Cache Entry: 1798

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5437
                                                                                                                                                                                                                                      Entropy (8bit):7.896373139777783
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:jwS1Wr7nCrX0z6/k3jrYkqCUZsiSd6etKA9tEyXEXzU7A9CZ/3JLSuaZtINcZ+:J1WnCL0W/kTrYkqCBltJ9NEjRQlSdZtM
                                                                                                                                                                                                                                      MD5:EC10E1B7347F30C92AED0EFFF4245F52
                                                                                                                                                                                                                                      SHA1:5D33A741758AE1066C6254960D73A56CE9CC9DAF
                                                                                                                                                                                                                                      SHA-256:E529253E4950750C4C0369BED461C6770AE29322BEAB05EDADF657DF932DD501
                                                                                                                                                                                                                                      SHA-512:B351D523601C0629A6A60E20E28D9DE303FDCE21D4BE553184408B1BB50CC1A67670A74D1098323C641759608983754931B4D80FA3470013D8A2A4270E4D2797
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx...k...y...u?......{...{|.8.#..H......*$...R"B...HHP.P%.A*.. A....Qi..*A ..5..6..ZJ.D4.C.8.c.....}...=3..=........6....[Z.oi........[Z.oi........[Z.oi........Z..2.....6H2.f.y...%V&..1......$^S.%.f.$nCeO.d...)....k...*BJ.FB.UT...LJ;._{..'...7.8UB.!.....{...?t....B....HS.GO.~.....S.(..5#.E../......?..;...`.K..)qYf.R~...~..i..$.k*.......c?.7...M.@by.=&0..|...3.l.k.X......sg/.L...0.PKA2;.kE.....E.m.^...l.:!q.es{.W.%..].W..e.....D.f...Pe...........Ud.$Cb.`nK....<.."K.;PjoL...H.d........J.....zl....(....f. VU....F`......d.....9.....N4P.I9...F..Ls+.....urt...q........|.....+.....X..,.\-.-PJ./.."L.h.Y[..H....F9..a.b.....@.|>.+.0.UT..X..mK....a....0..As^J`....].Z...B..I....k_.... .0.H#a..[.J....r=.$llw...`i.;..E......TJ.....%.V..H..@.@ a....B.Hs..B`VT......f.....o>...`.e.+...o.R..".R..R......m.u... .@TI...!!.....$lB....T.zlK:?...........J.*.q...G6.....5..a8.9

                                                                                                                                                                                                                                      Chrome Cache Entry: 1799

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12658
                                                                                                                                                                                                                                      Entropy (8bit):7.954645747745527
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:e6SB/suA8B6gIdEydSiZEf76a81eAKvmgE1:e9/88B6yxf7y1eCga
                                                                                                                                                                                                                                      MD5:81E508B7CC45CDD56CB8218582CCCD5B
                                                                                                                                                                                                                                      SHA1:77D1F35CF656BCAC1401FC6ECCD804AAAB6E59CB
                                                                                                                                                                                                                                      SHA-256:5CEDE5F70D1AFD573641AA97E4E5DA25F23B85F7B1990D9865DE9FA9FC1639DA
                                                                                                                                                                                                                                      SHA-512:AD1E3DB3682792AE2645EFE257C8F1C64652CBDCA9FDFC2952859F25E8B5CB943C2AC1C43718F71713C4CFA4298065583EBA0F92CB399FC4BB89084730282E8C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/free-garry-s-mod-gmod-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFj1..WEBPVP8L^1../c...M8h#.........DD.'..w....V(.U[8...|5U7.KZ..g...K|.,..l...m;....`.V......[e.$E.......itj......m....m#)..-I...y..nc.V.....b"{..w......U..I..+...,..J/.V}.>..............;..~..`.^g$.H.xWJ..8`..w.!.....oH.....m.b.....<.5.h_Hr....U`..$.%E..Z..P..8.j..U..TO9...T|...q~.k.Rk!;I.>x....K....n..E\.k2?..Z...,...........Z...l....6...P./1...U.PS'....d_...m.0...;."b.<3.dSy..Q....%2..u.r6.&&.]I...9....G..h..P.H+(1.....4....Zk].:e...w..c..g.&..m[.m.b...1.0H|.;.#...#....Qb.0...;.$K.m..Q...E.........x..x?.svUe.k8p...M..yZ...,i.H..Kf.......\.......f.....\.....`f.&+..I....m..C.......[4.{...........saQ.....e."I.m......:.Sr~3.1...Y.lY.f.....l...k.".....f........ ....(.... .R..h......`g....U..'(..q?..4..$..&...'...D9.=....#...Gd.....g..1z..}{...~{z..hq..e....;.o......."0...(N.+(D"$..q.D....Z.M.t.{.c......&*.P...<.!...#.$d.gk..`. ....0...@P..C.B@.6..0.#...aJc..p.]...4.,....H...FN)&!....Y.8,A.-.h.im..O.3..`....>.y....j..F.].........a&..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1800

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10122
                                                                                                                                                                                                                                      Entropy (8bit):7.916890410004837
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mo1gR8iPOf33ZSIbAbVD7/IDUP9PMPMFbtvHAudVg94IBkcv1oerutjZw2HB:meiWfMIEVAQPJMPMFbtvHh0zv1oK+
                                                                                                                                                                                                                                      MD5:260ABFEAC5BA0D01F64B5D4FD4F5ECAF
                                                                                                                                                                                                                                      SHA1:1E0183101C412D6E70843FB65CFF02ED76506948
                                                                                                                                                                                                                                      SHA-256:38F2167A9B28FD0D738A187B5040C7C853D7145E0AD613850D46A4B7447236A3
                                                                                                                                                                                                                                      SHA-512:56726C48734CB15A6B73CC1B039625286C5287DF50185883FA7E550AAC30F57696D25F78A887750DBE856EBC38F9E003FBBD52B967052351EF5A888083408535
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/lego-digital-designer-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.'..WEBPVP8Lu'../c...M8l.F....qp..;......m. ..%..?.#..q...i..n...G.5...I.kb(3O.nX....bY.N[@Y...U..L...T..$.Q...,......$9J...!|..b[/7.m...2..q..p.V?^...c.......E..B.I..{..0..3`...MZ..5..,.`@..G.z.....-$.NW..^..?><........._..v..............f.4......BZ*. ......y.|b...4...!....P.8..#h....7.0.......N.....(..P.2='..(....9I..CA.6..........y..H...f.........m.[.j.m..k....V._{[...l.X.....{.....h....#.Vm...l}..[....h.r$I.$I-f.K3.....ty0p$IIp.kd......Mk..}K......#N.......;w.l..N.m....^k.9....e.Vm..Z{.s...>w.effff.CM.?h.5.)f}.....7.9.h.d.m.v.R...\.......I;2.......B..6.....S..CW.!B..a.O#!......7...J.B"H.}P...&.....w\...IE>]...$..#dZ...9$2`"....Q.T.$#Y.."dGl.4... =..I."e.>.H.!Rh..$BF..P.!..*...'%......`!...).)H.i......c).Z$..DD.$"$..(...*..R.Q..R.V....*d....f....$.z#.i.'."-J(W,RQB....4.....id.V ."'.%."..H\....~...G^...{......_m..7....M+.^i...u.R6y#u.GI..v".B..y(.W....u.....D^(..D/!Q.+.W...o..._.-....~L..J......o..........o'*.."..!.,......6..:...@..l.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1801

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4300
                                                                                                                                                                                                                                      Entropy (8bit):7.936460362605017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:f0k+9HHmLU4j5ZpJgQMvXolS4vKYKzhIIZlSa8vFf9yZuTpuk:Mk+9nmo4tZ7gQMviPvKY9a8vFFyZuTN
                                                                                                                                                                                                                                      MD5:C8B504B45E699B4932F6322C9993CE81
                                                                                                                                                                                                                                      SHA1:CF3CF7792DC5CE7822FFDB6742E6213747F1661F
                                                                                                                                                                                                                                      SHA-256:D5E7C3EA1B3288861108FF7D23ABED5B7C82D37101D7A6EAE7D56CB3523525DA
                                                                                                                                                                                                                                      SHA-512:3ABAFCA2CB8543C63EE2FEA6759DF0083B688BD2A5F64C959000CBE22EE4179162DA9882E0ABB586637B957B67406120930153A716FF8463E138A490319D8D54
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/77chat-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.......m..?..2........(X.8A...zq...Cn...i.m.:...Y#I......m.Q.nvfs;ffs....$....=..w...:.$m..w...m........F..G......6).$I2.....*0..x.33....."..'.<'s4.l..z........$m..w>.......?DIR.J`Q.....B1..C....D...D..#..]. ...H^..........JZ.+.U.....(G..-.._qD.l:....uLY8...A(nk........'.5...?)I 3pq...'.\.f/a.O;.t... ...v..K..9e.....Gl.$...UH..Hc_0N-H....z/.{.._......[...v&.....T..Dq.Hb/.........v.q.....z2<.3...I...H.....U.{(.<..........c.....}.j p1c....#..R..4s......C..=.%..'.zV..=..Fe...P@......D.\.RUgu.....K...J...uDj#.;Z.........!>F.k......._`..[.$...L..$qQC.......,.8..Y.U.....J&...^..In...3....QB....B".r.N\R.3..A...... ..V...../......o.QJH.PK.b.,.R.....l5\....%......+.3Y..H.L..C2...&_..Y.b,..S..O..X~.^...M.D%.b.M..*. !p!..Pp..q.n;.GR.*......TH$I@y*..........A.S.1d.5nV.'ZC...7..f"I.BH.~5$...qT..w.gP.b...<i..F..UG.`.>=..hO u...).9.z.d....d..'..N.$.....z..F...Y,..?.../.......<b.z...V...08.`...26-..d%=..+C....>..*..uQ.pnN.!^..x2.q.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1802

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (59729)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):60010
                                                                                                                                                                                                                                      Entropy (8bit):5.251561930322096
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:uoYGDyGi43HVzdR2BmDb7zTNilqtvY1xWiDLYjQVW1/MVOlKvnxFa+B0+:uoFXOCx0wNGaYk+
                                                                                                                                                                                                                                      MD5:61F338F870FCD0FF46362EF109D28533
                                                                                                                                                                                                                                      SHA1:B3C116C65E6F053AAAB45E5619A78EC00271A50F
                                                                                                                                                                                                                                      SHA-256:5AA53525ABC5C5200C70B3F6588388F86076CD699284C23CDA64E92C372A1548
                                                                                                                                                                                                                                      SHA-512:8C2694D03A7721B303959E9FE9D4844129CEAD2B2E806E85E988A04569DA822EC7A0E2EC845D64C312D3E3EC42651810B1336AA542A3E969963B1B2EF65DD444
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/js/bootstrap.min.js
                                                                                                                                                                                                                                      Preview:/*!. * Bootstrap v4.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e((t=t||self).bootstrap={},t.jQuery,t.Popper)}(this,function(t,g,u){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,i)}return n}function l(o){for(var t=1;t<arguments.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1803

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12248
                                                                                                                                                                                                                                      Entropy (8bit):7.961218356526697
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Y74ZH/IEByqZvp+unhieQgsZzNxfa91kiOH551d+Gt7QUDFJPBC3Mkt92C:ffryLuhWfZnSc5DqCFD+MkqC
                                                                                                                                                                                                                                      MD5:91C419D8CE31805A98BCE51DD115B24F
                                                                                                                                                                                                                                      SHA1:799762C2817CD42E61492D8FB9778DFE9AB1BA15
                                                                                                                                                                                                                                      SHA-256:931695FBF8E987AD437668BD376E11FE0D971F2B50C60E8E5C51C7D0AC3D1FD4
                                                                                                                                                                                                                                      SHA-512:4FE1D755D68F630C8AEBE3BAA526D5B0D57711AE6E36F9F310104A0EC777A9D1AD686C0464CD1AA438ACF59FC849A742AAF388AF8F01A9751A0A529FA62BB10E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/picasa-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF./..WEBPVP8L./../c...M0l.6...oe....!....... .V.O@....g<.I..1c...T7..&Y..&..6.....({s.F...H..)c......D....&...m.V.+.......D:".H.m.j.2.q..M v..|yu.....s..[.d.Ad%......~2|Y...T...V^.E..........).&.|.h..9|<.a........tT.K..$.h.AY.sy..?.r......s.=/..h...]..d';.. e)-.p.)[w...].........6y^.........N..4n.-v.B(.......aY.d....S..r..K.............f'..` h.61...~..1..$.T....Q..F}...f.u1TP.N..cm.2I.t=.of....b.}z.Jo..$...0......k...m..6.m...{!..!..87......{..$IVm.-.h}.9......=_.k.....M.$.{z_3s..d.,.ffff.u%.H.UWcf...y..{...8)"....w.wl.%I.k.s.s....j.....h}.Uh..9....s..#.j.m.\J........Q.A........m.i3.4..ZK....#..AD,.1..L.../.W...|c9".*. .....9...$V...1.!...Z........X..*-G.X.1.V.....G...)..:....X......;)..;j.G......gF.Q..c..yY.J..U...<.e....&..M...P.n^P..3.k.\O.XFH..)I3y.JB.2.1........t...D..Q.U~.;........."d!+.:.......TN.G..ee1b.4..%...;...>d....'...)....&..u$.6hJ...x..XeRO.F..z..g.....n.^Ge.......hi.9.T..c.{..2......o......5:....`.c.y;..2.RPgu

                                                                                                                                                                                                                                      Chrome Cache Entry: 1804

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4347
                                                                                                                                                                                                                                      Entropy (8bit):7.943703965397194
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Sgwrh2j9RTSBGVonKVxg3dWzxdpUNtXe1fCKhmLFHDb:SgwQqMYKVa8zxdpUNE1fCZ3
                                                                                                                                                                                                                                      MD5:92F69C3D4B9D633A1B48768CD3C86904
                                                                                                                                                                                                                                      SHA1:94445C56EA032DE438FD9E75B42A6DA24BD45E86
                                                                                                                                                                                                                                      SHA-256:D12AD668BB5C5752CC0EA3896C7D2691DFA4021BA3278673C538B803D96D959C
                                                                                                                                                                                                                                      SHA-512:3DEC377CCBA0027D8148B233EBF62F43BC06C95B190E61260F04C86959E4EFE64C5F4581A7C11E9F22A989F8CBE9D7E5147461E2287726FC459569A5435506A4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..].w.U...2B...$.@@..A.... 8H.EE..e..!..L.dP...6...u....$.,..l........]k..^UWWW...G.>u...z.~..W...R......KQhZ:|(....=.....TP.a..Q... ..PA.T..g%.6K..)4.(JJ.AQ.....K.JEJ...TJ...6..L.H.<(.G.....qs ..E.h...T..L.(l.H..4..hx.2...T*%..0.SPi..~E.fB'.Q...(...O..Z..I2..J.dJI&.uk..r.wSU...%J9.X...M._.FI&u.J).&Y...|r.2..Q. ............cT4.B...e..c....h..k...>Z.E.A.L._...|..5..)......z..:H...@.....l.@..+W..:PT.}.y..x.c..f...+W.7.6oB....9He.UU.J...7.6.....I...e..Q..L...K:|..x..r....t..+.......{}...K.]..Y(.p...V4...k...n...5..j@...-.8..u3....s\.R..r9(.?.................`.%.t...G...., ..D...I.h{T.....&w"..+CA/T..x.|.W..n.i..\B..L...|._....W.^x....n.....zJL.z..WDP.C.....O&^^.X.R...Gc..El....1PS.z..../..(...1.k......M.\....^N4.....5l0...qw...M...u3../%^^.-|..VG.......a\=@*.e...[........^U..^..[I.....FU"2.......[)_..E....z..5.....|]...z.....[..5(.Wn...Q.v...KR.....<......

                                                                                                                                                                                                                                      Chrome Cache Entry: 1805

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11550
                                                                                                                                                                                                                                      Entropy (8bit):7.9622697168257766
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:pYTmwOj0GxTNG7sQbeRNE7X0ehBuctyelRXo8PsBaJk7kLbo7xwrrweycwo:pYKwOj0GxTIONE7EGukXo4GeYwrwZcp
                                                                                                                                                                                                                                      MD5:E4312C94EF58AE71C6B547273BFA436A
                                                                                                                                                                                                                                      SHA1:58A52D4A1C108C377D5D5743EC223B55369E1AC7
                                                                                                                                                                                                                                      SHA-256:0D2301DD6C2165415CC4499ADD585E1B383A3DECA3FC493FDB48D50E6313BA10
                                                                                                                                                                                                                                      SHA-512:77C5B32ADF95CB8417528B2522A6A965D5CF3D0F5B488481E3AE78FA9DE2583A68863F8455C286B7560451ECF867536FA57BFFFC4D3595DDA21EF081BCFE1C97
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/open-office-ppc-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.-..WEBPVP8L.-../c...M8l.6. 'm.....CD...h.m......|LK~......[{".....).I...P.;.p....3..nU...rH. ....b/.6n$I..\...k.y..;h.....H..%.h6.....p.&6....H.#.i.$G..Y..?..r7)........!.X\."@ s..:.....#..pt.,t.(W.......+??.DU6 .T.,.S.).....D."iZ...p..BjP.mEDlW ..#..........D.....Do.n...z.W.ISr1....+W..nUj7..4.+W0...k...m^1..uu]]W.n.c..`...-.L...WaS...@.%t..............`(h.I.........X+..J@..T.t0uI--G....A....#.,.XxR.$I.$.g..'..{o....$9.$.<..KK.Bb.6...O...F1..d.m....>.....9.@ .g..~..Y.3f..H.l.m[fQZ._4.E.\t.....Z.<I.$.%ID.k...Z6......RL..m..8..../)....Y...t.....!33CR....A..../I.,I.m..E.=2.........@..G..&...V="#.TE.w$I.m.e..Ym.1.Z.|n.6..C>6+......}......G#..7={.8.".Bi.`...& .......b..X....0..)....6.1!B....%@.U...e..iFq..6.c`.`)..^....%....d........4."...p.H...U..B.a..(..=VH3....3x...q^.@....... p.r.-.Y....D..@.`..!@ ..p.qY.H....(.h...^..fY....'..4.y......A....*KL..pi?yg..o.{w...u.O~.].{.......y.<.J[;....W!Al R....h.7..Pf@l.......)X....FF.$!....f....pF].w..{..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1806

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13878
                                                                                                                                                                                                                                      Entropy (8bit):7.969224556882514
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:4DO7lq+GlaH/i2SEN5+vtl5N5L1ShuiFrHwSEyc+bNV/8NCd9VZj:KOeI/iTEvGl5TMhuKMSCqVN
                                                                                                                                                                                                                                      MD5:2F4A2823D33DB038F48102C01B874ED7
                                                                                                                                                                                                                                      SHA1:33069612FEED2122C9EAC2BB76DD13B7095130FB
                                                                                                                                                                                                                                      SHA-256:40F7EC91C837A160370DA359467AC6B90ED639E57436F35C0CA585E11C2D8FBE
                                                                                                                                                                                                                                      SHA-512:8E98CBB1CAC8DF621AF985AF54C7B62D8FBE6767E97CEC749F7133B7DEED7EA1A087084FDDAFA0D92D9F00A012532122F849748D1732A8B64B600DC18249D061
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..5.IDATx..[.d.&.....q.$3!!......D..R....y.y.n...m...._.a...B[M.L.u.J.*I...."..H......~n....>.....$TI.2+7,...p?...k}.[.Z.C.....P..{./n...H..c..|........|.....F...ny.....?>........J..=......gv1..s.....O....+s...0.+{.......m.5$.Eh]\...c....O.?C..^.H.>.EX..D.. .a8~.c.....6......p|.......b....]Xy..81........7..........t:|...8.dL..Q...{|..S.....aC...V......x..1=.x:../.K..Y......T..9..zG0"h..1.,B.9n........?......x<... .|p( .q.6....W..*F..~....(....,....G?..7.......&.......{?.7..?.+..?..Z J).v{...~.....R..R.x..o}...:.y~.ow..r.#@.......X....a..$.<.4,....R..V?..6V../......>.u.a..{..W..........E.zd.4.,.[U..o>..?..3g...u...AP....X..G.wU.....Y...X.....]..^......7.....~.._..7....y.u1..9c....8.........C/.;.@.V.*N.&..U."k...y|b8.NN<....X.^.._.V..g.....~../~......+.\...u......`....`.w........Ov7.....+......~...F.a.1..e....?@..........?...0...{..W....^..>x...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1807

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5214
                                                                                                                                                                                                                                      Entropy (8bit):7.954361469533039
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:isNYD4DElBTRDb3VHHQfWmbCcQrb7z/x8wquSdrXI+y5S08GZS:isNYDFBT53VnmbYj2wqzrXINOcS
                                                                                                                                                                                                                                      MD5:CE4B4EB63DFF09E22FD3B01D9F64AA10
                                                                                                                                                                                                                                      SHA1:F6FB8B334A6722A3433843CBEFA41F606DF9E5DA
                                                                                                                                                                                                                                      SHA-256:36E8013CA40BF7C40D6AEDA10E3CF5B821BA647DCAF333B603C6A2554D6F5E92
                                                                                                                                                                                                                                      SHA-512:5340041C5279D01EEDAC37348DC22AAC4CA20F18129CD20E0C695529A26F48B959015887CF07BC038443515A9BADF633468E3F894E76943D2ACA49248DA8429E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/mac-os-x-el-capitan-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFV...WEBPVP8LJ.../c.......m..?...ADL@o..)Z.69h....Z.ig......{o8e.TX2..2.\2..e.............*...*..J..6.....a..wu@..Sf...4..../*.V.r..(...l..._e...$.4c.n..2;.w.H..H.\fFu...^yU.;.+..P.. zB ..Lqw..J.......L.qm..g.....Xet..m..V.1N...Ow.(}.....T..V..W.J.U4.^lc........;.......J%.mUm.}.s...%...q......w...r.D..D..`......".]........n.(.c...P.^...&.a.Q)..%..2...E..T..H.....x..<..*CaUv..`....G\@.#3.^.J\...v........N.....Q.5R..8.....n.sju7...n.J.i_..n..M.z......5.X!...H.F..(.j.u .`.bD$...q.4...E@..^U.ZT.%DB..tN.*1.E."...&..yN..[...A..^.2[.....i..&a.@.......fS.....@.g_.G...#....z.(.4.H.b...D.*......k58..oI7`.....vw.^?&.L~x.......#...*..X........./.}..~.e?..6P..A"...+l._<v..H...:?.}...O.><'....P}..........o?..M..Cj&...R.J#|...T.}.....m..M.c.!y..RW...W...M....xR0..n..D..@....7.....]............B:.".....H.x.C.).U....k..P..@Rdp.07.M|~...6Yr/}~/.<..............B..<...>....j{8.*R.. .p...!...B..&I|/.?.=.O}.....~G..G...i..T+Oc....Or..".{.|..*A.r/.Z.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1808

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3550
                                                                                                                                                                                                                                      Entropy (8bit):7.914672275090758
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:sey+zQPlQT5vQLHjGnqcJG2srZjJmKxTyPSrigvqg2d1DvAIqcj/4eWpUietJEb/:HQtDjGnqcJGJ1kqrNNq1UIWeWcRUt
                                                                                                                                                                                                                                      MD5:B7805888D1D6B8129A7B55E1CCEBFA61
                                                                                                                                                                                                                                      SHA1:A22C56251A6D5D83BEA75905F8161D1137F08A11
                                                                                                                                                                                                                                      SHA-256:C5B9E0F9B78EA7A15F2E8D8F16D16BF226E0A676E329A57C0369F8F98B0E55F1
                                                                                                                                                                                                                                      SHA-512:55ED2F13C4635CFBC726CBA72AC024A49941875FDA11335186B6F15F9C616652FB31D4CA25D0286173E74F5EFFFC2B854C349792CEE4163FA90AAEABEB4FB2D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/square-cash-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.....m#9RfF.f.... .....3...$..J`...e.>.DW.H.J...rG[~_8.d.Uf........_...C..$I.{f.....W0q.I.$k..........?.|.hj...a...9..@.!.F..mS.....@)j.x.......^......DS........-...E..&...]m.,...7..s ...e..8.....[....m.v.....8.....mOnc....T....o.m..m.Z..>49&6.mm.m{..m.m.....j..I.k.m.ek}.=...].{.viS.k.....ba.....@..(.Q...j.K..s....9..tpnqx....g.%.a.A..@.G.$f....`./o.....6.T.....M....T..iP8|.dC.>.\..3...U.d\.\^>...^.)T~....*.L aR.T...;.@S........O.......Fr...;x=.E..A@t...s8%..S.t....R.A...b$...._...Y..7l.'.@.+.'.Ph......=aN......7M/W.{.$Qa.#3]E.,0's.......MW...f_..m}..r..c..T0...w.y...(.s:.*M.77.on.|y.h.X.#.0.........^?Of.Cv.Z./...>.....0..B....^s......~.....4...&!.....n...#.nSR.zW.H[..vn.p~...m...^.!.od..vuo........ ........=.\..k...i.|....a..hRkV.....z^K...q~......9.a.0.r..@.#...(.6.ig...!.N$..SdMg...#.%W..:,.....$...W".....#_;....h.6_.^..S...9H........D.@....i.r...9..H...;......o9..P.3......X.,.!W...@.E..h..}u....4Q.}~M5..Q.T

                                                                                                                                                                                                                                      Chrome Cache Entry: 1809

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, Unicode text, UTF-8 text, with very long lines (12338)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):179007
                                                                                                                                                                                                                                      Entropy (8bit):5.177754391812893
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:6JILD1ItNbN+QxqScJgHCseGXJCm2ynYq88zwPRsjB57MoP54ovQ699COeIUOcAB:6eLD1IjJ+QxqScKHCsbnYqXbQdITF
                                                                                                                                                                                                                                      MD5:56F238107994C9AD106FFE44E484080D
                                                                                                                                                                                                                                      SHA1:B1C53187AA1746C31DA803AD754869E9295DB053
                                                                                                                                                                                                                                      SHA-256:D46C77FDCA82B3B565D81DDF5D0EC9AFD42D93BEC382E0EE463C88C1CE26DD63
                                                                                                                                                                                                                                      SHA-512:79987DE0E4FB3761A6D127BC63EA39A673613D52164B7D971126FB129A96AF2506F62482CCDE950573AE29683C7AFC9FBD3C4B8E52889D8EA6F2BD91A86BF49F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://download.it/?typ=1
                                                                                                                                                                                                                                      Preview:........ ...<!doctype html>.<html lang="it">.<head>.<title>App, giochi e film gratis - Download.it</title>.<meta name="description" content="Se puoi riprodurlo in streaming o scaricarlo lo puoi trovare qui." />.<link rel="apple-touch-icon" sizes="180x180" href="//cdn.download.it/dit/favicon/apple-touch-icon.png">.<link rel="icon" type="image/png" sizes="32x32" href="//cdn.download.it/dit/favicon/favicon-32x32.png">.<link rel="icon" type="image/png" sizes="16x16" href="//cdn.download.it/dit/favicon/favicon-16x16.png">.<link rel="manifest" href="//cdn.download.it/dit/favicon/site.webmanifest">.<link rel="mask-icon" href="//cdn.download.it/dit/favicon/safari-pinned-tab.svg" color="#5bbad5">.<meta name="msapplication-TileColor" content="#da532c">.<meta name="theme-color" content="#ffffff">.<meta charset="UTF-8">.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="canonical" href="https://

                                                                                                                                                                                                                                      Chrome Cache Entry: 1810

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                      Entropy (8bit):3.8915414066556506
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YGKeMfwDpHXAYHf1HJmM+sJiK4:YGKe9t36RLp
                                                                                                                                                                                                                                      MD5:82AFE934CB7D3AC2858D3374014A24FB
                                                                                                                                                                                                                                      SHA1:FA6FBDCE4D72662A4FE391989A35280492FE367A
                                                                                                                                                                                                                                      SHA-256:2A16AC49668DBC041EC09F7B52668E59828413DBC65FE1C8FBD6510E72E52471
                                                                                                                                                                                                                                      SHA-512:7C879D04F27F5A53EA8E89AA45917C56B6816B7F2E044791975A6CAB9D155D9C7E603464FC52984A17C37A600B91859F97935E6160A2C5C7000E7807486970FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"country":"usa","region":"fl","city":"orlando"}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1811

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11174
                                                                                                                                                                                                                                      Entropy (8bit):7.96465707315276
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:6JUJdyqNyl8vg0nHubdOpYeysaYL8FGi584qvmgJYFa2WE/QeDJFUBgDA23dm:eCyqNyy4oHuQWeysdL8MiXiOFaooeDq5
                                                                                                                                                                                                                                      MD5:5325FD7E461CE4F6ACD02973694117DB
                                                                                                                                                                                                                                      SHA1:D1772C3DEDD19523DAEE4D3739552252D30957AB
                                                                                                                                                                                                                                      SHA-256:472AB2DBB6B644208433011C4DA7179081D915DD6301974E8E3391A44310F8C9
                                                                                                                                                                                                                                      SHA-512:6C6A2C0DF13ED8B9F4745D32A5762B00CC076CA03B01F481C30EB5B6C50F6E22033E2E007CDAA3E4224C13424D484981E055D19124E12BF795E7B440E1E80A68
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/kilonotes-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.+..WEBPVP8L.+../c.....m.F...E............$..~N_;7.y.1.W...Hz.l.)..Z6s._....P.}o0..=.4T&>.....Ue}........PC...F..H.'.D?.......$E.=f.[...j..m....xn.7.....==..$....%Zb.._.&.I...*]KM....d.;u...7....]...t.....O|.4.9~.......Q..(....s..qa|....i"M.&.D.0..>g.....&.....V..O....zQ.jhL.M.........w..v".#..|.....w0..0.....m.......CDL@..[.G5..m.m..$j.s.k.F..m..l3).k.l.6m[.Z[.c.9.\<..m..x\...q.;a.l.>.u.=5.{k5..$.Vm.-s/......{......$...DOt....9...Z.$I.$I.E,.j.q.[UA..S.@......"..TE8..m.&I.u]...f.AY....\%1.\ZM..Q.H..:J...1.......9.m.m..\j.s.1...[.M...1{-.$.mK.D.._....I.3.k...^..[.$K.$.B......P..~..m.9...O.|..dI.$Y.........&.....!.D...e+...9..|............1:t8.g.......V[l...Rczz.[..~.~.....{.....{..~}o.~........~.r.s=ns......:.....<....>....._...U..@..5...W.. ...:..........r.>..v{`3.|'3^...A...@..&hR..R..Qw.E..rB+..R....e8....B>.Vwk.=....../..P|#......a..U..5S.]..z...{./o...._GH".]8.....V.....*.j.lU.59.T....Z...UR..FW.B....K...g/nm......O

                                                                                                                                                                                                                                      Chrome Cache Entry: 1812

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):165768
                                                                                                                                                                                                                                      Entropy (8bit):5.748935595206549
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:aUymJJlGri6fB+bxw48e4GMyOIXCJuHugfqtsh7ozja5HabxdLug:a1Wcox3OIdugi2hUwXg
                                                                                                                                                                                                                                      MD5:BB7F90B5D4F8CDC37B1A2AEC0750BA86
                                                                                                                                                                                                                                      SHA1:4A441DFAFBA45F66B4D9F9A923FE2F95210A36CD
                                                                                                                                                                                                                                      SHA-256:3ECDC60B81DA3246FC13CF47369947B8C0F03AB5A8E901B17CA4EEA4906F4E28
                                                                                                                                                                                                                                      SHA-512:CF75E121467F4034A332F6E1C8E0504CB7F5E65CC7C452D9E905A2DC648359C56786D42CBA6955F754A19E29A58A5156C4C8A98BD940B5F6209538F7A2EB1058
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/gampad/ads?pvsid=343331062718654&correlator=2145207820374870&eid=31079134%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202310240101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%3A22764537101%2CTD-desktop%2Cdownloadit%2Cdownloadit-it-defaultpage%2CATF_Leaderboard_Second_Refresh&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=980x250%7C970x250%7C970x170%7C790x250%7C750x200%7C750x100%7C728x250%7C728x170%7C500x250&ifi=5&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D0fdc66d1f8ac8cb9%3AT%3D1698410157%3ART%3D1698410157%3AS%3DALNI_MZRdGIz-nKJ0k8_76ZQ7GYdo9-WCw&gpic=UID%3D00000d9cefcfdc57%3AT%3D1698410157%3ART%3D1698410157%3AS%3DALNI_Mas9lFx9paYGQocdROztWuju1aO_Q&abxe=1&dt=1698410188016&lmt=1698410188&adxs=44&adys=110&biw=1017&bih=870&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLFtdLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMTcuMC41OTM4LjEzNCJdLFsiTm90O0E9QnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjExNy4wLjU5MzguMTM0Il1dLDBd&url=https%3A%2F%2Fdownload.it%2F%3Ftyp%3D1&vis=1&psz=930x0&msz=930x0&fws=0&ohw=0&psts=AOrYGsnQrR_7vBcGQybUgKgvOydpKb0LJoFokWGdm_v3fvaj&ga_vid=1995881029.1698410155&ga_sid=1698410155&ga_hid=912521144&ga_fc=true&td=1&topics=3&tps=3&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRjZp4mJtzFIAFICCGo.&nt=1&psd=WzE1LFsyLFtbIi81MzAyLDIyNzY0NTM3MTAxL1RELWRlc2t0b3AvZG93bmxvYWRpdC9kb3dubG9hZGl0LWl0LWRlZmF1bHRwYWdlL0FURl9MZWFkZXJib2FyZF9TZWNvbmRfUmVmcmVzaCIsW1tdXV1dXV0.&dlt=1698410151758&idt=2908&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtd-topbanner-2%26hvi%3Dfalse%26type%3Dtop_display_leaderboard_Refresh%26refreshCount%3D1&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26compliant%3D1%26ad_session_id%3Db6413f29-c277-4fb0-8970-dd98c320dd64%26pv%3D1%26ab_upr%3D7%26segments%3D%26personalized%3D1&adks=1334063969&frm=20
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Second_Refresh":["html",0,0,null,1,250,980,0,1,null,null,1,1,null,[138327351282],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CNOQl4CfloIDFYGbswodH34GqQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20067;&gt;8&amp;&gt;`dopb/%&lt;1732261!=|vqc)!7201061?&#39;9efotm(&amp;20723;&gt;:&amp;&gt;`dopb~&quot;]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this||self;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1813

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (340), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):340
                                                                                                                                                                                                                                      Entropy (8bit):5.188187168139427
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:Qg+RwlpeXJ9STgRh6vyWEYEPgTMeXK+nJiWj6R/HqmCkrKKfpMC6gTMY3:guIXhh6vdClbWAWj6R/HqmCkPiY3
                                                                                                                                                                                                                                      MD5:FBF25F6951AE143192879C26180131E7
                                                                                                                                                                                                                                      SHA1:2E32FFDEA49508FBD64FE0633136CEA64BCC029F
                                                                                                                                                                                                                                      SHA-256:6C47F3E02450FE4747D36494CE483D7ACA3CFC507F1A1E092029CFC6EB3A5AD8
                                                                                                                                                                                                                                      SHA-512:CA496D81F33D79D7EE18D41854C5CD591843B2FD9705B2AD65FB053A6DA488B22F90EACC1D4AFC03206149F7F00D2CB9C9527A65ECC46C20414E76397485ECC9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/js/flickity-home-fixer.js?v=1695907987063
                                                                                                                                                                                                                                      Preview:window.addEventListener("DOMContentLoaded",function(){var f=0,d=setInterval(function(){var a=992>$(window).width();if(a=a||10<=f++)clearInterval(d);else{for(var a=0,b=$("#home-rank .tab-content"),c=0;c<b.length;c++){var e=$(b[c]);130<=e.height()?e.find(".carousel").data("flickity").reloadCells():a++}a>=b.length&&clearInterval(d)}},100)});

                                                                                                                                                                                                                                      Chrome Cache Entry: 1814

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12802
                                                                                                                                                                                                                                      Entropy (8bit):7.987097476113791
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lGSkvJOvL4uoK4JF9pOc+YSZFP2bRdYncu3TtE8Qr4uo8fxGZ40mqWZCBIAFDJU2:cOvL4HPylRZFubIZxQ4ZYMXmqWoBt66
                                                                                                                                                                                                                                      MD5:C136FA1AB04B03335D8EDEEA328EFC6C
                                                                                                                                                                                                                                      SHA1:054708498FA5E2AF9B945B34A790E4B2F37D97C4
                                                                                                                                                                                                                                      SHA-256:DA0FA59B06899A74D2006F2F4546445AB8263F83896464CA7671E9DC4ABA8235
                                                                                                                                                                                                                                      SHA-512:1B70FA46ED3A0E5C138EA7A15DC8A412DAFBC33A24DAC84CF926E162C220CAF4B34C1E952952D1EC11ADAFFF87DA51AD5553A42753D8BE551DDA6915E0E52F6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/perian-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.1..WEBPVP8L.1../c...M0h..2.}...7....../K..~$.@I...h..e<'.w..$.+....v..~.m....-LT..Q>..Y8n$I.b......y..m.$G..I.QC.....[.S,.._.GG.m+.)..*.a..'.;........AGo)Wa./....o...ui0.%...B..".(/....zl..U.!. .C.....`.|Y..m........\i.X.Vkh.O}p..s.Z@\x.....U?-u..0..tz9.m.U.......a.U......8.YH."........-..+.../B.%.R....6..._..[.V%n..q.N.'.E;5.}..|Qr.KL)_.B} (.`.....=.h..a...m....;.....m.*XS...v..t..9..i[.m...b}Q~e........r......w{.N.^...9..n....?..Ga.R.R..F.5..a.b..ZZ.sb-tRZ.cp.....f..).d-.....F.$P.".m..5......X.cj.q.....7....."I..Q.=p.]{n.-f.....".....mk....Wkm.....m[...f.l...=...T[.....F..&.m..e..Vde6G.l....G...6.Qf)..mR$.-..C...H..|W.Z2F...y...n..03....3S...-).l.V.".`...9.K..3|.|c..1..TUD"p.........Opz.....pB.v./........E9,.,.7.b6f.s.F4..8........<I..T.....X.r.A......$9^.9.....I.$I.<..z;5....'.Db.I.$Ed..).m}5].....(A..........|.u!.,+;?...=/q.7.Z..I..@W.m..S7QA...l....Zkd..%...u..]...6..4<.;.h...Q...!.%.<....z...Y..5..Z...}-.6..,@....j.@......b.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1815

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                      Entropy (8bit):3.5
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YGKeMfQ24:YGKed24
                                                                                                                                                                                                                                      MD5:055DE8F64447F10ED2C4C7F78E27B7CD
                                                                                                                                                                                                                                      SHA1:BBFCC7FBB135D3893E9BD559E44E069F57DFAB31
                                                                                                                                                                                                                                      SHA-256:30C714BF4216E577686D238B98561D093672CB25BF90BAAB50DD956F75CDA4B3
                                                                                                                                                                                                                                      SHA-512:1A726490120152235BBCE20368630EF20FAC7964BA32F846FAC2C1F1A58EE9722356AD94FA6342685E8CEB5015CE2E944EDD739B901D3D9B0A22A5238118142B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"country":"US"}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1816

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13252
                                                                                                                                                                                                                                      Entropy (8bit):7.970882554270055
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CQzvh4owdXCuD0e3AHtWDJdSFVIkw6H+dhPMcwbszLSoP8H7xrl+0iS5SP1/R8:rzZ4oOXCuZIwDJd+zihkkp+9FtkM
                                                                                                                                                                                                                                      MD5:79D09AE82223AED33D3B2EB307EA59E9
                                                                                                                                                                                                                                      SHA1:BD6E7ACB7A3AE01E1935B4E0441F5A33FB285C26
                                                                                                                                                                                                                                      SHA-256:E9B6B3BB287B89B56C3670AA24454596BBE811D056DACC43DDE28B080A7A2EFE
                                                                                                                                                                                                                                      SHA-512:21D3AC2780AEAB244960C351BF527E5A897E265AC4CE1A5CF83B981FF351314594ACA56F86C2742B5F945E6A76C2754F411FE664DD1756E77A02D369159C52F5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..3OIDATx..{.diU'..{....F....^R...(..<.."..cw......6JM+k..J.f..Y.n\.ku.#.`.N..P...*..y5(..6.E.....}.q..o..N.{3.)...X7#....>.....}.$.........(.Rd.6..@@!...(... ...2....@.r...|.B*`.3.&..1.ee..e.tP(.....(.......`....1.k,$.p..n..-g)h.....^}..)....H...P.$....<a.2.P..t.8.....0..i"F..f]..D..].#..D.m......f)Vt....,....IY..m....d...\!..f_.'.b.........W.K.......Gy......+..H....|......U.......V.H....!A...E..E..]....W6..W..d.........v.A.....l......".......d V..e..!BV"5.@E&....)..%....:..t........A..... ...p_8.|>...FH....'X..y`i....0.8.)r.k^iDhc.....}..*I..b....I.`.f.S..iV..I.. P!@....\..........M..P...W.A#..*+.s!..............o...0...'5z.A......@.:|E.2.....@$@)^.@+...*..qv..7>y./...B...+..ZB./k..z...Y............N!l......+:.@.....Jgv.$..W....J.T......;..xH..g.,PQ...+..K..U...-..Av....n&...D...........!hTD...$@.%$...`.P..Wl.....}...[........Y_.hj8HR.Q.'..[.W...k$

                                                                                                                                                                                                                                      Chrome Cache Entry: 1817

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13917
                                                                                                                                                                                                                                      Entropy (8bit):7.938196999330072
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:ATasohpody8N8x+bOl3zdeLb2e1geRPoLTgI2Q2n1nCVDK:CasqpWdNO+CRzUqe142WK
                                                                                                                                                                                                                                      MD5:8FAA76ADD992858090EE0D70952C92F7
                                                                                                                                                                                                                                      SHA1:E3E2173A03BAC5B0C606C0E268A1294B3B8E8066
                                                                                                                                                                                                                                      SHA-256:862167E1FF23AF5C9207162FDEA76A85F59553CE58893BB1F1CE79E7359B229A
                                                                                                                                                                                                                                      SHA-512:FBBC6C9DFD2AC3328D7B3E66E9BCF58EA7F7B8BF03EB93D9AE6AF316DA9E09F4921F1B2594C15FEA3A5A8A7D81BD385E60891F49EFE3C64E307CB7093214C284
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..5.IDATx.d....].......{....g..c.c.06.f. i.DTm...$.*.....Q.V=.Q7RN..'.(.8..M...H.x.=.......y..}_........zE7(....4...,...ov.{..R^....C.x.^...P..S.M.1...;.h.E.&.....;D.0.a&.v....s8..=2+.3....p+...Lw.e.8.Kfe.g..FF.z..z...~..?.?x...d..0i.N.E.KSp...m.1Dlhh....F._8...._...o..6...[..;..F4`a..&..N....Yt...Ab.0t.`..5f..G.1..=.*.].....,32.Yv.Y...V......V`.......O....y..O\......5..he..).NN!. i.HS..9../....._.._<>...;N....w....&..t4i.t@..t..jw...C.,-..M.:t.F'[...f.YXXt1..=.....rVw.%3...H.f...d..q.....v.....o..G.~.".f.3C[{.q.$QE....M......?.......G.X.t.9.Za).0.%..N:.4....L.M............:6tb..^..a.....Yt...92K.f.q...`...9.YXX...gm[.5.~.*......y..g>~.s.;{....F$A.....u(....?..........8=.]2.8....P......!)..C....;......H..P....6....,.06ASd"...4..(e...%...%L7.2....l.\p..O.x..xz......z..d?L..Y.8..2H.V......?.....-g..4.t!V.`G4I.4..@.F*P.....FC ..-.*..T.LgH.....['. .h.P

                                                                                                                                                                                                                                      Chrome Cache Entry: 1818

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6259
                                                                                                                                                                                                                                      Entropy (8bit):7.618574840765371
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:/K5TAtgQp3lS9383Xay86IYl130gDam2G:/uTQgY3g4blt0ji
                                                                                                                                                                                                                                      MD5:C2B2A9132AA89708A697ECFBEC9AE65D
                                                                                                                                                                                                                                      SHA1:B1BB24D8FE8FF73CE43C6CED5B4AA714538805DA
                                                                                                                                                                                                                                      SHA-256:C1D5F7621CD90C3AB5D0310C0ACB6ACB039862528CDD8F77C7CCB8867A16DC1C
                                                                                                                                                                                                                                      SHA-512:FA36C011C1A1C6EF271857FC2CF1ABCE851102E979DE083788613B0F1144F37C58216E9880315CAF0D784A628C9E0BFCA612564266431A586F3A305AE600A479
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-leggere-mail-tiscali.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........4...................................................................(............................................................................................................................................................y.b.. .b...V..........3..c.L...sd.............b..<..WP......2.;?@p.........3.....m....m.....~L..Z.....%;!..^dn.7 $.N.u.|..2.?\f.`.m....,^..{Y.-.sa.{..6.&..yz........n....-...#.y^....<........D.....{o[.o..:.qQv%QY&.....b..*>{....."...X.6.-~kT/.".k] .;.y...k.........Y6u=p.g...............z........E..+..m...~..}.WP.l.......|.G.2...........DbQ..u.hk\n[.7UzEW.zp..f.T.y.;r......wh..6me..^....].$...{._6Z...Z{.ca>t..I6.2.I.:.DU.....m.k...JKc..c...x.8..k..wt_^...kRu..;.Qv..f.....N..^W...HG.........!.N..$..........=.W.8.h..^.C........G..%.....{...|...l.s.....{[Z..,..U".U"

                                                                                                                                                                                                                                      Chrome Cache Entry: 1819

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):163689
                                                                                                                                                                                                                                      Entropy (8bit):5.728475342586183
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:wUymJ2ri6fBqaxw48e4GMyOIXCJuHugfqtsh7ozja5Hamug:w1W8+Wx3OIdugi2hUwEg
                                                                                                                                                                                                                                      MD5:611146E8AB2E5F7C02C5592B852517A3
                                                                                                                                                                                                                                      SHA1:8229798A38B39B0C28B3E8962C1743BC0A8F7CE5
                                                                                                                                                                                                                                      SHA-256:CE4BE8CC7D6DF44FFC0B3347E5D16A30D0FC8AF3E9E34A85FCD006983D006A98
                                                                                                                                                                                                                                      SHA-512:A28D1E7128BD9E8A6D3D78D7B347A30C89A8A03F801C68AB456DDC24DE0CEE4CE6DFB85F42BEA9BB4DBAE2BC6AA327E1F4BF3C7BC03E3F5E3717EFD49DA6DDE0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/gampad/ads?pvsid=343331062718654&correlator=2438047912895928&eid=31079134%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202310240101&ptt=17&impl=fifs&gdpr=0&trt=2&iu_parts=5302%3A22764537101%2CTD-desktop%2Cdownloadit%2Cdownloadit-it-defaultpage%2CATF_Leaderboard_Sticky&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=970x100%7C970x90%7C750x100%7C728x90%7C500x90%7C468x90%7C468x60&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698410155278&lmt=1698410155&adxs=24&adys=1737&biw=1017&bih=853&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLFtdLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMTcuMC41OTM4LjEzNCJdLFsiTm90O0E9QnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjExNy4wLjU5MzguMTM0Il1dLDBd&url=https%3A%2F%2Fdownload.it%2F%3Ftyp%3D1&vis=1&psz=970x-1&msz=970x-1&fws=1536&ohw=0&ga_vid=1995881029.1698410155&ga_sid=1698410155&ga_hid=912521144&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRjqmYmJtzFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyLDIyNzY0NTM3MTAxL1RELWRlc2t0b3AvZG93bmxvYWRpdC9kb3dubG9hZGl0LWl0LWRlZmF1bHRwYWdlL0FURl9MZWFkZXJib2FyZF9TdGlja3kiLFtbXV1dXV1d&dlt=1698410151758&idt=2908&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dcustom-stickylb%26hvi%3Dfalse%26type%3Dbottom_sticky_leaderboard&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26compliant%3D1%26ad_session_id%3Db6413f29-c277-4fb0-8970-dd98c320dd64%26pv%3D1%26ab_upr%3D7%26segments%3D%26personalized%3D1&adks=1791997687&frm=20
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Sticky":["html",0,0,null,1,100,970,0,1,null,null,1,1,[["ID=03efa880f877a8a3:T=1698410157:RT=1698410157:S=ALNI_MajyfV5EpZNnxKIs_vL05nD_wJvhA",1732106157,"/","download.it",1],["UID=00000d9cf091fab8:T=1698410157:RT=1698410157:S=ALNI_MbZClMUdGaQeLlsPxEAR30rLQnhEA",1732106157,"/","download.it",2]],[138327307067],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CPmH4PCeloIDFZm-swod6bgEtw",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20

                                                                                                                                                                                                                                      Chrome Cache Entry: 1820

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=LE1_OtIRXO1LuZJBl9PiDpoQMVI&google_push=AXcoOmRDSm8Gfzyi0BojYuOALcmiANsDqV_qnnpAgx-azkpurKOGzWe2DCw1YE6lON8orMWlJdpWXbxyof9pE6_m6oKb0HBH52_K
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1821

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):192
                                                                                                                                                                                                                                      Entropy (8bit):5.071861532420611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YTX/6ABZH9/MC6ABZxJzqIgTH2ILLg6M5CA5EfMJJJv4+TzKUUaXWkYkWnt39jrj:YbvBoCvBdqZ7McGTHV9zaalgD
                                                                                                                                                                                                                                      MD5:23C7C9601FCEF4D3B7A0156F978F548B
                                                                                                                                                                                                                                      SHA1:59A47FE9EDD6026B0B468628EB3F96B05A010F1C
                                                                                                                                                                                                                                      SHA-256:EB2697B60C526A1D4980E0874700E7C2B4F43BB9292770F71BB4BB972506E415
                                                                                                                                                                                                                                      SHA-512:3D250E9A223259A23F0EBF4FBB20DB3FDE955FDF80A64B9C7278290C60EC2560EBF665764D4E35515F9E69E1CBA2F4E21FA7504505CF3AC8D3A380201A284F6D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"visitor_recording":0, "visitor_recording_unmask":0,"time_difference":"1800","counter_image":"data:image\/gif;base64,R0lGODlhAQABAJH\/AP\/\/\/wAAAMDAwAAAACH5BAEAAAIALAAAAAABAAEAAAICVAEAOw=="}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1822

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12431
                                                                                                                                                                                                                                      Entropy (8bit):7.978511212079476
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vQL+uBX6q2EcGW/CZnGQLiS6Iac/qqZRuJlXdsaPjsoN4t5J4OcJgEJkX:voX3gGZIFlJlrsA4nmO6w
                                                                                                                                                                                                                                      MD5:97EA83DD2D8E269ED678818F40CFB527
                                                                                                                                                                                                                                      SHA1:4807B1F7C279055EEB82DB6836249982D439C3D7
                                                                                                                                                                                                                                      SHA-256:0BABA0F6B73C603101B0D4DAC9C6FC1BA3EC48D0F455E62780DF8B96F633DC7C
                                                                                                                                                                                                                                      SHA-512:8A2EAA7DCFE212C664D18C43CBA73F14C3B3011881A395B8A663E9EE815CC03F1BED19E9B184C659E1E23B5C9B01407D61C3C9B9A9F8A2BBCB6EF707BA124E2F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0.IDATx...xT...L...wQQT.ZPD..Q. .^..v}.T@zI....{!.N(...{..K'!.H'm.....[{.9sf...r...7...w2s...Yk..Z{G.........g...8.H.|.......x.e@"!.....b..7J.R.8 ..Q.P.d...kj..n\.....)......p...)..E)......\.9}:`..oW.?w..y.-Z8q...{6\.PT}..o.....?(.uMMG._......>X0.Slt...=...&........Gw......l.58......`..&*..55....veN....~...U[./..~..,=?.LyY}S...o.+..5..%.O..:D.LE.v..)Im...A#.}ZZ...f...+.Q. D~.?!.s..uM.7.lU..J[}....V_e.U.......%bP....5...)...,-.n..b\..b.4>..M.u.s..-..s.o..Rn..oT.re....;w._.....-xwN...C.f.\.....Y.3c.Y.....+..nh......%.KJ..u..[)I.A+..[.k;''&.:Ti.q.....K.v.....X.o.=+.....~j.I0...7k>....Z..O...... .Nq1_.,O=.....zm.!.2.....;.R...8\\...ew[-...^+hf.....~.2.VD.C.7^..Yu......IOm.k..Z....:....:.A.6.U:.oj.F...:/.Nm.Lz....Z......".>Z.0f.....E.......4...S..8Dq..'...o/...A'h....H=.g.E.=,.....UW.9vt...... ..Ne4.MF..2.8,A.E^z..A.e..^/0R^&C.......jli5";..n?...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1823

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):165767
                                                                                                                                                                                                                                      Entropy (8bit):5.747206789737359
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:IUymJ3Qri6fBuumxw48e4GMyOIXCJuHugfqtsh7ozja5Hak0yjAug:I1WWvSx3OIdugi2hUwV1g
                                                                                                                                                                                                                                      MD5:8487B05F2A2C9E927EFE14340A5FDA8A
                                                                                                                                                                                                                                      SHA1:CF80D3A833616BB31F63231865EBDEC90E232B8C
                                                                                                                                                                                                                                      SHA-256:3BA3521990ECC33B37C9635C99D8307862653E74CE4DD1B2F6F4AD39BF9BD513
                                                                                                                                                                                                                                      SHA-512:248412D26E7218790C7796B4FA2B07D300C801ADCB604233812953041F5D1CF52835208159D98A6C48DBE9212AE78FA5A172A7A1BDD6BD4DFEEAE0FAC1CF7692
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Second_Refresh":["html",0,0,null,1,250,980,0,1,null,null,1,1,null,[138327306593],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"COz57ICfloIDFY_2swod2kQF6w",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"5",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20067;&gt;8&amp;&gt;`dopb/%&lt;1732261!=|vqc)!7201061?&#39;9efotm(&amp;20723;&gt;:&amp;&gt;`dopb~&quot;]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this||self;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1824

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21494
                                                                                                                                                                                                                                      Entropy (8bit):7.959804879455797
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:JyjobFsUIlxtyAzhw03Gy0jxLNFn5U32yA9BodGwjlU9v4KKOs:s01IlWAzBdkFnKmfSpU9vzs
                                                                                                                                                                                                                                      MD5:DFC1119C18797224C76FEA20833EBFDE
                                                                                                                                                                                                                                      SHA1:8B46071714B90BF8645DC2A69874C8AE134C1343
                                                                                                                                                                                                                                      SHA-256:3BAB7B0BC85EDB0D60FE440B70B9434637F78BE8314A2CD6B142225884DC8D5F
                                                                                                                                                                                                                                      SHA-512:5B6883B3FB2B253BD88CEE89B4B01C426FCBD47D2B33F644A26FF7BDFF9FEFAB41139FBC11EAD4D848C0DB0A80C46A3BD8B7452759F9DE74B86D8D837E994E6A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..S.IDATx.].w...u......tr...7.w_..=..<.!..@. .P..D.4e..xF.MYUS..X...?d.....*{$qhRL`...Hd....o...'../...q...9u.Cu...wX..........& (..Z#.h..i.S...@....G..w....>q......D<"... .......0..... hq..n#R..a.......A...p...P+R.....< (B. .. .$.r}.k)*.L..B....*Y.U..M.5..Xk..H!.D.....q..#.@.$.`......`...A.P~0<...8!...."... ...{...n....M...+..h}a..[...R.Z.."... .........{.@...q...x.k[;.7_|.W&...}...R.h..B`a"..>.....w!...B].......|..RI3.N.0J.jz.[.[......h\6.'N....NU..X..5...p..;Q..$....%.s...,.H.l..v.i.....DDDf.......{/...VN..huw{.....vjma..k_..9..e.]. ......P..@.....(....x2M.._..._..o.7Q.,.....O7..$.L...."$IR.......km][aP.B...*.=*.j..w.pn.....n.].\;8x....~.~ng....R..S.(...I;7....hn.3....R..K.@...(..9.,..@.AD.B...H..jW...^....L..4.;.........a02_m..!...D.........{f.,.....t....7.9....'k.|.......2..m..J).=.'i.].mE....*.u].)..-...M..V4.OwDz....M......g.}.S.vXe...A!. .....O.J;.4..;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1825

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8774
                                                                                                                                                                                                                                      Entropy (8bit):7.901665230823109
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PiPnim4x1ju1q9eSglcGrLGcsw0uAFZ3VAQq4WpmBP5h7Idnnae:PiIx1yc9eSAv0RXqQqBmBhh7cv
                                                                                                                                                                                                                                      MD5:8C84695242A4DB76F19499C9B17BC844
                                                                                                                                                                                                                                      SHA1:0532C01AC6C93A196D35E424D2309AD303A1E21D
                                                                                                                                                                                                                                      SHA-256:9D41ABF5D629D41705147F7071A54B5F68D39302C8CF0D0AE76F371176BB468B
                                                                                                                                                                                                                                      SHA-512:F8EE74BB16DBEF5391B2E93BFE1F564FD393B3537D6317284D076C3B654898C4E6B6919B9C1664D594D35BC8F4348DE70B9357FEC1F25695C75287CF69D46BD7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/tv-tap-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF>"..WEBPVP8L2"../c...M8.$I........%.....N.]..D.......u....f..Y.._.../3@M....L.nc.V..}..<..J $$...=0.$IQ.*X..N..-...m.F..J..._............%.C....8.x...@..^..x.C .....q.l..ha....!.j..9.Z../.1L/06.^..$1c..80..{#.k.....IB.....n..I..3.Q!.L.OO..........$......H,""b.H.....=D......!Z$.J@.8qh...T9...m*..M^y=....mm.vI..mff.....G`ft..ik...2.NiG..6..>_...2uD.a...A..f0...-.j...R.$.$.E...p.....c.l....t......C.c3..z..).3.$.X....)..x.m..n.r...S.......L.o*h....zk..>W..I.#IR.E..Op..c.<[....m.qI2......ff....6/.}...w.n2C..@Q.mI.y4&.._k.m.mk.....m..m...k]...(.F5.m...l..n.w..m.V-I....XKD.......'.-...]E.............*...T.BF....*.P..P@......P.Ie.).....HWvH...........\.z..]..PB..l......9)...x.....q.....1t.....v.S3....|..... ............;..-v..v..q..M...*.....D<..H..u...:............~<....P9(B8D..E(.E...0%K8T......@..j.......[=....^...E..........F.q~n..1..L.4...*..T.J.Fi9T.....`T3N.O....o.K.u..2=..r.`.......Mm?.j.k..E~{..y..J...%.i.=..U.T...P_+....v...O3...z.........w

                                                                                                                                                                                                                                      Chrome Cache Entry: 1826

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7670
                                                                                                                                                                                                                                      Entropy (8bit):7.971289140671173
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:M1gv1Ev8WA6YEhPf+XxEDcw99kR84qhYhWQr0/3n:Mg1Ev8WA6Yu+hEIYkRYYh/0/3n
                                                                                                                                                                                                                                      MD5:5595D1CD0D001A0F1F21E095A6F19B78
                                                                                                                                                                                                                                      SHA1:64DDD37C0293940566736384DA4D7D774D922246
                                                                                                                                                                                                                                      SHA-256:AA72802E7BC81BB196C5F5077CAA50A619679F49A9E34F775CA8ABF9198B62CD
                                                                                                                                                                                                                                      SHA-512:1887D2184C8550DF360187BEB44CADDAA6C72B2B75359DAC029F56FEAE7349B5F4869B7B3E0F8B027AC90F9474767B14875C58D1325BFA6F3B7883A85AA2A7EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/es-file-explorer-manager-pro-1-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0h$I...._...".?..M.....|.V....C.AH`.*$S......7.^.U..3....$)....KHme....7........|.y...$2N.y..H.....`i..@g!...........>..Pu.={....A...K.{.<.*..&..N.:.6"".T..{.......q.B.Vi...!@...so.9e.!@.(.4..V.2....w.Os..Q...F..4[i....m...z..3L."m../.$9..YU].....8t..................L.U.....Y..~.q.W..V.Fq..:..~Rj...R.VH.e^.Ji.....R.(..2..Pf..B..ZZ2.....Q...g.U9.m.....$_r-f.b...._...C..B.k.&3...4l....U.m+.Rjk..f....L....[$......[.f..1Fk.....2ruQG....B.Le......O.4S...(.882...e.7atu..#Lq.....~t.n.#..-^.[...,.. :....Ei,......tVwp..4,*.G...G$....v....:<..#ml.C..tIns"pbc.CF.H74...^||.>..+z.uJ@DX.E.."..H...bs........Q^.s....G.-3e.....]..d....U..0 .....c...).Sg...9..y...%t.`.........Jv...96...u/.HmE9.O..R.ncS....J{...T.B.....w.'eH.....S.....DN:.$s...E}1X..S..c.W......6$..g..e..x\...6. 3U....J..P. k...~...>..>h.....'...hH...I9T..=.p.akn.{...|z..8"-.KO..G.&z..z........1Y....I.k.J....6../...DC(..Y.cu.RW.P.T.P?.<...=.wu.U.^...q

                                                                                                                                                                                                                                      Chrome Cache Entry: 1827

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):18582
                                                                                                                                                                                                                                      Entropy (8bit):7.986056955532681
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Fpby8BCKd9A59nyl/pnsd2V3adgWWO/ZxjH4E92W0FcnKia:/zBn3wBylxDadgWHZxjH4uXA
                                                                                                                                                                                                                                      MD5:4012D7345FAB70928AC330D8B457E26E
                                                                                                                                                                                                                                      SHA1:4F5E7BD1540CB1DB5370F759568B1F26EDE827FF
                                                                                                                                                                                                                                      SHA-256:1C58A37894AB8CD0E04CB78CA080E83093635BFDF0A70C1186D1C64A351A7626
                                                                                                                                                                                                                                      SHA-512:F27021CEAFCF5E796B520744B165DE638D3616B064ABF388E4A112B8F234F08CEF6A7E1865A591C38E8F66A7EFABC2C2956A50BBA465734582E8DE9E1971E19A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/rocket-league-sideswipe-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.H..WEBPVP8L.H../c...M0l.6....H...."...P.LH..W..G.C.#..S...!.<z.#.;...@..._.P......^k.%.............qm.J.._.0.W.(..b..........B.a49........ &..H../.x....C7.e.4CS.?.`...R.S.....nbgq.9;.:*~5..]6..iS..h'.iQd.e.y..AC..|pz'U....4.4#....0.....9...bDLq&.J..d".rs}..}....)."....7.(.P.3.....c..<...... ...t.....^..S'.#.!t...Uj..&*..G.m...o (E..V.k.a...<3...E2....{.D..U.....H}laC.Me.~.T.UZ..`.....;'..T...*..@.m..g..CDL@..).*..M2.6.....3Q...&f{.m.0..A.J./y.$[.m..K...>....1.;.;.Sr...N... 3.Y.c....Z\.<'....$Y.m..<Jm..Xk3.?.\.tqJ.y...VKq.$Y.l...GV.x..9'8..I.....e.0.....m....F`.|...:.l[f......Crfd.c3.W.f..0L.........w1Wred.+H.I..l.Y..mR$.....U53......{..z.\\MX-X.U..X..8fBx8...'m.$I.$...@@"bf.lp..c..........'......*..0.".@..m........j.eIf.c.......x.G......q......2H.7w.......i$I..e...............e.Zf..M/f....g.a...]..,.em..H.m...$c........93.^..b..0c....[.}..>Zut.@.....I.6VF..]........I>....o.7....5.......y....t.../..o.......=..r....'}N.....cbLs`..8.f

                                                                                                                                                                                                                                      Chrome Cache Entry: 1828

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14146
                                                                                                                                                                                                                                      Entropy (8bit):7.974814837428015
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:X7/dqmkV8HICvD8m5+L8Lu+FjCF+lVEUfS/ySYv3QRik:XTRS8HICg3L8y+F2FYEUqKSYvOik
                                                                                                                                                                                                                                      MD5:D4063E146941228472DAD754D85054CE
                                                                                                                                                                                                                                      SHA1:77878713B6643FFD685BC681135DA50FFECBDF30
                                                                                                                                                                                                                                      SHA-256:AF67CB704196C72177CE619E03B722035957ED9F5C40DC201AF6F0428C5FDBCB
                                                                                                                                                                                                                                      SHA-512:7F8DE5E6FF7BB8D565078BAB18EF4542961253BCD079B12FBCA9ABA7EBE9A8F1132B907FCBF1509883974DB7F53ABD56E95CF0BB1485ABECCC0AD980A484ED3E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..6.IDATx..w.-iU..].SU;.xs......l.DB....J.. JzE...GQ...A.w..Q$)...".dI. .I....p.'.XU...QU......y..}...s..{..~k..Z.......... ...A....U.T.T.R.024.P*f...B.h9..l.gk.6.c..^.'....H.^..?...V-..%E...P.#cU...0.3.^`T2...B.&S. ......H.%.x.%.L..6/.g. ...H.R...5-...W#+..G.B..26.a..)".PA.IEC@.S........Dh....TN..@&..f..TW$...}..&vP.E.!,+.u.t....P.!W.9.@n.!.ZR2....bJ.....g...Ev....n.m.u.8.r...CX..N.jUZ2V``....D..3..+.aA..P.`.tT.n....C.u.1.A..J.9.z.%......3f..}.....Y6..r,rR) ..... ......E.(2P..f...iYs'd.E.V............Ef..Z\....%.'....X.}...X..Yp..#:..=........PR.#%...kc,Ft...m..Q..*%..B.E...."...1P.....m.vmg..13..'y}.....a.5..1#G.......E.(.b.P.!2....QD....B.... $..\.sB`d..@Y..........B'....?.Y9.9......I.........=m.+x..;..C.......Q...F.u40A....g.Gi...@....\..=%WJE..U.-OT..4..`e.;.rY.......W.]J.......K.....'.H...$ .*;.B...Jl......F.. `.B.Q.E..+.c.4...M!.....("..b.(.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1829

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                                                                      Entropy (8bit):5.190816455620734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:TMVBd/i9mc4slzYbNDgtj9fhWR6L4mqZWzCF9xJLmgUhXqI:TMHd6+bNKjz8h9nWZ
                                                                                                                                                                                                                                      MD5:A2AFCE8C63269C7E8A5A3D5C90A88519
                                                                                                                                                                                                                                      SHA1:47CF7B541C27E4D4E3D5AFED9D55B288A923FD98
                                                                                                                                                                                                                                      SHA-256:38AFA88926F69F684E93AC9023338100A57B9424CEDF63F7EE73B1202C98EEAD
                                                                                                                                                                                                                                      SHA-512:3F55865B7FB3B6ED27827BACED720A9E578328A10095E7BDEC07A2BE70FD05ED9EEDD2F76B3EBBA8ADFEBD293CC459DB73D00CE03A0FDD88169BD83D8A34B85E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/images/maglass-white.svg
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="490" height="490" class="svg_maglasss">.<path fill="none" stroke="#fff" stroke-width="36" stroke-linecap="round" d="m280,278a153,153 0 1,0-2,2l170,170m-91-117 110,110-26,26-110-110"/>.</svg>

                                                                                                                                                                                                                                      Chrome Cache Entry: 1830

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12776
                                                                                                                                                                                                                                      Entropy (8bit):7.978066674677245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:+yxWw0F6wSeFP67SPbDoZmBa7RYA3qIxrhQcIhEnZvu3knnVIXbMI2j2QS8nE8hy:+yfwRtbDOmI1PZrhBIhlk4bj2p2ixk
                                                                                                                                                                                                                                      MD5:B67E16BB96315BE1BC7CA7779F44C034
                                                                                                                                                                                                                                      SHA1:ACFCA15267C616E5B908C65ACB37A92AC204A730
                                                                                                                                                                                                                                      SHA-256:119F6B6E3F4F7128BB5E85F69249BF58826F1835DB257CB7521CBBF5022466EE
                                                                                                                                                                                                                                      SHA-512:BF14EABF08D7E2D186C6B84268F441FC2B4594C1347A874C7623983237EBE7711FC7A8B3FF161ED6547B88492B5C5FA67222DC4DE956D779DA06F3680731C330
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/neo-mame32-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.1..WEBPVP8L.1../c...M0j#.z>...?.. .....Q....4@...}.<...(..#uQ.1..<C$O....m$I.....o..I.".....m...X...;..?.x...$)R.o.>..c.h.....k.y..BP.$.....N0I...c...-P/Q@M.5.q.8AC.h.V/*..p..>.?.S......=.F..'D.z.|.2...n*....SiR.....TK,.....8.........HL.1..1`..9c\D....c.."#..c@}.D... A. .2.A......g...!"& ...}p0vz.U8.(..E..'..H.,I.mK..="..z.@X@,....w.~.0.........w7%....?O.$.-I....}.uN:._.Kk.A...bO.$.-I.....u.:.......}gs0p.HQ...rL....m..m.V.Bk.....Id.`i.....Kef...R....J.$In$..,....#..@E8e..6......s.....g=..d.x7..m.T..._.-nk..........3.@.}0333n..2......s..J..v.Y.eI......I.T.m.="3....L..._....|.:s..Ck...Q.$.m.r......>...L..7....c..ZABD..............x........sr..h......8...B..|3.7NP............H..<..p..h...\5h....[t...w..^Dt^..%m.X..r....+..$.q'.. 6.Zo.s.]....~..g.V.\.P........8.iWb........s.-..~..>....|.kS.5}....h.kO..;.@8....p..t.k.S)...5.P..o6.\c.B..B...........+......]......Z.8lF........&U5M/...\.^..Y.8..p.s......APr..V}.y..k..5m....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1831

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1078
                                                                                                                                                                                                                                      Entropy (8bit):1.240940859118772
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
                                                                                                                                                                                                                                      MD5:4123CE1E1732F202F60292941FF1487D
                                                                                                                                                                                                                                      SHA1:9F12B11BDE582DAE37CE8C160537D919C561C464
                                                                                                                                                                                                                                      SHA-256:D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
                                                                                                                                                                                                                                      SHA-512:11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
                                                                                                                                                                                                                                      Preview:..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      Chrome Cache Entry: 1832

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11678
                                                                                                                                                                                                                                      Entropy (8bit):7.963620158873159
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:SoAlmW03qJK5vNEd6i6Ul3UgPD1YdQFcHg9IIs2SqPDNAi+RoeHZsf21jCpCSY94:SofWjAvOd6i3xPBA20u6oeHZsfGjCxYe
                                                                                                                                                                                                                                      MD5:C5187FDDC310451560B5409B3BEBCC38
                                                                                                                                                                                                                                      SHA1:1A3D9CC3AA090A6DBC8DB7A66230BD141DFF7083
                                                                                                                                                                                                                                      SHA-256:344F7526DBA623467B6E62C8DADFB4D88091428ADAFF5C8A8EF84EB4062CF08F
                                                                                                                                                                                                                                      SHA-512:7E97F0F0E1703C46151BB0EB2572EDC987545BC6DDA3561486E58AA3E2F3F2E4CC7BECADDA1EDA97724D1A0622EAEA650D3E8C2397E8696D614F244CCF74C159
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..-)IDATx..y.].y..}g.......h4...IP.w..,...i....IV.d.Iy...LM...jf\.xb..U...(.$.."..G.(Q.%s.)..u..w.....?^w..f. h).[.......w..w~.r.23.... 0..3C..X..H....S.........D"..u...\Rp?...1.....-.R..+.x.=T.X.R.28.....T..Vr.....!a..4##....... .............@7.........@DdI...."......X...1G.T..+..Y.p...&JR....:....:<446R.n..n...@d.T..G.b.1....".@....7.......?.{....#.#...,.@`&.d...UQ.eN....k+[..d......'+K[.ky?Q..Id.R).+......,..k..]..oO.1...5..JS..<b.....@#..............Z.u...@.<...C .3b..Vf._l]8.v..b7..l_..{...k.|..*.5%.8bg...V.....c.g.j...S.=q.+...O.;8{..=.......r$.....@..q.......O.F..8...". .0..,..<r..|q...;.x...s.-.C%.c.........8.T-"#RU...+.Q~ j.lD..'.R.>....\.Z....b%....WV....#M....%..}.1....6....6Y.i~+......a.p;_... ...V.Z..|.[.nL.....q.Q..h.BY....K'.-.,Qj..Ii...."..a%.V.....~...kF.....p$...2.n..7.....leq$.........C".3" ..h.=.0 ...v.._..M..............Syqq.....qd

                                                                                                                                                                                                                                      Chrome Cache Entry: 1833

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10766
                                                                                                                                                                                                                                      Entropy (8bit):7.949650183993784
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:iN5s8pOEJfQT4zISKih3goIO44faSW2uvvDCACMYThphO5CpsVEu:iN5zfQT4sS5pgoZ4sFzuXoPhRp4
                                                                                                                                                                                                                                      MD5:2A20B65369B1E56069CCA936B8377FEB
                                                                                                                                                                                                                                      SHA1:0FDC2C6818BD2BB4CE72024EA54B5D65E95FB5F4
                                                                                                                                                                                                                                      SHA-256:06936184763BAEA7FBE9DC74B552BCF35551B39F80728A039D066F28C847C9AF
                                                                                                                                                                                                                                      SHA-512:6FAC958EE60E0939AD59E046BB7DECE6AEF3F46CBF68DD98572B4A4A9379D06999FE3200CA69E4CD8B4C7CE2079ABFCE84D4F70BB5405C407B591029D22CA6AE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/hattrick-organizer-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.*..WEBPVP8L.)../c...M8h#..-].*..?`....,..c..v...}d[h[.y.z.%;..j.....U..P.:P.....GE...OX..#Y0.$IR.W.p..........6rdI:.fc1..'i..$I.......)...eee.W.....WH..'.E....8.. .r. ..k.......8.....".......`.6.)dl,.I. ....G.W.&N.y.CD.l.....ob......L%z.w6....a..#..X...H..O..u.Y.l6......R..Yu.&F.}..x?.cY...7..&... .0..m#(...w.O!"& {.bOewU.....Riz...~(.Xv.xl..m.$k.>.}?.3"....6j.1z.6..m....n.S..m.=l..]fV*"..8ny.l.$.Z.c..m..q0`..v..S>%\:T$....nn..Zs..[.$K.$."bQ....O......`~h.n..~$.Vm...r.m,f^"m..0k;.(..l.:3.=q..[...^...'I.d.$.I.y.j....]....[.$K.$..d..z.....%L(&.r#I.$I4j..x..y.......$*..o.5.m.9...O.b.b`.....F4.Y..#.p..........8..c...e......@.H..2Ac.ZiL.K.s..p...4..........Bi..:c...q?..4.r7.3..Q{..D.........K..5*.Tj..!..z.....j.v..5.{..,.........}.Bg?. ...<.y....H..4*ueL..`*.>.b._LsgB..m<..?|rS.{.vS{.....l.Y.]d...e..`..Pw.....!..1. .Bw...~vr.F..~"..5..........................b.0..=/.A...p...G.P0j.a,.;..n,.....'.?....<m..].t%a.{...#..m.U.WO..]./K....j....(V|

                                                                                                                                                                                                                                      Chrome Cache Entry: 1834

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1835

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10682
                                                                                                                                                                                                                                      Entropy (8bit):7.935438497103202
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Q7eYYb8NfOO/dRK2laEmbEbLWUMs4HQ7xwy8jiGYE5grDbv4mg5dDHilBmRPkg:2erVVZEOUMSwy8hG3wmedDClBckg
                                                                                                                                                                                                                                      MD5:8D5B98D7E831E61377BE82B75951C3BC
                                                                                                                                                                                                                                      SHA1:1B6A54A761F8A6E1EA0FB21512460EFAA4FFD85A
                                                                                                                                                                                                                                      SHA-256:A07DD3EE2B6D64C0A42D778909F0E3806DC323B22B71DF4788D0945974A9568F
                                                                                                                                                                                                                                      SHA-512:DDB35E45B177EC43CF5226E85FDD6C12B92A86905DE2FD28B9D200D42D7A56F4F8ACC62BFCE8D81B5B930897F2174D9504F6972DF9EFC0F96903EA5EB9C901BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/octagon-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.)..WEBPVP8L.)../c...M8l.F. ;./J..........sw...N..;..&.N`..!jwg..jvc4.n....K..H.Rg..;..8.V....y.....>..".V]u........3.g0.I.$G....F$ZC.Q'^.._...=...$.V..2$...........'.D.rG...... ....-.........Z.W.6.....m.B..#A,N~.M-..0..8.:.!.......v..@...gD<...-..W..h@c..FQ...W.h4........g.F....h....c{.3.L.........>._o(..V........z..[;Y{?{C...}d...8f.=+.}..b=.~..=........7....Ec+..CA.6R\.......PQ.i....2vS.T6B'U...S........b...iUx.._'.....f6...<H......p....p.;:..tw..]J*w...}....&9.J.m...>.}...........rz...[.$K.$.BR....W..T.5]8&.sm.mK.UJ.c..ac3.L...F...eQ&g.{..[qF.<G...m[)..Z.}33..ch....0.5.[...Z,.6N...Z./I...mKD="+..x}.....f....9@f......M.$......{Dd..f.C.!....c..Id..4..QB....GaFd....J...m7m......RFa...>l...!..1c0.d..m....SJ...m.k.J...Zo...3K...e^.._.WhY.....oX..Y..e.Y......Vk.1....X..C.......E..R..M.8..j...f.,......m..f..PB..+%...(..LP....P.BMT.K...+....R............X,.@0...J...h.->....G...B@K.E...D..*..Pl..P.[....xq..H.h.P..PPZ..X...!...%..HL...2.....I#@.)

                                                                                                                                                                                                                                      Chrome Cache Entry: 1836

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (2020)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12817
                                                                                                                                                                                                                                      Entropy (8bit):5.34459161517544
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Gq6KPV24ZKs86O/DfVcOfFmI46coWCTGdhFKdbsWkzY:GkxI603wI46xWSGdhUr
                                                                                                                                                                                                                                      MD5:1D3D22DF067F5219073F9C0FABB74FDD
                                                                                                                                                                                                                                      SHA1:D5C226022639323D93946DF3571404116041E588
                                                                                                                                                                                                                                      SHA-256:55A119C0394F901A8A297E109C17B5E5402689708B999AB10691C16179F32A4A
                                                                                                                                                                                                                                      SHA-512:0B6B13B576E8CC05BD85B275631879875A5DBCB70FD78E6C93B259317ED6FD5D886F37D0CC6E099C3D3A8B66FEA2A4C2C631EB5548C1AB2CD7CB5FA4D41EA769
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html>.<meta charset=utf-8><script>.(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.'use strict';function m(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");}var r=aa(this),u="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),v={},w={};function x(a,b){var d=w[b];if(null==d)return a[b];d=a[d];return void 0!==d?d:a[b]}.function y(a,b,d){if(b)a:{var e=a.split(".");a=1===e.length;var g=e[0],k;!a&&g in v?k=v:k=r;for(g=0;g<e.length-1;g++){var c=e[g];if(!(c in k))break a;k=k[c]}e=e[

                                                                                                                                                                                                                                      Chrome Cache Entry: 1837

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):28131
                                                                                                                                                                                                                                      Entropy (8bit):7.980542867743361
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:nvkTQURr1MKCSC2tHorXMLGn0jWdR+Nk6QfZQposeM:nM/CSC2EXMLGkW1LM
                                                                                                                                                                                                                                      MD5:880BCBCA23489FFAF037A76F019D18C0
                                                                                                                                                                                                                                      SHA1:F6214982065C790AE58C18C08C9C70BA16C5E55F
                                                                                                                                                                                                                                      SHA-256:68C1E5972AC259EF459715DD9DFE1257100C8C092864733BBBBD87782F6FEC27
                                                                                                                                                                                                                                      SHA-512:10EDE6E890615005E7F49DD58032A032E16F3505709CCDB294BD352913882BA5376BA634CC5CD2ACE1680CBC5D3E8DEDED55C7454EA1C7261340C44515C593E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........7............................................................................w.z.3U..F'..{_.y.v.l...X.^D.N..IT.@... . .6..#.U...Z.e....|..w...U.f..HT..8X.V..e]gY....M%.._...o..........)2..?O...^^.A.."DN.|..1....yq.J>.P.c......hIW....]V.!...x}........R[..f..s.h&/_..-..N...4.[.........-).....;.#=.;o..h.H.0.....(..c./>..........3.w.h..S=...........C.v...._@.r..s....KO.....:"J....(^S_.....v....M[5W<.v..Gd.i|..s....(.S%5i......E.X.u.a..5..N..3KC.........kw.iw..X.r...^..~.9.V.......n._;A.9..GM...~.6t/.Zw>...hb.M...........+...F...y.._e.{...2.{.X.>y...K.e.)r.|.p..N.%~..A.r^.".....7..oS...pJ..7.2..z.q..P.k...11...1....b.5.N0...<...O..Z...e...i.V.U..q+y..^T$....}.....j{......~_.WJGn|..^..4.Q.......C.....ch*lA.4.......1.Q....|e^M....w...z[...(x.}.iI#.... .{C.9w.t>7...d../.....5@B.@.9E.=;..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1838

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6934
                                                                                                                                                                                                                                      Entropy (8bit):7.681131233732453
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:YiTkzqaY48OG9sSzzoHU2q1peNzL9373azkr1bRMAp7:NTk2aY48OGVfZperztr1Jp7
                                                                                                                                                                                                                                      MD5:66BAB587C36510C3BE29A74D2E6E8379
                                                                                                                                                                                                                                      SHA1:AA8495FE2A74654AAC51C29D7E70B7E975B0BBB4
                                                                                                                                                                                                                                      SHA-256:1B5AE4E349612EB2CC5C13475645C4CD237EBA67BA8CF2D2B71A343AEDCE860F
                                                                                                                                                                                                                                      SHA-512:93992E6CD31C9CAE38DDAE62B8400E2B7C3B111DCAFD35055F32A6666E6F612D2766F307B697A0894C770FE71A86DE1874B301AF3017518ED27BB0E409ED8AC2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/tlauncher-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c......$5.#...............V.{:.~.I.....RJ.]..}..O.....P=.. G..H..z...o../.<..q.I......_h0'....[...]e.d....e......rF@.c........*..J...............D.....9..T].#.....+......"..(.C.A..H....T.!...l..,...8Z....o=....J.=..')..E...[*..U....s.....c.i.$..xr.*f.....m.H....=."b....!.>...K+td.V.1...%33C....h.S.2f.9b......<...m.....>...3.jJ.,....P.1...33z.,.>.{.^.#Ir$I..`1..?#...a.g..2,&..$.mK..|...t.C...Z.j1..$Y.$I. k].....y.0!..$......//....>o.....k\\.z,.=...[.bA..9...T....V.[{..J7k9..Y.....5.Z.L/.9u>{.b..........O.......{....{.....?..K.....3..../.4...F`S...@..........1...9...{Lg.._.y....[.....n};.#D....7.@+.S.(f..P.b....Bl....L..._gW..6gm/..YW.E...M..=H..H..../-.m.W.%..0L,..#...1@U.fO.W..d.9c..T.s,.I...I.mJPfL.G}C.,.qi8.......*x.`*...UF`.X.....1.J..........n....F.`..c#.uJ....0.... ..3b..`(.A& ..Q..(.Q....`..`4c..,..Y..S..%f..`.a.... ...kJ.P..C......;..G..M....f..F&.f .7.7.P....0..O....U...H.l..)1.Xe...q.C..T... .O......G.$..G.<Z7.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1839

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):164295
                                                                                                                                                                                                                                      Entropy (8bit):5.383513264476802
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:pcVtxZBWu5wTYjCpEGDpcyPnzto3Tc4QvynBPeQ8+Gw:pyPBOYjCpEGDpcMzto3Tc4QvOBPX8+Gw
                                                                                                                                                                                                                                      MD5:4B88D387C2991238E604E9C5B2ED98D1
                                                                                                                                                                                                                                      SHA1:6AC9BD1A1F9170F40A0B1BBEA9A02338493E2E04
                                                                                                                                                                                                                                      SHA-256:9B4DAC8A1F6D37770ABBADC2D1EDF6284CD10CE46F1CD8AEA9DC2A9D076BBED0
                                                                                                                                                                                                                                      SHA-512:C73E037406FBC2C9F440BC1F18382AFFACA9E4388E046698D1F0D1CB7432B845E387BCF3498F2C9EB8CDA805391BC517434690463322FE3C1FEBDEF41AA03179
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cmp.quantcast.com/tcfv2/cmp2.js?referer=download.it
                                                                                                                                                                                                                                      Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!==typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"===typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="/",n(n.s=130)}([function(e,t,n){e.exports=n(61)},,,,,function(e,t,n){"use strict";var r=n(34),o=Obj

                                                                                                                                                                                                                                      Chrome Cache Entry: 1840

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):13098
                                                                                                                                                                                                                                      Entropy (8bit):7.96686275297152
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:NFXNqvDCuUho9ivZdKu5439MpWvqOuXPodwmMz6IxtOblGoxVy/cDtS3T:NL+DNFWZFpWyBZz6I6blh/yOSj
                                                                                                                                                                                                                                      MD5:08B5E6C2A8668E39E12B7A600B2D4761
                                                                                                                                                                                                                                      SHA1:DEC9F069A005DB3753CD306D3C7A8F060D7597F8
                                                                                                                                                                                                                                      SHA-256:258DC2FCE0D4CD0D4E724FF34E581216C323D24255A9FD9058BC4AB9D789EEAB
                                                                                                                                                                                                                                      SHA-512:370F2E3A202F15329B19DCAEF953DD967E307983091544BE6462191992A6808AE06CED7DE0B21B4004AED22B93E18DFD91800DEB806C11EABF590941D60076FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/ultimate-custom-night-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF"3..WEBPVP8L.3../c...M@h#I.T...]F..<.".......|.6<.H.s.ns.5...tw+..].M.(...QQ/../.0...M.....i......$...q.H.DL.A.{...5.:...I.U.......ax.Dnl.V.......A.I......?.. ..KBIc...[...<.XP.@(.....i.0.M.F.#....>@Q...... .(g.=..?C....<.G......h.[.DM9Y...n.-..M.Q.1...He...Jo66sD...FQ>..M>.i........0......M<....CDL@..BBRJ."Q...U._.S.?...3...R..o.vl......<....i.L.1.Lm.m.m.}.....p....<....@I.$I....XD.b....I~Y..j."L..[.$K.$.".Qs..J.....y...W}..g..~..pwU..?.m..m..Z{.c.>.........O.....%.`@.%.c.yV..H...m[.J.k.f..v....Ye.9{.%I.$I.-$...c...|..{.....1.vm.Vm..c.%.pww.(d|......I..2..y.r..k.9Gp.G..m.m[.R....9<..m...../...m...l....[k..Z.m.m.u..H.O3.1&.n..........(bC..%..-mG...Z....H(...`lT.....+.B..-.c..e|.......|.................V.!..iW9.tp.L.....(4..p..R.,L....z.w.....m... ....U1/!dL#.7....Lx.P.....UJD*....\1..q7il..s.R......iVV.<.4y..Qh..Vb6... ..X4..C.......67.H.V...Q..0*EK....s,[4..0R...di......CQ....\J.tuBs...l........I^H...v..z.c..qG...$...\.I3&.QN)H...A#

                                                                                                                                                                                                                                      Chrome Cache Entry: 1841

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3913
                                                                                                                                                                                                                                      Entropy (8bit):7.920323796885375
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:ms2lMD2GJJ6YV5zuqFCDW8uwPwWhVDfDZv+z8Xj736:ms2mDbDVJ3FUKQThVL1v+4f36
                                                                                                                                                                                                                                      MD5:12C6440D42F5F4C67349CFFD23F9C502
                                                                                                                                                                                                                                      SHA1:411318E298085008D4F2F6F157BD42FEBCD9DDC2
                                                                                                                                                                                                                                      SHA-256:5BDDABDE56BBAA1BB38FDB427008080D7166C6F3726DD1AFF6A50B5C5FC09B81
                                                                                                                                                                                                                                      SHA-512:9EB741DCA70C6DA04A155E7EA9E9BD0A1466380903E8388962DBDA274107A1AF8989EBD283E8833F545ED898A825EB3144AF5800728D83776F003F59D29C9FAB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..]k...u>....ew..5.lc.l../$4!....(\Z)*...$VS...m.T...UK.JU..MEQ+R.-%$JK.IJ1-X8` ..\.p.........<..~..!..!...h.}.{..........]2.`.....X...`...@0.k.....X...`. ....w}E......3..X..@.D.D.N7..}...@.P......@.M.7m?...3..q..No.w.)fS}..g..Z. .h..L....s...g....t..=wtu.Xl.A... .1......G......AgV.CZ*........Q.u..,..C..z.K..L|R.v.,...z...O}..L.*..h.T...P..C..:...6.?..9o.u....&{..""zq...GG.s...^6c.....A...wp...$).c:I...:`D+.O.6.O....`#$..P'B.w......O=....i^...9.S[9@.3x..y'R.}..'..W.....5(.{Zm.T.....U........g........).p.Fx..... &.c.d."..A.....(...C...HO.]......9^.Y.H..R.f5w.W.Q!..I:{..[V].....~w.P.,X./......s.Pc....T..v.P*....C.&m..8{..$%....@...._......yQ$..z.j...N\.z.S..@dJ....z.6......1..7$.....)V.X.qw."r,.f'w..Z[V^Y.....%8.39.........3E2.|........&03Y*.9..V..0Tfa.:.7=...L....._.uy.^=V.*..R.(...q.{.1H.y...2......3.Z.=.{-X.63=.L.]D..J./....Y......Vgg.S....&

                                                                                                                                                                                                                                      Chrome Cache Entry: 1842

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3434
                                                                                                                                                                                                                                      Entropy (8bit):7.886700633944543
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:wbSVZN58QbOsABmqm5fdP6KDMwPItVMAYgoODqyKMThXqTlCZ/G7W4iTM8DD2+G6:wkj55bOtJKDdAtVMAYgAcTIlA/Gtp+G6
                                                                                                                                                                                                                                      MD5:1AA447EB167F166965640322DCD7BE76
                                                                                                                                                                                                                                      SHA1:78352B3D16652A87FF6D1456C6924FC2CB4550C5
                                                                                                                                                                                                                                      SHA-256:9DCD84E560A038245900EB7E9D57B7752A0E25AAF03421D3FA8EA6A04507E1E9
                                                                                                                                                                                                                                      SHA-512:94403401C0107D5C63B36EFCF676373BE59F41D906BFB4E1F7C176DBEBD79EE8433CCD463FF0284F8ACEB6B94AD01D6FCDF3DA4C8917726FD7571B3181E67FD5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/microsoft-outlook-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFb...WEBPVP8LU.../c...M0h$IQz..z...G........6`'!.....F/5......-bt..@...W......dc._.B/...{..i$.Z..)....?.....t..R..p..+".....K.......;. .N}.O..lt.;.....E...X..<v.....M..V.bz.a.p_CT4x........`]..v.%.Zhc.8...r....t..:....]u{Uu.?(...z.^..a.m....{.Cpd133333.F}D.j2..Y.......@.z...d]w...,I.j.m.Em}.b^..rk...u..S.......Vkx.$Y.mI..d.s..M...NM..Z.....{..-1....,..oV=Z.......#..H..10....9W.S.....>.}.?...X...........jN.:@.{......._..zz......y.......j......O_....f.......|h..........4.....H....L...KI..@..J.#...c........S.\b....a*I%.....EC."g....j.=..4.A..{..3,..-....!....'.X.........S....L}2.K.;@q&._....c@...w....:(:(...3..k;`......i.O..U....X...7A..K....PX..x.u..-.......1.M.%V........B.u.q.e.......M.....\.gd.....|..Y..v..vi....$.RE,a..Y.j.e-.@....H...]..=.-..5...`.....v....JH..\.....*.B.._8.W...l*T....~Vw..x.\..(.*......D.2U...v...M..=...q..tk.,lw............Z%....z...l(1.......A.\.\...``%YU...l....x...q.....K.1.4..B!.,..i.r..y..."..q_.".I

                                                                                                                                                                                                                                      Chrome Cache Entry: 1843

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6266
                                                                                                                                                                                                                                      Entropy (8bit):7.901574509189394
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:0z+LZpGR3p8kNnE0LvGajsLSHJxNElatAUAd:C+dp6ZLvGaI+nWtzd
                                                                                                                                                                                                                                      MD5:DF4B7C08BFDCA2E1142F2E41EE86BC5B
                                                                                                                                                                                                                                      SHA1:C01E73D6121E7A2FAC99F6DB7D60D4159A3BD70A
                                                                                                                                                                                                                                      SHA-256:6366E653F0B96387D971EE41683084AEE9F09343279B307A6443580F0594A53C
                                                                                                                                                                                                                                      SHA-512:915A76EE761E20895B651152D6D38E7328CBD3F5C49B64C7F47AEE72E424A852CC15FF9FA61C80A0BFB9D3A5999FC4AB77EF1DB8906360329042070645E44EB5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/pages-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFr...WEBPVP8Le.../c.....m.6..._.n........#.......Z<lW=........&...A..]...I.p......8...YR..%..,...m....#........E...D..Hy...._..x...d...........$./.........3,.@.^.....L...`........V.....ic. :...D-.. h#...~..j%Q".@7 ...J.......[..s}......@....O@b..E\o@....$..,mo;..Jj..E[..?.j..CA.6R...v.....v..R.0*DG.=.3.f..E.%I.$I.-$s..^....~.tS~....|.'.$Y.$....G...s....tc.m..m......).l....iG.i....I.5.l.z..d.....y.>.......Eff...'37........Q.5.$).$..l.c....z^......m.9I..|..(...=g..Y.vN......Y......oL.....a.|%>1.$...f&..1..|....1.).....A.......N..(4.<.. .....vLv.n......Gb....7.mq..,.A..@wBt.5.@...........V.7..o.s.}..\ML.v....&b..zx.s.;n..m......|..{.o.. .....D...o....+....S}.1.MT0.!.......X1.....m.{.c^yU.q... .....k..?.._.......H......"..`.G..A...f..J.1?s/.^.W.E.[....~.....V^..XH.c@@ 4........ .A......h.F{._..?......m.~.........Y.9t.!....B.0.7.~.F......h.S.j.........:~.....`.$ .......~.Qg]L.2.5... !.I.L.:1...M......_....U.PY..@.mO.....KUMTm..Tw....ss

                                                                                                                                                                                                                                      Chrome Cache Entry: 1844

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2343)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):52916
                                                                                                                                                                                                                                      Entropy (8bit):5.51283890397623
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
                                                                                                                                                                                                                                      MD5:575B5480531DA4D14E7453E2016FE0BC
                                                                                                                                                                                                                                      SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                                                                                                                                                                                                                      SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                                                                                                                                                                                                                      SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.google-analytics.com/analytics.js
                                                                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                                                                                                                                                                                                                      Chrome Cache Entry: 1846

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12230
                                                                                                                                                                                                                                      Entropy (8bit):7.96302328100292
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vPMcbUZkqChqEnIN9DmE5NSHLn4CjHqr9nL3FApaRAWMVZzajxWzEU7UNgCTaosz:vky8kqQnINFHcHLn4wHqV3malMVZWjxk
                                                                                                                                                                                                                                      MD5:A8913FD4C28A169F9448953C64511545
                                                                                                                                                                                                                                      SHA1:7E9E26626874C5EB55525463F5EA92C94A2D5FA6
                                                                                                                                                                                                                                      SHA-256:A8C32D305699488E68C06489F1EA136A899E599FC7CE7D0975B06263614A545A
                                                                                                                                                                                                                                      SHA-512:90AEDDA7BFAA66D6325E94678E3CDB2937A960B9D393AD508F0C4D69634573FB1D1B3E6D59B292C3438A35C87E34695221D10718E1825CA6F408466264316C39
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/install-disk-creator-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF./..WEBPVP8L./../c...M8l.F.........!...L.....y......v....~.....~.&........O2.j............[.q...Um.2.....OC...wJ..m[U.p.......3..?.m..H.$9......8...w[."I...J.Ko.....jh.j.....Xw.(..L..x...O.9..._...Q).yzT.].*.3.......G3..!..`.^ ..I.0........Di. .@R.@(.........(..AhYw.....f......O...&5.m"...:6...l..Jc_6.'`../.[.k<.=.%.`........V....)4....0..m...Y.:.........*...6z..v..j.G.R....97.E.o...I.m..._D....3'33.y5..|pf.,L.vwC.......K.d.m.2.(..........D-.dm..`f.c..{k.D..m...m.}..="3..d....._3.......y..l...U5$}.....fo(L..nO.[.j.m..K.},......i..j..6..d.%I...<.....fa]......w$.m..k.c...K.E./f.{.^S(r.H.0.`...#I..6.(.....0U.....Hl.I.$*..{....$9.$...w...c`aWz8p.I.....{....{...9. ....$...J..*o.U#n)"..E..z...r}:..Q....]....|_..}....B.+.l..1b.1.I ..Oa' dn.O.....K...d.u..../..>y...f..D... ...@...Cr.%...:7r!.......D.$.("A ..%..'.RZB.*9....N.??.....5f.......'.....&.R./.D.r.......0@.d..w.........C....H.F.|..tu6.! ..H.0.....A.......$......h.8#;.....(1.8.{

                                                                                                                                                                                                                                      Chrome Cache Entry: 1847

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):43
                                                                                                                                                                                                                                      Entropy (8bit):3.0950611313667666
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUMllRPQEsJ9pse:Gl3QEsJLse
                                                                                                                                                                                                                                      MD5:AD4B0F606E0F8465BC4C4C170B37E1A3
                                                                                                                                                                                                                                      SHA1:50B30FD5F87C85FE5CBA2635CB83316CA71250D7
                                                                                                                                                                                                                                      SHA-256:CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
                                                                                                                                                                                                                                      SHA-512:EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........L..;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1848

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11086
                                                                                                                                                                                                                                      Entropy (8bit):7.923273316383555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:nR/62xw+ecZtLn6dszKxtEohwUE+K6HIDp3RoNJOwx9z:qyZUyzjaoDHKcwxp
                                                                                                                                                                                                                                      MD5:A71AB9925273A8EA3E6C4E465CAAE89E
                                                                                                                                                                                                                                      SHA1:7A6AC4B60D710E417D9A58A0148D35D1E61AFD1E
                                                                                                                                                                                                                                      SHA-256:9E8A96AA7DA6878BB6189572058C2ADCF8C72CE3E41C2DFB80070B0CAAF92E95
                                                                                                                                                                                                                                      SHA-512:8EA6C8DD5EA657F642CC9272659C137B95B75F29DEE6B710CD2647ED4623D7E3BB0229AD4CE34A7811A10E8798AB93B5F15BE77A0AF837AA55BB8427609E3D95
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/bakkesmod-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFF+..WEBPVP8L9+../c...M8h.I....W.?.......x.I..xC......z.r..Zo#@.s..jb...Xh.....2.&._i[.S.$e.(.$E. `...........mU....N.C.......F.$E....Q.(..`....@@..".......xf......$>..<.P..Bx.M(.`l-....@.W..B.x.f...P^.:....V.=,..@....q8~....m....W../.. ...!.>+....$...`O.!.P..T.?.{0D......rs..W....C.0.e].l....O...6O.m..$.V.sm.Quv?.!f>'..Y8.|N.<x.g....ffff6f...f..%".r@..$I.D..].....}K.dI.d[Hj......K_".c..o.g....z<..{..dVV..$.x.m.....o..m{.e..$..d..U.|...I.l.m.R.m...[v|.?S..s..#Ivm+.........N.{.....m.!I.o.8N.2..e.m..m.....x..1.l...Q.RWw.+....8....o.m9.$I......(t.a..7E<a`PUT...l..l..m.V..K....i..%-[..~...N[.4c.s4.PJN1...J8b.X.....D.. .@..JL...b2-.........c,.1..s......`......G.k...PB.H.cp...a............Pa..h...<.`.....D ..@...`b.=6$5..!HRN........x|..W."^.6....."(...P.@.@"...e.v. ...."...(...\...G...]2!.+V:tX.D......N^O...~..GJ:....,5.8*LR......Jh7#..>5.p..c%.....0O.r.}"DV.p.....3v.F^u..HB....Q.....H...E|....bi.'..&.[..0.....1..P.RB B.#...._s....>....$.hP.FJ.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1849

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7274
                                                                                                                                                                                                                                      Entropy (8bit):7.964495816691422
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:GwNCbZdkObzugoV3cV3c90UGOXZCHMR7ix:GoCbZdkszy6V3LiZVwx
                                                                                                                                                                                                                                      MD5:81494783CE14A58FEB04A46B96591DA9
                                                                                                                                                                                                                                      SHA1:D46085637219678AF5C01CD5230C14AE3946C2CF
                                                                                                                                                                                                                                      SHA-256:F361D139734802566383493238F89ACCCB901AE56E0E1884C8C873654EBF864C
                                                                                                                                                                                                                                      SHA-512:45563D7C68436A70E106C4FA35400D51612A9C48EE1134DC9EE863C49A3BD9739A5670F673C9B1C905F0D649253A89F8A14F3C790F5C0AAFEA36AB82CAFBE2EE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-word-2016-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFb...WEBPVP8LV.../c...M0h...d...?...".?...r..2.mR...t..C...'..ui...l...........$)R.g..o.I.P...Nc.v.5($%lI...r... I.i+.}...g....O..... . ......0d.)S.|.r@..`..LE.o..Oit...N.zB..IMjR.. LXvo=Exl..ojR..L..(....,...........r...u..uYNl..<.......a.dI.jJ.. ... ....o...xCA.6...... "&.n.......{V...]..~.'....VHs...3.Rd@..Vx...h.t..._A.wx...VxxKi^$.t.0..Mz..?.i.t.........#...nJ...9.s.9.<..>.^.....^.s.y.9..%v.`K....\]........kz.....C..O.m.&..h.Y..p.....Y..+.j.mE.Rkk.I..R..\?.....yI.k.VKN.$IR$[f.5....g......V.e........_..........._.A......j.....:o~.x........:..?..{......./....o....:................=....W......q..........Vy-.2.vk..".n.oE..4.6k....#.5.v........p.5Z...K..o6.Ey.H...i...ql.Z......&......F...9O2].%|ZWk....<n.,=_..u'......dNSnp.....f63.$.w.. B.. ...gA.z<7.<'.?.W#l.{C........p2...1......1..Y..$..$a*........h...D..n......2.1#.t.v.n.=..B8F.. ..D<..i.~Q....v.ll.....4O.M.[.]....E.&..t...:.}R5.K..|Iz.)H...t/.`5....E.Hw...t.M.....n...^#R

                                                                                                                                                                                                                                      Chrome Cache Entry: 1850

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8548
                                                                                                                                                                                                                                      Entropy (8bit):7.850433918014
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:oh6omFXeQaFyBIdwBw6Ms905KNN19iNwJOo89eAs:/omFXeQwyWCBCYWW39rJOo891s
                                                                                                                                                                                                                                      MD5:D78FCCE5FE7150F778A5B13930CAEEF3
                                                                                                                                                                                                                                      SHA1:D864A6A420B7F913FB469E7DE32FC8CFB5770082
                                                                                                                                                                                                                                      SHA-256:42CAF69BAB44A63AFDB218F206DB0A838F518336047DDE0DCC595AC48F8D62FB
                                                                                                                                                                                                                                      SHA-512:C0D62D5E009E6F007894A14C1EAB9FE91D3AD3DD672C16909DFDDF1E7B2DE65567133D55661B74C590F58AF5A3C47C4A39AF76939999ACCEB4ED651ABA05B692
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/gedit-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF\!..WEBPVP8LO!../c...M0....@:....!......}..{....O....;QH.7.:..@...J.h..%.;_.hc6h....A...<iA....#.v..{......N..M.p$.V.X2~...j..r..L.8.$.I.-.^.n..P....|.......u>.,.. ..+.q...;.h<o......@..].......w.K.o.x....AD`..{.<........[.o.......K.B..pa.M...$.....!.(e.P.wE..0..m#.....`.......u.......U.h.;\.....:tOG/....I.d[..Z.>W...8S`f.a"....{~.Y.w/.....I.l.$IB.Oj....'Y.j.}...-....$Qs......!.m#H.r....?.....!I.............Z...m.....m..m.mk.;..1[...x.T/(6..H....S.E=...%I.$I.-$..A...e..#.c..h.H.m[...`..Q\Q..U"...Qd..0.0.4.14..P..y....'3.../...I.mk|.....cfNf.9.0.gU.,.,...O...af....A...m.wIv.....q...G..._'.c.R...l.C..A..fI`@............X.!.$.. .!..I...d..d.!W..1 D....a,.,b...`.........BbN&..)dJ....P.D.F...... D)* @.. .......x....8...g.....{d.Y.MGfP=.r...>....h...c".........b..1...@...]ELG..}....."....-.!..).L]U...Xa..!.s.}..Q...}.L.R....".. #..!..x.M..Z.-...s.9.9..5.GC.......9..&1$0 r..5.0......L8.j.R.....m.@... ...6.=[.^+o..`....eFf7....<D.!-.DD...d.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1851

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4807
                                                                                                                                                                                                                                      Entropy (8bit):7.933811738095023
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:V+NDKCDifLC+zHvh9QT3AMSpVbTNOhE5d4Ai00I7NYt/VUzw6kKZN:VqDnDy5PwT3BSpxTA65eeN60wPKZN
                                                                                                                                                                                                                                      MD5:00A5A1B2C4E1C8FFC4863C0C169A658E
                                                                                                                                                                                                                                      SHA1:4BB1821F77FE907A64672AA1F365E677644EF25B
                                                                                                                                                                                                                                      SHA-256:E4B4F9955CB1BBAD5411BF056172577F906A7AB90653C98810CF1A949E5EA380
                                                                                                                                                                                                                                      SHA-512:B847DAE745285E72E360D09C8C7C4EF31D277D145D42BF84A3A7AEAB6A2D023B04B6B7103C3BFEB6B42CCBC43EE1F86245236430FB5183FB42566B78D0C75413
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...RIDATx..\..Wu?...==....J..J...1..m.....".U.8...$|.!..?...*.BU>$..@Q)..RN.+@.1.1...M..e.,?%...jwg....{~.p.{fV......5]+ikJs...=.w~....hrm.....&`M...5.k.....X..&`M...5.k.....\....m.D...W.I.5.6...|......"&.....JA.Z..o.D ...D....%HS....3.0.....3.....\.._/..o$....Y.$1....e.\J...ym....l..h....."..vn...DT.r].u1F..Z..qCf..51AI..@l..$.O./>..O..Gq..K..+b.....z5.4a"..$.&..Ic./\g.....ff.x..%3..@vE,..wC.L.I..$G..<.X..cf.$.jC.#..1......-.9b&...4!('.e.....A........D"...]...u...MW.7........S.sT!...A.(....R.V_....'.>........d...6y..J..d.zx.....V.3.q7~...........Q....A...s.Z...P...9.Vfb.4M.3..Fw....}.J.....56....|j.._...A...X..W],....6+B...8.6.....7..2c..b<`!..JD..?...OX:..d.oM.|.[..g..~.!M`L..[.?.fw....bvl6.D.&I..{..\...3.c....?...d-..3..V....x.p..+4..(cAJ.Aq......._b.m......*........x.....e.!..R.i..v.....k!.?.x............LX....9..=R"q.../..o...#.U..[..1.,!.c.k.._J

                                                                                                                                                                                                                                      Chrome Cache Entry: 1852

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6420
                                                                                                                                                                                                                                      Entropy (8bit):7.9576417164754805
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:I6SSPwc/RXwTxm3Oztv9eCse+dPHcPQIZREGFWEk7QmtlP1GK5jJ3uQVY28hmIua:Wu53ON9eCYctk76mTkMVfDrIjSCf
                                                                                                                                                                                                                                      MD5:4EB95B71BC0B3DB1C3F28B4D31B09970
                                                                                                                                                                                                                                      SHA1:51550D65D499D6EA2D6AA79659E6DC81051C6112
                                                                                                                                                                                                                                      SHA-256:8DDAB128AC24E8E64665A55D1472BD767ACAF119D9A3A01CFAB8A3A7BFC88EB5
                                                                                                                                                                                                                                      SHA-512:775413E0C90A69946BF940CF4CB60C8017E6C912A36A8E944B17E27AA2EB1EC9129CA6BBDB022D2F0C463BD371AC89040D538363234BB36936F9B3AC7EACF227
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/yahoo-mail-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.....m$E...=./..CD.'@.].=.;)....8. b..'C....S$.....8.@l.."K. l.]l.m...D..4...9..........$;U[.&!L...?"...r.#+.f..=.M..T.W..R....A.HI. . ....1B... ....~(g. ..\...!.G......)....[.). ...).a.....3...Q......u.g....W...B.b}.IR...^4i.......^I.........+q.k..o..XL5.4..|6.B.Xm.. B.IB.b.S*.8..m.4.a..."b.tJ"....1.0.n.J.F...g.........!....|..@....13..R..Y.:..:...R}.L...V}.\..6."..&..5..Lm.#....sc...I.Lo.df{.7..I.k+.s>z)..>...VZ....$GRf.........|...../.]<.m.m...m.m...gn..$5._..=)..N.Im.4...V.u.s..j.1.Z;7........$).$7............k.U..tl.V.8k...jYu.raX...;.^.U..zw.....8.|!..e..AF!..YX.4 F#+Q..9$..1%....(.b.O.`?..l.E..$.,K.........QLN=..7b.T..&9...sf.\.'.u..Y...Y...2.<...8MP...w...Y..|..3f............zd.5..,.q.:E. ....s...\.,w04.Y3...S.2..z)...yR...].....k...l.-..#.8.:.........."))\.D.q....E.u..MX._.0.U.G.(..-.2..fzC.....J.e..RB.zU...2.[61a.......F.DA..(d"].:..`L....>n...v.e.,..m..C>.R.....t`....L..A..1*..4'..>........2.kX........f.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1853

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2778
                                                                                                                                                                                                                                      Entropy (8bit):7.903628370417734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:oLMIGpImaD5zvTHL/9eS8NWBFVhffx3gXzZRt3cH2k2NnOpo5/xMhfeIjdOMWb4E:oLWwzTr/wS8odhfhgXzvtUSnOpSxMhWx
                                                                                                                                                                                                                                      MD5:48DE1B63E4FF9DBA00523F3707F58980
                                                                                                                                                                                                                                      SHA1:A07D4A2B02B36D8C0C3C01C784A0813F4BD8A9E2
                                                                                                                                                                                                                                      SHA-256:D1171C77D31FC53966D5B66566C169797BBAA0356018A86352274EA5D21AA147
                                                                                                                                                                                                                                      SHA-512:7552D981AD57C908C1AE4A3D56A9BF75A9399B0A7B86A2F450B47687D277739A392F4F0F9333509DBA76A7AA59A9DE88E6371452A7E4D969EED30FF9EB7F9271
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/anydesk-mac-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0l.6..wV..... .....;.9=./.v..(.$U..<\sO.o.j"I..J$......m$.=..>.."h.6.28.......Th....<..w.H....&...f(h.FJ....{.D..p.*((&R.^H.*....I.........{l..8.}.6n{....m..v..\..._o=.......#I."[......".L.......m#A......W...m....?yuL.mm..I..R.....m..Zga.m..X..WUw)Y..P.$I.$iDfUw.3.._.<M..A.m$A.........`.Og....F...T..x.x..c...`...fS.p.gx.P..`..`<.1...."@..c..!... ...B.qDe..mH..:l!.2.....V...vP.... ...q.p$.*.8O.Z...4......i.|..b..0D6.....`.(X,@^F.(.(."z.@+..8 f../#.....@.1K.?KA6...I.y(xb.....d.V.....im.>0Q..:...a.0.,,A.BI.sI).u....D**H.\Q;q.(.B...S..E..O.tH0*........{_."...x..p....{B....''..P.<3..P*......!..!~}s.....+a/.B.@)..E..W..:.E..p1Z....7}?.....1...(+.....k.(...b....u...,.........x...b.?}..o.]..P.0...._.|.e....v.uK..........=.V...b.7...o./.K8a."...._A..b.....P..pa...M.;..}(|.._..@..@.@X0.@....;.9....A...w.....k"........?Z.?.^..........|.l.)1......e...[.kf..........%Wn.."........X.`.Nzh...d*".D..h..d.0Y..D...>o....s...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1855

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2836)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6177
                                                                                                                                                                                                                                      Entropy (8bit):5.441757647965717
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:tFjRteJS6zpbEOv+vrp+gyOB00WTflDBMLCMDfwpdxo9JM5:beJS6lQOGvrp+gyrf7MLCMDfwpdxo96
                                                                                                                                                                                                                                      MD5:576D46E5128A96CEA637ABC1206EBDEF
                                                                                                                                                                                                                                      SHA1:EC4743D89D56122E6407743F2246DAFEC3B49AC8
                                                                                                                                                                                                                                      SHA-256:0575B7B6BCDCBC8BB7F6AC99500A65DAA1E19721D8081D588F4356DD201B0F56
                                                                                                                                                                                                                                      SHA-512:5BF13B194E64FA308B2731A8CCF0E6443EC34EC021C8EAFD4270F10788FE57666B8C89A507B2BF3AF622CF45E3F817A23C2C3560008F80512C2C22CC851EDE8E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/pagead/js/car.js
                                                                                                                                                                                                                                      Preview:/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var f=this||self,h=function(a,d){function c(){}c.prototype=d.prototype;a.D=d.prototype;a.prototype=new c;a.prototype.constructor=a;a.C=function(b,e,g){for(var y=Array(arguments.length-2),l=2;l<arguments.length;l++)y[l-2]=arguments[l];return d.prototype[e].apply(b,y)}},k=function(a){return a};/* . . SPDX-License-Identifier: Apache-2.0 .*/ .function m(a){return Object.isFrozen(a)&&Object.isFrozen(a.raw)}function n(a){return-1===a.toString().indexOf("`")}const p=n(a=>a``)||n(a=>a`\0`)||n(a=>a`\n`)||n(a=>a`\u0000`),q=m``&&m`\0`&&m`\n`&&m`\u0000`;function r(a,d){if(Error.captureStackTrace)Error.captureStackTrace(this,r);else{const c=Error().stack;c&&(this.stack=c)}a&&(this.message=String(a));void 0!==d&&(this.cause=d)}h(r,Error);r.prototype.name="CustomError";function t(a,d){a=a.split("%s");let c="";const b=a.length-1;for(let e=0;e<b;e++)c+=a[e]+(e<d.length?d[e]:"%s");r.call(this,c+a[b])}h(t,r);t.protot

                                                                                                                                                                                                                                      Chrome Cache Entry: 1856

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12350
                                                                                                                                                                                                                                      Entropy (8bit):7.977371921482251
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Y8D8VHR8DoIEfHEhnMlFRXhV3qLQLaX5nykKGIvO1HnTpddpsE5PQI8+2nnkeTwy:RDKxpZ/lFRXLqLQOJnvNHTbduR+2kewy
                                                                                                                                                                                                                                      MD5:619DAACE6BE31E066EB3057FD8DE356B
                                                                                                                                                                                                                                      SHA1:A829D8121163C8281C89AC056FF5D5A55056E5B5
                                                                                                                                                                                                                                      SHA-256:444B70AEAF412FFE770BC4D1B5B6D4E8FC915F5AD2039F8444B0C23A8934775A
                                                                                                                                                                                                                                      SHA-512:9AB9E1FE08022641DE96080BF5EAF87DD86075F8F46FF3BF04F7ED7857E88B8EC73449B91DD382EA775E95C706008171CC1C09018B2DA16864D0835B9F02094B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<../.IDATx..}y..e......ko.C.I.[`.,.Da..q......E.....q.\PF........FAD......a.....U.{..GU.[.v'l~..}...T.....;.ID...u.:..Ep...@.!...?.0.K.v.-....@.|B..Q....P...i...A........)C)sK......4.@.%p.L"....T.........w...##..B.. .X.K.....U.J.y..H....bI.....U[.M..H._........ae......x..2.\y.... .).AL.).4..XS4V.N.F)KV.....).]">.....\(....WU(D.;....%.... .!O.5.>@.Ur..`,>.. M...r%....4.>...._.Rmb.@0.....j.BI...T.Z..J..W.........6....TAdU,.(..D.j.....9/.(SSL..h"....ZIj..UB...L......r.b[.lY.b../..q..u..Uk.F....]..j..'y...3w*.N.hMNU..".....:0...Sc.P.q..T[".JM.UP.b.....f...' "...b..@D......|.........F....s.#V....f..|.}]<{fa..]...;.b1W.6...jC..j....].@%I2Z..F+]F^.fN..g5.$".."R.s...^....o.......q".....<..G..u....z.?.g..J....."5.&0TG.Z.I%y...S+.J||..UA.T.{...z.sDd...y...y...Y......$.yM...+..|.I.?...a..&N..V...,.!@a(.....Q..k\......R...@..bI...Xk.h..U......g.}.U...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1857

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1858

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18771
                                                                                                                                                                                                                                      Entropy (8bit):7.977346048069192
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:iEEE/jphrqdlcwAiSzXptLPy2EB4bBQMAealNC32Yt7Max4U:vjpBJiSL1EB4bf9aTAT7Max4U
                                                                                                                                                                                                                                      MD5:C7C48A55DE3FDC6245A2E25D7D2B5E65
                                                                                                                                                                                                                                      SHA1:7CDF72AFBD8D44AD2D8F50D3241D6E6BAE20297F
                                                                                                                                                                                                                                      SHA-256:773D034D79D7C2F774B97A7967D3FC529FE01D8E2B8B17FDA80EE3C952A5A6A9
                                                                                                                                                                                                                                      SHA-512:EA91803B0BC85D86398D3300BDD308B07ACDBF8E0A0166ABD2BBA31E034FEEE6E68EB4901FF1FE91A0666481939980B53C268F7FADBD539464C489E1E072D70D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..H.IDATx.\.i.e.u...3......*..dQ"e..D..m.dK..h.$..v;....b..7.....4..I.Gz@..P.m.'Er...%Q$%."Yd....t.=7.>.Qr......w......}k..60..{.=.^...C.y.1..!.1...VUU+[%...R..<RFE<..:....9..C....a.8..q..ZW.......Bx.......<..a.....#..AHi......`l.Q.L.$.c....?E.;.o..8.#!<r...._...B...0...TU#.x:=>:....#..s.P..3ZK....N.3.p.^..R...p....0..QB...aO......*..$.A/....9.o..p.8..4...!8g.!..F"....b..S......#...]....r.3.9..p(.....!.p).u.#x..y....J0&...._..pX.'m...3..RR...s.:..1...F...........a.~.P......QwN.=).+....A.6M...q.......m)..w......9...#cq..G...#.FQ.1.f4i.t.......>-\..=....6J+..6..[.'..u...I.s...{c]...#......q.L....b.X2...1..i....~]W...L..|.Wee-76n....I8..b.8gI..p^.>.c..V.!...L..IU:o..q....mlnnnn.....M......x.M]r..a.r.|.f;;.l@idl..1B.{.<..E.".Z..2. ....U.U.Xk....G.....RZ.<..zJ.G.y:....a<.P..Fx.H."...&U=.....D..n.V......*.zcc.3..\..u.U.1...:.c...qF.$N...gY:.R.d....#+..N.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1859

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8474
                                                                                                                                                                                                                                      Entropy (8bit):7.944246524977916
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:nHhsfUYLeydvKzw5y1/PL5fP/rA9Db+rJu+Un6yGDH3BJ2RAC:nHhsfURydv+wytL5fPTsSu+u6y22AC
                                                                                                                                                                                                                                      MD5:638E9EEEFB71498CED29D4EB6846BC19
                                                                                                                                                                                                                                      SHA1:25B1F3E3B6BB6D482EDF8FB7CE5E9B92EC381534
                                                                                                                                                                                                                                      SHA-256:6C87E1637D9ED10D94C028E78280612034B6E34C04A62F04D69D5B1309BBC2D4
                                                                                                                                                                                                                                      SHA-512:F80602F4FA30BC5A3596B4851ADDA3A7E2F01C94C0EBB78B14B2307162CB120CC9A1A5D6FFE16A57CE4FDD2DDFB3D6D07EDA9CE35C592F49E0C409016207EBB3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/vlc-media-player-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8L.!../c...M8h#......?..!...0...*,.p.....t.X...TK.Y.66l......l.....d.6.mU..H...v.s#...W.$)V......._.>f..n#IR...3......a9.?...@.C.5.%$..W.....AJ..8...eHR.@....,.......%@......Re..l...(.8B@.).....rH.)!....a.8....8...q_h.`.(..rXJ.....@...../........Re.t..''0!y....2..pCu3'.P....?.....1.L.s.....NZ'-J.4..4[....N..%I.$I.-d....e..U..`..6....$9.$...S.......9.$Y....=...CDD..NGL.eI.UK..#.....,....Y1..g.vV.<.\I....w....'..mK.$.Z.".`f....9.i....f..d..".{..7m.m..]....u3../.3.L=...-.1..l.z&I..}.GD..c....8lY...(V.a&...f...S.-I.%I.m!..E^./....a.z......'I.U.mK.......)...Q.-.1Fo.c...........w..2.[....9.u.)._.93.FG..4E.....1.1...... ,*.e.E.t.7q..........^P..........C....W.......1o.......<.y.<.zl.%......_...YW+-..S...... ..T...z..y..{.[....Zn..Zo....r.I...V.!.BL..f.@.....Fq....v....{..hp.k........s?eQC...!...1..=-.bLQ.0t..rt.../.......A..U..|......#f.8.....=.........D.v.d..r.8............j..`..........Ru......\d0b2.....:......y..{O..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1860

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                                                                      Entropy (8bit):6.674021547526022
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:6v/lhPLUyKRxAKHMZ+bRIOXWpBvhZnadjoeuwD0HwzVl6Imp:6v/7TU1xArZwRIOmvvGdjawDlP6IE
                                                                                                                                                                                                                                      MD5:61F47D513727B9B36280684657177C50
                                                                                                                                                                                                                                      SHA1:9938456A80FFE67D15A840A8F45266608D11BBAE
                                                                                                                                                                                                                                      SHA-256:33DBE029210AF5D40741495D14E03B8AD1AE2E6EF210085DAF0D6F8992F0EE59
                                                                                                                                                                                                                                      SHA-512:C7B064B439E48A6CCB0390ADE5631F6634E0C960F870F245D72E2A901568D5C8E8F485EB3BD1BC549C594E5F1B21A9E863A4B55CD2118A9B4912EFB5E8CEFA7A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR... ... ......s......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx....p.F.E......... <.X..n.x..H,<D.V.Ub..0....14..z....|..{4-L0!J.[H.S..p.*dI.-H..O.T..#..9..c.#..d.d.....T.....=.j....B....Xl}.t..v.1a&dJ.=|..A......W..a-d..;.d...e. ....">l..R.i...A>.'....-.G........IEND.B`.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1861

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7159
                                                                                                                                                                                                                                      Entropy (8bit):7.956794835219675
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lyPaja2LL4XInJYO0nGSRWtwvrOhBkFmaCXLnK7Wnz19bm5vzdM:5WOgEdayLRmJRM
                                                                                                                                                                                                                                      MD5:DAF0A1B8058357AE85637E1B7D71C3C3
                                                                                                                                                                                                                                      SHA1:C8B1F818A3B464C14FF5B6F76590A268929D8E4B
                                                                                                                                                                                                                                      SHA-256:0080A21ACD8B156489D63610BF19D306108C778CB5BD25026CD72BF0DE9A8648
                                                                                                                                                                                                                                      SHA-512:5C48715885C91E8EF916314B6A595D3F94EEBFC1B04A009D49F0423C1BF37723BC233A1B4FEE7BDDD21D1AB9E319341A734D44302CA33B5831DBE4DFC3ECFD3D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..\.P.g.o}k....lv..^..j5U.o..6/.J.q..G<.\E.E.A........p* ..(.x."x.r..x"...r..0g......i.....zz..._.....?..(..H.".z9.'..>..XS`M.5...XS`M.5...XS`M.5...XS`M...."..H.x....?.d...E&.....{.'.,....7..Z.F..h..4cccO.....Ot...h7.L4^8.....`..F...........+.......@.oow7w.w.gvww7w_....yzzJ.%.....:999;;;99m.=I..j.$A.f.K..Z`)........!.)...8nNR*...h.H.%....2.L.E................$i4......:xl............!.s5.iz..d4J.K.8EQ.sr...........R(.M..P...s...ap`.~..I....6?|..w.\.....E..-_.l.._.\.c.}FFfOw7@M..X._.s......../."&.~Y....f.x).).o.....E...MNRN.>..>....8p.......q.q;v.X.t.....B...............3>>N..?.d.....C.NB...;v.............Y.f...GGGPB@Q.@..vv....].xq[[+.,I.....(..$......]f...5Y.M.X@..............G.W.....fg7k............F..w.....].....S...h.z=.2.q`....|..={.c..I._V.....y.QQQN....gPx..[..l....0.......c3..f.....;{.......^.3.]..9s.......J..&.exxx.}.X.O.^V..ZY...+<<B..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1862

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4150
                                                                                                                                                                                                                                      Entropy (8bit):7.909610988995955
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:9sEYdlnpBdlUStGKNoWFeLQmWMm5J7+Yb/jPBnSBiw3S1y4:WEOnLUHWYLQmW3h+Ybln6i0w
                                                                                                                                                                                                                                      MD5:9CEB32AA139F796849389CA177FEE591
                                                                                                                                                                                                                                      SHA1:D1B4BA636370BF6F9E6AEEEE8F5C6B09587A02F1
                                                                                                                                                                                                                                      SHA-256:AD8D76CD622B72D7D8B089059E3B299966071FAAF2D2A9BCFCADEB7F70B3FFA5
                                                                                                                                                                                                                                      SHA-512:1FFBDE290B773AD380A831D13504EBEC4C3E6EB5037485151ABCD93A6787645F9BAD1938E6B16BD3AF513751EE495E9DC0ADCD87746B1413AF7E506EFC45274E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-excel-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L!.../c...M0l.6...^.....m........ .......@B.r...-..2!dB....C.o...`.I..F....hm...2`.H...g.~..._......H....92).U..[Q%.................F3.R.].h4.U....z.&<;a\/)..(~NH.w...q.Ra...CC.x!.....3Y.;O...?..1....v.o...}.P....?.]..1....BUdT.....V%...a.l.B.....l......ZZ.sZ.mV`.c.i..OOkii=.......@ *.m.%.m.}.5.Y...F..&..8D.e.6..].g..H.$I...~..........$G....OtMVWc.K@P..h..@.m.4........m.f..F..ld.H.m>.{...:.m[.....9.....P._......"...-..R...{....Hr$.Q...w[.dL..w..#.l....{..{...(....=.|.@..4.'....+...ted.jA.31... !........dY.u...").H.q... @B......jz.X7.MMJ.U.Ho..z..g..@)R.~.........K,.<..0...,....K......[...DQa.[_.c._...e..p.P...r.7.s`.!..#0...../??......$F.,.a_..<..m{..H..$.E..*....}|an.... .i..)...Y9....+.........~...i.)....5.p..@...E.......$.|F...u..C....._.....X.M.....z..<^.btf#.@...S.$....t>....E..t......;P...IW.........c5.....J..4B... ..I.b.J.c..;Ij.....E.r.V.$.z1...bq-Twc.......y.4GV.s....H..JIU....H.L.....*...tO.e..<......../...b.d)D..{I.)I.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1863

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1354
                                                                                                                                                                                                                                      Entropy (8bit):7.7841660939670865
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:NX5iYNWWxZF9PLjXjpj7UlCKk0R+8OHAgDcaFzM6QYahws6hAhnGwi4pMeNbSSTQ:NX5iYNlj1/YLk001Hhf19ahwSDMKbSS8
                                                                                                                                                                                                                                      MD5:912E32DBCDE71C5EAC26CBA154F20185
                                                                                                                                                                                                                                      SHA1:19880824E2CB5B5774B288C95A1CF9065898A7E6
                                                                                                                                                                                                                                      SHA-256:0A1126E739AE969F1FA9C22EDCC0856AEEC911929F7D3782CF9DA65797BD9AB1
                                                                                                                                                                                                                                      SHA-512:201CFAFAA3044321C98B991BF85E470978B20DA6BAB55CAF5A46313885C0E62B038CA8356149923159589A5F5AF2FEB56251EE2133DA3F35325A8C9877D6133F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/free-chess-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFB...WEBPVP8L5.../c....-l..I..?"s..m.m.m...m.m{2..y.*;"./j.8......./\.b.*.y...t.*....3......;....Ok-..r...._T3.7m....L0..KJI7>.......c.KIs}........`..^\..n')......K..b...0.\N...n...v.;.j.1C&..K..o.i...|..b....ys.R..iu.....L....].3.....6....3L.7......K..i... w.).Y........h...r......O.}-.?.M..']|.o-)...h.?..&.2...ZUN...X..O.D=%.`;.S!..jU..}N.Tp..7R.F//.)..[.^)..........S....n...}c5.;..s0L)..\..?..D.d_.Q))n.m.s...|.k.(v....0..{.Z.n."w.....C.*.}.w......*....".&.{k.U..>..k.'5.`..]....^)%M..}.s...u.&.t.....:.^ki.3.......Oe..;.X3..Lg..\.R.......TZ=...G.O..m.&D.{..\a.d.t.a.S...X.z..h...}.6.....)`.m...f...:J=..bc......;.5k.v..=j.Fw94.M.g..MKZ.k^....w......M.F{..1p.wHR..f..(,76..7T...yJ.c|....[J......KY...7....v.K.c./..g.z......,.q.-o.4.L/.4.1].r../....AI5..c....../2..q...TR.>.L..Y...?S.j....q..q.~.Z.L.oP.~.`.&.+jU...q.!...`.R.VO8..cc.......Q......*#./}.Z.M...^x.....f...K..p.c..g..........wQ.....B..`...\E|...b\.....k...O./..m....,S.F..<E.....O.....E....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1864

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):22954
                                                                                                                                                                                                                                      Entropy (8bit):7.9596514187675735
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:ah7kW2mHcgiGNb+d4iSmH5c/KkuegE+s368sI4kVelb3nNqJSJe+X4PD2CyXqeS+:eYGxeSAkumDe3N5JnobrBeS+
                                                                                                                                                                                                                                      MD5:C256FFF05249A7FE7E20C00A244C3E00
                                                                                                                                                                                                                                      SHA1:6AB2ACAFC2CE1CAA1DBDD3ADF7646C48F22783C6
                                                                                                                                                                                                                                      SHA-256:7F32538207D4A2AB397AD52889B4D6B69DCF16DCE8CF472C1350CEB5208505A2
                                                                                                                                                                                                                                      SHA-512:3E3141D3552D224E01B3E049200AB1F820F14F130EF5DEC3C4CF40C4DB5463DF7FE35B1641D7CF2E477DA77D6EC2030C92E3A8DBBB01EC0EF498F9AA0FF4233F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..Y5IDATx.U.w.m.Y...L+.....S.$.B.J...BH.lc,..n.......}...m....j0....I.T..T....\u.....J3...O.;..{.=.?{.1.s=..y..$.... ......Q...'[..8.f.q..........vrx...dH..P_..9......!.L...#.GoolN.`.....b20........D...g....*...p.L%..$.d.$gQ.).M...Y....h.&g...%.X.v..k.I..Z..+...|..4.N.G.5+..%J.sgd..TJ..p~.[..}....@..(.(.e..a0...G......j..^.q........7n\.}...~..R....j.........\.N...tgo.B..\m7.~.z"...n_..j.....#.. .u,.$..............k*5.+.....,j...7-.bmd.V.l.w.*.D...u.u..&.Ce.c\6,F...4...z:JE;..d...<.j.+j..2...mV.?.u...G.{..G....%..9.........#....?y......oMn..t.r/...Myl!=..o.|VN.sm...*...t....^..k.v.,..&.p/..t.....p.L..%..B.....9.,........r..u.&].>........hq...;..5.E5....*.0i.f...M....3............1t..I:.L......u.w..pf.V.d.h.w..._.......c. p.... .g..K............W..K=..S...N.>...lc.#.Q3.!k..fS.CC2! i.G5.=..pe.......\ne.5...W...........!q..=..r..%.h.d)J

                                                                                                                                                                                                                                      Chrome Cache Entry: 1865

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):214
                                                                                                                                                                                                                                      Entropy (8bit):7.002317147594002
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:+d1Zwl7KHaQ/HZUGSIX1a0ZS8h+hYIKkhpEIZywap0CF9Y:o1zf/HeGSIX1a0hIvhpEIcwap0C0
                                                                                                                                                                                                                                      MD5:EC40CCE5FCC4EF870B9B37C25A666CCC
                                                                                                                                                                                                                                      SHA1:E7F9E20DBF3B749018560B2C1B99A798F15F8732
                                                                                                                                                                                                                                      SHA-256:874A64C76AE3D1FB76C4E9C9B97A4E1D655FD13DC582EFB01C80E59222DD542D
                                                                                                                                                                                                                                      SHA-512:6213149E22B78FB216E2D5DB90334179367FAC9661F8CF1457F7EF6F5EA946230EB342DC3785171E5E7F10A4F5D085D6BD5A964C9D617F215B12E5A05C4E12CF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/images/burger-32.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../.....t!....m.H......b[....4.6.....D.t...Hb...\.'w......G.J........*.Q.P.+.ey.KsZ..........1..&<....=...GED$.,..j]y.5.......$..5.M].*.o......OBJ...........0h.w#`..f^H....=.G...".....g.|-.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1866

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                                                                      Entropy (8bit):5.190816455620734
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:TMVBd/i9mc4slzYbNDgtj9fhWR6L4mqZWzCF9xJLmgUhXqI:TMHd6+bNKjz8h9nWZ
                                                                                                                                                                                                                                      MD5:A2AFCE8C63269C7E8A5A3D5C90A88519
                                                                                                                                                                                                                                      SHA1:47CF7B541C27E4D4E3D5AFED9D55B288A923FD98
                                                                                                                                                                                                                                      SHA-256:38AFA88926F69F684E93AC9023338100A57B9424CEDF63F7EE73B1202C98EEAD
                                                                                                                                                                                                                                      SHA-512:3F55865B7FB3B6ED27827BACED720A9E578328A10095E7BDEC07A2BE70FD05ED9EEDD2F76B3EBBA8ADFEBD293CC459DB73D00CE03A0FDD88169BD83D8A34B85E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="490" height="490" class="svg_maglasss">.<path fill="none" stroke="#fff" stroke-width="36" stroke-linecap="round" d="m280,278a153,153 0 1,0-2,2l170,170m-91-117 110,110-26,26-110-110"/>.</svg>

                                                                                                                                                                                                                                      Chrome Cache Entry: 1867

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 30208, version 1.0
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):30208
                                                                                                                                                                                                                                      Entropy (8bit):7.991864737403972
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:768:jb+qKtl0nb59Z6T4gtrbF0TMJunOYslPBiR30fvVE+cJ3H0:vD20ONtFYsniRovrcFU
                                                                                                                                                                                                                                      MD5:21EBBD28E8542CF12700A838738E0D70
                                                                                                                                                                                                                                      SHA1:B387FB6E48C8F2822411EECCDDCFF007FE38F867
                                                                                                                                                                                                                                      SHA-256:0DCAC7CABD17A67B5D09D54D506C6ED734516248E9E8552D194B1A5CF16B7722
                                                                                                                                                                                                                                      SHA-512:4A68796FF7F0A58521503AB4FDD55842DC34E2E10027CA6A7FD0C40326F7D8F2BDC8F53448E1B9C109BEF123DDEDD79D86481588DC5777B73CFDA9AD4FE74CF8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://fonts.gstatic.com/s/dosis/v32/HhyaU5sn9vOmLzloC_U.woff2
                                                                                                                                                                                                                                      Preview:wOF2......v...........u...........................y......2?HVAR.*.`?STAT..'*.../j.....d.....z.0..T.6.$..p. ..z......t.5..)...@..>..bl..v7J,*.o.8f.l......?)A...F...`.T..1+-Y.Z..=,.V...6.j.A\.h.."...P..p.+.sS..9*_.Sp)...g.:.aN..W.X.......&....\;.R...K.....=.z..R..|..*.ph....%....y...[~.'...%....;V...[.B..St.}......V.0F..k2....&ed.j.B.B7D..?.....,.h..Ic..W?Q..............o.s.H.Kb..Ab..Z!V.$.....w.;.%TD$U.+.%W..*..N.[.V.B.#..$...Cjo...-...Z.B....#.:...K..<.>;u.:5....up..A.PS.?.._....jV.{M.D.j.....E.$.$.d..C\.Y5.!.N.3.v(7kR.JRV.5..V..>.gp...j..Y..`2$g.2.A+i.F;...9.#....%..I...%)E..Q$$..h.>..F.N..Q'.jt.L._.I..?.....K*...Xf_..D...;....8. .aw.....s..6.......>s2..`L....oo.(m#.*.a...O<.M:............) RQ.2....i aj+le}._.......!H...Cb.$!y..|Y:L..v.E'..{.*.0..p..B..yDe.Z;...N5...}.#..-..."y>.i..u$.."-5.]...#U.*b...X...W.I...H56..}f.....sR.{...%....R...U-....p#.....W....c.C.U..'...!-.J..(..Q......(.S..@i|.....)i.R|.4cL.9..Z..Q....m.+w?.]....<y.=....\..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1868

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6258
                                                                                                                                                                                                                                      Entropy (8bit):7.951351390985654
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:sOYiGBRkXVlICdOTQr+cXESY6SFnxwjKcD:swGBRkXsNW+djnxc
                                                                                                                                                                                                                                      MD5:6D9E498F7C0CB5A615B80B432C18B22F
                                                                                                                                                                                                                                      SHA1:F14757B8E9BB6578D8A2D330D1633BC28BFCE5AA
                                                                                                                                                                                                                                      SHA-256:A0F132F4B3B3C74AC0BF147DD797E40800F2FA5FB9AE1682F575FE8472AB6D6B
                                                                                                                                                                                                                                      SHA-512:F568C5428299AE83656AE6A2DCDC2FC2A719FD3C261CA0D97E1D000DC16C5B384A204FEB81CCCDC6A5E3395CEF832A7317FA947DADCFCF332BC71483FB52E59B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}Y.].y.Z..>w&/E..eQ.5Qi5.k;...#..R4H..H../.C..h.P.!(...A.7..'.........d..lK.@R.EJ.Dq...9g.....sxI.x9..=.8w:.......o..$l>...6!..k..M.6...k..M.6...k..M.6....Q.8\....._..<...W..+.:.@5..u.H".<^a.+.P*.S>0...c.....1...c...*8JW...$.8.J..[.|..'......RT..!%..o.{.c.O_3..C...=7/k...,......f.?...e.^.^mueMBe `.....~..-.x.....W.....v.....I.hl.............s......Y'...D.A..u.......wNL.....e..r.5.(.4.y.P...N...=..c.s[POZ.X].W..U.$.e.A#.-..>t../.9s....r...Rz....`. $)...G..?.|.......?K.{.$.I.M.....E..&...\...S....~...].j..\$..........%......<.x...T5......'.F*..R..f&l1...9...._.5..]...)...K....i,.D...'.O=v.....1?7...}..A.:[.....]...2..-=;.......z.}..-.!..G..R V]..Z."O.4|.K'...k95LU:6X9p.......*.. ..H...J..S./?|r....g...H.K....%..D^...~....vEHhz.#j._Y8|zm.....F...N..H..........GO-.....sjK.r!..^....J.u.]...C.._{.+.kK.2Z..]........Mo.......`eFR(0...$A8YU....3.<

                                                                                                                                                                                                                                      Chrome Cache Entry: 1869

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5771
                                                                                                                                                                                                                                      Entropy (8bit):7.93256311524083
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:US55Q75x3qvcbISFZJSQqdsTmK6/h5ayCPfWNPwVS0+Jexieir9rVWB6TWFR:T55QdxaUbHFPSQiS6zaZng4VF+0oeYPQ
                                                                                                                                                                                                                                      MD5:8BF53180422D9B4872843D52FC91DE7F
                                                                                                                                                                                                                                      SHA1:E691949B707EC7CE9ECC55AD3EA87AE6F21E0842
                                                                                                                                                                                                                                      SHA-256:0109137E783143FB84CC4044DBBF624FAED1CBDBCB853A266811C2F941FF2971
                                                                                                                                                                                                                                      SHA-512:860667ABD3C342E19A00476C12BDD5ACF5651C0D0E15792823F361197F47930781A2C4C92516D28BD13DB2035398442C478E17F44F5A7157C617FF05BC99F1A2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..]k.eWU.....{o?gz.3...$...AI.Q#..R....e....h..XZ..*-.._PZ......!.(..B.I.D.$..0$..c.{.5.....k-..so...3I.tbfN%......z|.[k.KX}..........9....97::....i_.D..D.Z%..eOD.PU.i.......k.j.......B..V.....&U..+....NMM.y.*C.73U..*.J....w.}..Kd......SZf..k.,..g..DP....G.y........D]Y.S.n..gO.8if"b...B0............kY.Y......vM.j...;$.?dkQ..4u......%...f7d........~..?..O.v..$.s.?ODI..I3.z.{?..x3.....PU...~"....`.k..9....y.....R.]..UFa=....s..i...w...W_}...ja.ja....w.3.b.JsC.."<.L."/.....!$...f..t..e...r]a......;P4CSY_X........J."..z..[..[Y..DB...zQ...t..w..J.Z.U..y..}...o..<.....!h.)......{..l.a.....~..7..j.x"~.......L....^hd.....[....|.A.....(b.7.[.sC...u...l.d...3..\y...\...o.o?.f....s.,`.....C!s3*]...^.zG._y.u..{....ymU0Dd4E.G.k:...6y8........3..........H03U-.blr......O..7.IT.3.+..<?5=....[X...#,..5p......h..../.\zu....A.(&.6.H..:aRv~yi.m?....?..N..I.g..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1870

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10956
                                                                                                                                                                                                                                      Entropy (8bit):7.941064928711183
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:q1U/7U9poksB8AAKK08NUURZTHFf/Si2aJYOo28dkeBxSYAN+m8Gdr:CkchabAViUflfqhoDnebSYAN+m80
                                                                                                                                                                                                                                      MD5:C8D6B06F2CDA496FA9C62BE62F72CF63
                                                                                                                                                                                                                                      SHA1:A5FF13E6AF1B0A9123763E4CD4CA699B21BE1A81
                                                                                                                                                                                                                                      SHA-256:AFCADCBB2411338BD9519DBE6D3CA9F2D39E8B418666420631C49883B1289545
                                                                                                                                                                                                                                      SHA-512:0238E2944A780A42662AF563F28020ADF79438BA2F3C3C7B078A179D850DC79E4A29BE7E56BBD567FE4C7F664926172CA2083807917B7AF6B04D27A0AA10AF7C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/solitaire-xl-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.*..WEBPVP8L.*../c...M0l.6......._o...O....s.C......h..G.o[qI+4....~[......jE.E..Y.a.,\E..:.....".6.....$....C...qg..b...$...F.._.#w/..w.z.......}.PN.H^.....${..C..I.].q.Nj.....8Ct..1.7F..)b..pV...,.%.zO.n.D...ST..].T.......5Q..2.D1d....D........0f.._5..f....(.r.......l3%..!B......8;&|.b.o......A.{..'w...{T...h..&..?.=...B..\.@8..8D....m.$.Y.`...@..M8..2.L...`.lM.7?7.0.D.......P.k.Vm[..R[.c.......I..5..40.L......7.9g...#w..F...m[.Y[.}...([.-.Vs.[.....!...h...$I.l.$...}^....1.....}m...c.l..gH.......YY.U.^..m.....^.\...sf...twM1#..;.l.v"I...d..U..3f......3fffJ.t..p03I...d[.m.".\J..u....X*0...`9H../f.o.N..s...].kI.d.y... .1.D.I.|&2.*g..+r%I..I.m.m.e....7.#.$&..`.._..ZI.-I.%I.m!.y.{..?s^'#.c....P2....MI,...&.......]....q+.O.O,;w.~.~...B.....uA.....q.8.h;.A.C....X...X.%......p#l.]...@.e.T.g.L....$....L....S@.Z...........A..~4.qk..w......bT.+.G.v.(..=.....ruLPK.cT.:,W..k......}.c^.yi.(-.....j....P...J.Px.......<.yyx......U..v.w....?&..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1871

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10090
                                                                                                                                                                                                                                      Entropy (8bit):7.943703508912908
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:7U05l/8QWTtbdmHJ2+KO/iiNwcJoZg8XGTBFGYUDIQ3Iwjx7Q2RM:Akl6ZdmHJ2y/inqBoGFF61W
                                                                                                                                                                                                                                      MD5:DEA7CB97C74B748DEE1815C0260F1D97
                                                                                                                                                                                                                                      SHA1:46B4781BF30E49164EA839D9346821D0FF934919
                                                                                                                                                                                                                                      SHA-256:E9058AE40977C9F7B297206ABB58213255813255993469917EF1B99AB304B706
                                                                                                                                                                                                                                      SHA-512:C7B5DE1D740DD8E5410F8C2F45577FD2B2D988CA9B6FAC00F6C8DD5FE15BF946C41D53D0D47DE3FD99759A7C730D17C3DCCC43756A2F8145243F34A495C05C65
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/autocad-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFb'..WEBPVP8LV'../c...M8l.F.`.......{ED...n....fw.G...F..........s...eKJ..M..N5.?...............n#I...$....JD.....p.H...V.....9.#a..4..G.$ER..e#....|..0..../k.......d#..D......`z$..`..m.#.K..`G.'!.......2e.k.bZZ=...?/ c0....u9............J..X.."..>O.....;.!..R...O>!.F#.H$?.+..G.<%3mAf.....&...y5z.$.......E..L..`8...v .......3.O."?...m.).....D...5.A..E.F..X.....h......#.H.].J..............35......*....Ir$I.5sL..N.{N.+. I.$I......_.w..E..$.$.......{...S.(./p.m Q....%.m#H.....pn....mU.m...>..LL.9.Z......y...1.. 33.bf...0Ir.$3.l..jh.o.$I.j.m..R....63................<..s.5f..[..}K.dI.d[D,f....S}XgFD&.|V.~f....*..........p.#..T`UL`...p......#Fx........ ..DKd.v.7.V.....#.R...J...............9|6.l....&p........xPb...!....#M..F.A.].....Z%..b.G.a &5.pz0...M.....`.d.........At....~....A..-^....0....t.I....@ak.9y.aIX.(Vc.N...7.F...A.O}mh.......k.8..8...20..|.JFt.FJ.,...S................4m....... .../WFT.@o."..}..v.C..).P....E..... A......4..+..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1872

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9856
                                                                                                                                                                                                                                      Entropy (8bit):7.971005583601277
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lc/DTPqu+Fi9CGCOwGJPHPcVHEp+O9kzMY4CDBSzXdHdZZxHr6LmiSbqQv4:m/DTy/oQhOrPMEZkUCIXdLwmlbS
                                                                                                                                                                                                                                      MD5:80A96794C890CCC1A6972ADC135D5D5F
                                                                                                                                                                                                                                      SHA1:B9F90A8D4DB2D78A68E427757AE5EC133A570BB7
                                                                                                                                                                                                                                      SHA-256:C21784E366BFB57550199A3996600F6331E29B5E0C297F63AC0D17BA1CA66EB5
                                                                                                                                                                                                                                      SHA-512:F486C90195D55B2D945BCF907CE4EA08A2D85439E97DCA541F45190D7F0DFCA0099F21A3D7B90533708126205DE29C23397A5661B569FBF4D23A5F602B973CDB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..&.IDATx...TS.....z;.{...>..vp....u_o...Z.:bU..l+......)!.d`v.E.Pd.!.$@.0C !...@HB..:g'...ZE.}....p...9.|....A..|..h.G.....}.w...O.....H$...B.phh.`0. .]...?)@......_..........}...w..Pkt:.....].PR&.I.P..........pFFF.z...HSS...aaa..q...Z..'...d.....H...J..\DA.s.^...m..sl.k....x=?....&.)##.@...s.V.......Z........B..d2.e^.|A..P......H..L.P.........Z..V..W....LMI.2..K..K..3.>.$RnnnQQa.@0n...SaYdA..$'%...L&..=....F}}ttd...7.|.}......e..,,q.(:*..d=Z....`F.p....W..VB..8j.9......2...6......-...~p}@&sqv..}..|.._{.".=kR ..._.H?..\Q^....u..r.n.h4@I.F.N......R.....d....w.9,..t.....!::*9).........@....iT....S...n........~...Oml,1!!2.7.\.....................UJ.L*..%..d..`T..h4..A..U....{%...D.P........Q.O....]rrRPP...Mg..R.....f??...hxh.W"...H...^..W.+...e.2.T.'..I.. P.....S...7k...S...].........w.,.Ji...o..I.==...U.E...{.@..;q.X.P.i.E.>......IQ..#h1......}..7.uu.e|V..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1873

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6836
                                                                                                                                                                                                                                      Entropy (8bit):7.885042984594257
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:oBsD7mlXgtjVIYMQ0qoOkbUEBLEKotffqGUqI9xp:oBpXgtBInbUqEHVUpZ
                                                                                                                                                                                                                                      MD5:6F85B12C9702EA61129CE46707C13996
                                                                                                                                                                                                                                      SHA1:4E6DF0BA43CAB98060C0520A46DE7FB0EC3E8937
                                                                                                                                                                                                                                      SHA-256:63A9A92F2754D7CD462E7F965D42C0DC0466E4E95BA80F7884D97C7738163AAF
                                                                                                                                                                                                                                      SHA-512:465C02D1866461D5BC0655E0BE65B7EBB7D209AA46471A8610BEC14E0598CBBC12F8CC939BF449F266BD452E14152A2F9E66552F7ED2EA683F00365BEF5A99A9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/desmume-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M8l.F.`.'...d....O.D.......P..v..Z.).?...Ca..2..t.G...&dw.#.nYY..$[.......sw....H.U....~p. .hX.F.F.._..+a.K.'...q..!`+.o.F......qaC,`...C....%S.^s..7dJ..xDB.AMMXK.G...s.|.?\|.....7.../.dv..G..o.....5}3.....(d h.6I...v.BDL.(...,.t.5..7_D..........@N.............'..@\.Uv..UZ..d.-.?.?.. "&..m..m.>...Z..}..m[..Z.m.u.m.;.5G...o...m..J....,1.$E.<......q:c.0.m..-.1..E..^.....SVJ9+....m.~.6..6#V|...?.$I.$I.............y..y.e.)..$.d.D.<".....;..?.o..`...w.......T.y._cD&.R...../L+Z0b.X....;s.......6.....$#.......e.w.....o.4..M......_Xt..@.1...8.U.2.3...)+)..&.T......`.........S......Y...dy...0.c.1...&j.@.9.X.........!..w..A...F..Z...'.."*.`..+3.:L.)...`H...3.|..2...._....u.A#G.`D..H@b01.YB......)`p...{.PH.G...... ...Y..R....A.."!.0.1A.f.F.?..V..#..`D..~.i.@b..D...>a2..........._.....Ha.Y..0....a6..t....7.......X..+.. . .o....`&......8....W.uaX...9]?O. .........#VC..(..1...rb..L..<i....7W.........\.%t....$..r..M..6.....2"F.t.N

                                                                                                                                                                                                                                      Chrome Cache Entry: 1874

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2912
                                                                                                                                                                                                                                      Entropy (8bit):7.8970847607749945
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:tV2eNyDuFy9voPAvgHWN4+pAeq7MN4E23gk2/AGdIzcC6zYFqVyfPgCzx0OvYghH:nvFFuvhvg2NjpqREYi/pIzqMfPgCN0OB
                                                                                                                                                                                                                                      MD5:39572B3391275189DA0A70DCF9D43065
                                                                                                                                                                                                                                      SHA1:62540E1656C5D8DEAB20207239669D265EF85BC6
                                                                                                                                                                                                                                      SHA-256:A6B869DE7BC398D17C09F2BE6E4F797ECEFDC8166216C6BB4F4E69BCA07AA1EB
                                                                                                                                                                                                                                      SHA-512:E149DD07C6DBFD10B6883E9C19AD3779D5911F3E338771A7ED6B0059A62FE28D6B1B96540AFC7CC1ED7765EE50BE10FDB8727626FC25DAF18087D1F26D9CC7C8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/microsoft-word-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFX...WEBPVP8LL.../c...M(n.6.....Izl.....o.46......$'A.D...n^g....$9R...+..z.T...=`.IV...Q...Wg..W\.m#I......cf._.....t..28^4`..m.....1.... ..b*.l.e..L..L....v....j..I...*...d._.ag..t.........nx.wy.s.m[.$i...{x$.33..J..!p...-.."...........wOSd...b..k.V.m..>.9.K.l...b..plvi..+fs....}....j.my.Z[......tYR3.^K..0.b.f:D.....K.On.....%.P..@.Y2.c.H.hu...s...o.=*V.(o.a....KN...F{...W~.?.7../.5..|s...N..\..X...._..g._k.....?u.W.<..?."Vo..k.q...yV........Z...c.....57q%...........g2.+,._C.}..........c.@kJ.......v....s..a]......c..v].YX..)].9.b.L.....a...0.`.........a.1.5K.J2.....=..{{.,....t4....)=.O1X."}..1.F.....<.84On...3...eU1`%..>../.;..6`|4.....IU..!.@H...]/{.FR%.....>~...i...).qI......Q..*2.2.k....l.......I...Ik..5n.4...H.,)...W.SC.....R.....59.........Ut.9........WCQ..hY.....%.*.......$..@.p..?..8.y+[..$........bh.....%.*..A......e...~.....XJ...*.T.".Ix...pI....U\L.T&.&....'.../..s../L7........4.;7m.'o[...F.c.B........O....}.z............m7

                                                                                                                                                                                                                                      Chrome Cache Entry: 1875

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (21224)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):24203
                                                                                                                                                                                                                                      Entropy (8bit):5.349731623672621
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:PLX1wtH+NTv0vDckjUhzU0ZppJeiUGg2TD7eC43YU/Us3ZYNbHG3W5AJdME9oPaV:jKtPQOaG3WFaoPaIK/zn
                                                                                                                                                                                                                                      MD5:F1DFC75C82E12DFE846D5593978E422A
                                                                                                                                                                                                                                      SHA1:12E580A708B09C9A8F4CA7CCBE9DD7DF32EDEE60
                                                                                                                                                                                                                                      SHA-256:08204982C484FAF6890C60557A4E642971F17625DDDDC0559DC0E3CA728AC9E0
                                                                                                                                                                                                                                      SHA-512:623412E6D454104251215E38A0F365F879EC70F77306769F5FA40E144C0EAB43237D1FE13B92031AD5848071A6A8910F01576F079E1A0904F4D8DD8959D922A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
                                                                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},ea=function(a){return a.raw=a},fa="function"==typeof Object.assign?Object.assign:function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(d)for(var e in d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};da("Object.assign",f

                                                                                                                                                                                                                                      Chrome Cache Entry: 1876

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17475
                                                                                                                                                                                                                                      Entropy (8bit):7.956983632916116
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:P8z96Qpl6b3nx3X6wdfho5funWGk77hQeggoQ:6plgh3dpnWfJQegJQ
                                                                                                                                                                                                                                      MD5:92BD2D4ABF64AB6B2D5411F931903076
                                                                                                                                                                                                                                      SHA1:ECD4879BE9E8948C2CD02F903346D90550993049
                                                                                                                                                                                                                                      SHA-256:25E50ED2B59A3DEEC6637B34023DC4D3C12A0AF6CA117C17B73B202723E9398A
                                                                                                                                                                                                                                      SHA-512:B9615F3A397C865B552F1D1D2D1CDDB925F2FC1B1E8B10C8DEF508ABB4B7041C267C954EAB9F2ED98954C60C5EEA9FCF1DAAFF0C9783957678C2889C61687E7A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..C.IDATx..w.mir.VU_8......7ofv.3.(..L"@..E."i.lJ...0l.. [..2..@Y.DH.. .b..%..&..s....NNo....7.s.P.?..7o..$P:h.}..~...._..WuPD.?.C..@.'....(... .H xv..... .D....J@#.D....:........<.:..B...f@FMT...(.hB. ..".O.$.>..D.;v%.....}..D..Q.Y.R.Yh..5.9f..........C..J" )..U..k.1Fk.....X..............P.R!....&.T1V.-.;6.\....@...Q..z..'F.. _....K....6EY.eY........"......w.i......."......-..Y.b7.R...Qhj..C.! ..x.A|J0........s.2.y..4.XD)2F'..'`,.r.I........."..Z ....U.s.s8y.O.-x..d~x.."%........|.$IY...t.1N=5S..g....d.x..&I.WF.)......D......z&..g/..zr....Q.z.b....v.Er.dy3s...d:.M._@y<..g=&...D....L....u.$.k.....<.qe-.u....Q]...4O.c3....ke&..;.Q@Z....9.(.w.z...=.cw..7....<.O...M......-|..K....K....|..,Il..UD5R.........=.{.\.<{e.....cq!..E.Lj,..@......P.D.!..!..B.^1.B!%.,...u.7..*X..[`u..5.=.w...uM...X...3..k..E..S.Y.:.7.."."..*I.=.1..*.i).......Go.....z.?.H.Ii........^...*.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1877

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10260
                                                                                                                                                                                                                                      Entropy (8bit):7.955513310145621
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:fhu8o7wzJjA9wzx2U6QItXSwdzbhFTAkUUaVkSMRVAHpQyQIhgkV:5ur7wzJ7x1zI1dhFTAj7iSMRVAHJV
                                                                                                                                                                                                                                      MD5:D10C98D1F2F31D5C7557FA4C9DDDB9B3
                                                                                                                                                                                                                                      SHA1:8A8C8C96B854C3D5BEA8BA3589A403A6D6476653
                                                                                                                                                                                                                                      SHA-256:1AC6DE64D219F5542D6452BF6C6CF5CD826DE5953052C5CB3BE506347762A828
                                                                                                                                                                                                                                      SHA-512:57888041438F986368F550E9397EB847391594863EEC45A28A21F9A90B3B41169E2370F8FE2BE0C6C4A6B8F12CB81E906ED172944B0E283A37223D2CCD6D2BA1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..'.IDATx..}y.]Uu.Zk.s...o.7s .L .I...V@D.2U...U..h....._.jm..~.. E..u(..h.d.0$..$!...$.x.s..k}..s.=....I.?}..s....9{....~..."..x... .?...y....."......">.7..lVv..>........}.)D..6........KX..|.5"....`..;.t"V..-...pS..y^....p5..K..hx..U=.yf!..Wga.o>.U..6 "..#..7n....F.t..0..|.7..=<{x......`.E0..s...v".Hs.'.4/%....%.u.K...6......M....r..{7.q.#....T.)E...!b'.@.)".ED...kmow..K...3O9i...s..UR...jm.~f.^.(.9..F.u:!....V.=M...... .D.5F.A..o..V[....L\).ZF.R..UP...c......;..j...LD..K.M....P."... Q:uf.;w...../^...(/.Q....{........;v..U..6T6.(B.t....c...^$...a.F+R....RN.J.#..GN.......f.G..6B[m..X...h=/O.:..lJ.1.7)...4".."jM.H..Z...9.h.v..y.W.;....R.t.V*)D80:v..<...sd...|.N........TZ9Q!...F#dA.""E...!....!`.4....Q.X..,3..O.`-#..+.3Q/..`>.*...c.UJ.."9eGD..(....* ...7"U....k9.....[.x.......Ys."............((xX*............BN. .+.zJ!..rn}.1")....)DL....".....B..6U...ffk .;.X[.j

                                                                                                                                                                                                                                      Chrome Cache Entry: 1878

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):210580
                                                                                                                                                                                                                                      Entropy (8bit):5.470536325169631
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Wq27nItFVerLt1hgpeKo4joS2k4OawyiVrMg6i/i:WFDUALt1ipeKo4UiJs
                                                                                                                                                                                                                                      MD5:86A37C359B238F8C198EF0452886AFD3
                                                                                                                                                                                                                                      SHA1:C0DF761A37144B866DC8E6F4736248832B5377D6
                                                                                                                                                                                                                                      SHA-256:63492DCF8FA2FB817340D17D053ADEF3FAD08E3E6A851749221C62DD632C6AAE
                                                                                                                                                                                                                                      SHA-512:C55D0B7029F76A4B5F9811AA4753DBDAC43756B52C637A2C28B18A026D679A405B64C763838629C3A2A13362A49E8DDD952588F94F211D9585614F9E80CD6B70
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:(()=>{"use strict";var e,t={2131:e=>{function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}e.exports=function(){for(var e,n,r="__tcfapiLocator",o=[],i=window,s=i;s;){try{if(s.frames[r]){e=s;break}}catch(e){}if(s===i.top)break;s=i.parent}e||(function e(){var t=i.document,n=!!i.frames[r];if(!n)if(t.body){var o=t.createElement("iframe");o.style.cssText="display:none",o.name=r,t.body.appendChild(o)}else setTimeout(e,5);return!n}(),i.__tcfapi=function(){for(var e=arguments.length,t=new Array(e),r=0;r<e;r++)t[r]=arguments[r];if(!t.length)return o;"setGdprApplies"===t[0]?t.length>3&&2===parseInt(t[1],10)&&"boolean"==typeof t[3]&&(n=t[3],"function"==typeof t[2]&&t[2]("set",!0)):"ping"===t[0]?"function"==typeof t[2]&&t[2]({gdprApplies:n,cmpLoaded:!1,cmpStatus:"stub"}):o.push(t)},i.addEventListener("message",(function(e){va

                                                                                                                                                                                                                                      Chrome Cache Entry: 1879

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7332
                                                                                                                                                                                                                                      Entropy (8bit):7.95947106477555
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CpMeqHSF6T/k2NAnKJYtodhYAVdcwu45QXBqakvyDaA+MWrZlBd1l:C136T8iJYOBXCBPkvmaAlklBt
                                                                                                                                                                                                                                      MD5:3E383476AB5A358C8104076D28A9FBF8
                                                                                                                                                                                                                                      SHA1:1DF4DFA63202761A798DCA0E6DB82A852900D143
                                                                                                                                                                                                                                      SHA-256:BAF34051FC717F4E381AE7B405593D0226AB7B3DBF1ABC4E7AB5DCB9B712CCA8
                                                                                                                                                                                                                                      SHA-512:8BCDBADBFEA2FBFEA4D2A14AC211AB36B67FF96136B0DBF9C5A0484B86DAB9AD176976F1614470BE9FD497B6B4F2808D5B71E3C85399C4F84722B46AA74BABB5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/geforce-now-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.....m.F.b.Mn..........g.m$...X.n{-A.9.."..........tJrUD.=.T.3.$...ms.d{_t....t.....Mk.O..........\.UU.w..Sa........s.'+..n"I.d]).t.I.r.p.....O........up]q........p.o%)...;.....0K.~q....y......@...Q..6....j.=..$...!..=nj/..Q(.$.F..=_..A.Br.........Y6.P(6r.h#i.Pb2...NA..F. .....`8.:.`.....u..3..n6.....vn.....X.}.=]....in.:<.O.U....$......".......@w...H2...03_.\33.2.=3..Q.....(K..`.Lw..^H3.3..../.KJ.[g.U.2a.K...=..0MyK.tJ.U.d..z.].s.:..W.\)-.b/..&.Z..5.'...SekkgA~.*.m..m.VJ...........m.. .`.vh.V`....[..%IRl.-s...z..-ff......L..G.*.c..._.R....(ZUB...."v}......?.'...>.4..c...a...-.......}"p.N......_.x.9.......J1.J.i..T;m'YQ..;?.>.i......l}....5.7.R...P.fU...U....>\.....o>...#....R.aiw..6......a...[_....{./~i\_..AMW......V.....V$MI!...C..Jh..C.q.;. `kHtHK......?....3m9..$B.....MT...S.1.)1e..=UIM.R..v..4dn.I....`...$.`zi...6V}{..L&i....N.<..Cr`Lw...K.....F.8T.eQ..A...k-..D.......@J.P..VM-..:Y..y.;7`.Z..iS....:.n.V....._.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1880

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (797)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1994
                                                                                                                                                                                                                                      Entropy (8bit):5.073029267772446
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:3JJfYau7pDTCj/MIpk050KiUMjfrVcxBUMcppi:wauIrMIpky0KK5ckpi
                                                                                                                                                                                                                                      MD5:44A9D35AC0063306CC6841A612D95D31
                                                                                                                                                                                                                                      SHA1:4FFB41D60BC4BA6A526A40A1CB21268B6AD41CF9
                                                                                                                                                                                                                                      SHA-256:835188B45FE5BAC6F41EA7DC15D48148FC99E81F9276ED0E90F3FA5E79900256
                                                                                                                                                                                                                                      SHA-512:5DDFEDB11BCF5C38399CB6314EFF516D341F03157D3E7F4ABFC269523A2532897570B9BFCC205076E3000E3B607B5FFEF9C3B0E326AC5DD02B43932D1EB9F97C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/js/flickity-bg-lazyload.js
                                                                                                                                                                                                                                      Preview:(function(window,factory){if(typeof define=='function'&&define.amd){define(['flickity/js/index','fizzy-ui-utils/utils'],factory);}else if(typeof module=='object'&&module.exports){module.exports=factory(require('flickity'),require('fizzy-ui-utils'));}else{factory(window.Flickity,window.fizzyUIUtils);}}(window,function factory(Flickity,utils){'use strict';Flickity.createMethods.push('_createBgLazyLoad');var proto=Flickity.prototype;proto._createBgLazyLoad=function(){this.on('select',this.bgLazyLoad);};proto.bgLazyLoad=function(){var lazyLoad=this.options.bgLazyLoad;if(!lazyLoad){return;}.var adjCount=typeof lazyLoad=='number'?lazyLoad:0;var cellElems=this.getAdjacentCellElements(adjCount);for(var i=0;i<cellElems.length;i++){var cellElem=cellElems[i];this.bgLazyLoadElem(cellElem);var children=cellElem.querySelectorAll('[data-flickity-bg-lazyload]');for(var j=0;j<children.length;j++){this.bgLazyLoadElem(children[j]);}}};proto.bgLazyLoadElem=function(elem){var attr=elem.getAttribute('data-f

                                                                                                                                                                                                                                      Chrome Cache Entry: 1881

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4212
                                                                                                                                                                                                                                      Entropy (8bit):7.90150367246126
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:8wkeCG34kGy5q+mzFmI6zs3kOUL+ZrnTS4tAZIKtm2Wd8QQ:8iCGNY+YFx6zUZ5rnTZJfHqQQ
                                                                                                                                                                                                                                      MD5:63D8412E439E1F6C1F283D2777CC5683
                                                                                                                                                                                                                                      SHA1:20D57015DF4C8FA24001841C30D8C76A1147975C
                                                                                                                                                                                                                                      SHA-256:868A8EA19CAB033F970673DF4858EA93EC55490DD47E0F5C00632AB069DE9915
                                                                                                                                                                                                                                      SHA-512:263871D2FEDDE54A4C4810B1F659C2B12E1E6292E36361705633B8B2895213FADB1B909EAF82590754192382429C0FCD6395539D1226F359AE3A0081C44FD748
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-outlook-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFl...WEBPVP8L_.../c...M0h$IQz..z.`~.........P.T...&........r.r.<..OP.......Y..$I.R<.-.........$9R.>....o.._N<..ml....?D....9T.n....O.~V|.?./,....[.R,.^.c+e~..p^$.sT.m.E......G...G\....P...K.].....;..X..Y.:....,i."=..@..y?J......S.....8.S.%.).@....;CA.6.....e....s..Y.l+.......v.`...I.\.mK='Zx.i.v.k.KV..*...sp..N..[o-.&7A7.m.V4.AYdC....4....W...$......7..o..{.tL.g..F.m..%G...33.5<..`.#`f.R...).!"di.Y...|W...Uk.$.....?.....L.S.L.S.j....Tbff|...%I..I..GV.8..x......7...VUzL@..]f 0..W(nTX=..R...a.+.P@1.\.4.V.e}.@(.EO#[.R.....~........q`Y..HO^..W.wIi...+.?~.}./...c.Q..Pn...z|...Q`..0..>|?..{.... 0..o...j!b..4..'^.,.j.M4......z.h!...8D.@,...4=.scqjP....j5..s.....@.....y[..`.@b@c..,......*......9.r.#./\....a[.. .R..Z.$.d.0.... .c.v..~..u..!&..$xg_g>n...s#.....3...l.da9Hj..G.."...20....C.p..'.....0.SN.....-..U.P.@q..F.. .=.. 2..P.;..U}.....1.-pp..Wy....Z....".].NQ.O.jK~dE!..x.dL..e..b8.....D..g..o.:.5...bR.<.......}..WHU..,......@....|........>t>

                                                                                                                                                                                                                                      Chrome Cache Entry: 1882

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65439)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):145942
                                                                                                                                                                                                                                      Entropy (8bit):5.2437271650195285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:X/HLIam+nnwlK7gweViagwQKnvc3crPJV9oYmdh468vZEc8YdX9JI+:PDnwlK7gP4XDO0+
                                                                                                                                                                                                                                      MD5:8A9AD568D94062C0186983F6AAC0BE50
                                                                                                                                                                                                                                      SHA1:6ADA7BE1D7E465AED305AD492804066E555E855E
                                                                                                                                                                                                                                      SHA-256:0FAB57543F51269755C854C09E1A361E6A3C04AE97B28B483AE00F13DE630E9D
                                                                                                                                                                                                                                      SHA-512:7C98625906E2AA72E3F84FDBD6A3352AA10467A454042BD06FEE71244473D47FCC81DC5012E0FC3E1766B3C273A3F89DB54E59D288D67ABEE7C930AF3A507C1F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.id5-sync.com/api/1.0/esp.js
                                                                                                                                                                                                                                      Preview:/**. * @id5io/id5-api.js. * @version v1.0.47. * @link https://id5.io/. * @license Apache-2.0. */.!function(n){var r={};function i(e){if(r[e])return r[e].exports;var t=r[e]={i:e,l:!1,exports:{}};return n[e].call(t.exports,t,t.exports,i),t.l=!0,t.exports}i.m=n,i.c=r,i.d=function(e,t,n){i.o(e,t)||Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:n})},i.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(t,"a",t),t},i.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},i.p="",i(i.s=18)}([function(e,t,n){"use strict";function i(e){return(i="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function o(e,t){return(o=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(e,t){return e.__proto__=t,e})(e,t)}function a(n){var r=function(){if("undefined"==typeof Reflect||

                                                                                                                                                                                                                                      Chrome Cache Entry: 1883

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):166676
                                                                                                                                                                                                                                      Entropy (8bit):5.754995638503267
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:tUymJXri6fBBxw48e4GMyOIXCJuHugfqtsh7ozja5Harug:t1Wb5x3OIdugi2hUw5g
                                                                                                                                                                                                                                      MD5:8CC1AB5F3A614A0C6442B814A6FA811A
                                                                                                                                                                                                                                      SHA1:F91D1D56B17C91C4B1A351ED71283F23216699AC
                                                                                                                                                                                                                                      SHA-256:1A4A3F4106C7749EB2546B4924E20BAE5358F953D0071175F13665F450B10C24
                                                                                                                                                                                                                                      SHA-512:85933B418EE5B1D62DADDCB7679137BFF1DADB40348C0A2D6CD93A9249D2C0E1ACA75A55B5B1C9EFAF23BDFF19078250A432F75DB9B6BD5F2804A7CF986922CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Sticky":["html",0,0,null,1,100,970,0,1,null,null,1,1,[["ID=7f2588f2ca30a273:T=1698410158:RT=1698410158:S=ALNI_Mav2ZgowQyXeCbdcWqPdPaNhV1-DA",1732106158,"/","download.it",1],["UID=00000d9cf0c53181:T=1698410158:RT=1698410158:S=ALNI_MZMsYA3zpWJLzb92xNEGYFT4c2xUg",1732106158,"/","download.it",2]],[138327307067],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CMvpyPGeloIDFY_rswodqOEAbg",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"2",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20

                                                                                                                                                                                                                                      Chrome Cache Entry: 1884

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit grayscale, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1611
                                                                                                                                                                                                                                      Entropy (8bit):7.792925521411799
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:4cEiKswjEQZujhdet0ylUuhCt1xwsImCkBpe3LDRzGv8H14PW0b+hhtxxj3xX:pKIytJUCEAOBp+DRzGv82P1wJ
                                                                                                                                                                                                                                      MD5:E79FFE4C0D858391513D3544D8A82643
                                                                                                                                                                                                                                      SHA1:47C773F9C0CF973ACCD76DD9D92298E91AF35DCF
                                                                                                                                                                                                                                      SHA-256:A11C04679D136CCB1811A4D6A777C7050551A2C0DF40727D934C00DA344C7460
                                                                                                                                                                                                                                      SHA-512:65B4B57E42F29D8E1C35CFAA696BDF92EB026B165E3537271CDCEE66DF8B70753873D2E48C41B89D3C8161F593AE83AE607C935B6ECEF46256A9ECD136D4E794
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....U......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..k.UU.....sF.i..Qs.I..C.T$..%4.@.T.4.........(.....^#F..D..a&.:.!8.S...M:.=g........s....8..._k....`:.^]y..")>....?.4C.-.O`...P2x......d..eTa.4}....zXK..R.P.ADD.Up..<L#.).."".r...X)...I....W./...~P....7.t..1...Zx)....<g..kV...%J(.y.4.Z..:......|..I. !.<...^.#..C..&...G\....\..I..r....%A.Y.e......QpQf>0s?.)H.-..a...u..a...;......a.U...A.3.^........Fq..c.#.....Q.......Y =....O..A..Z.D.....\.9...a.ok.0...-....s(...i...........-v.L....T3...0e1R..Z_...2...vF../A.Gw..9.]....l......z.....<>MQ..Y<#:^..j.}).p1..x...<8-......f.....k!4..)5/4cL.._+!b..x..-..pT=F@B..?...jv2.d.H.WQ.L.aC.((..D..,..R..%Q9..I...../E(...D......aR........usn.U..c....?<.H..d.8.5.C.>TV......iM...M....vq.v.!.n.5..s....Z=.;...b....n-..y)XW.O...m. K.\.mQA.F...l9..`n.t3(..;n....'..Pxq..o.....z..H..cRx..q)\....._|j....0.w5.4.0.C..P...%_...8,&.=..k!....j.^....qq..c...*..(.]..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1885

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10184
                                                                                                                                                                                                                                      Entropy (8bit):7.942560436543751
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:BxydCXaLQgOk6f0/SHVTrIL8/x9jo+ca1qBjlrZ6rz1xToEgGgLY9:+CX8VG1AyxBcaaIz1xTSGgLM
                                                                                                                                                                                                                                      MD5:3A4955129596668BE425392BD478E365
                                                                                                                                                                                                                                      SHA1:105C91AC235C3704ED7A8AE70E8A5192BA30A546
                                                                                                                                                                                                                                      SHA-256:454255259A3AE066F60AAB86303666D7E8514DE1BD4B5D388E4AEBE41DD84FDE
                                                                                                                                                                                                                                      SHA-512:69E0828AD9F91BC20C91292870349A9E1DB32E1148DA450704D21BF14B4AC48B4A3E796743CFD30B1489ADA8814CFBEE6EF0A7FF112F25CB23F2DC177D68EF22
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/aptoide-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.'..WEBPVP8L.'../c.........x.d,...az..........m...;........u'.....}._5.~uE{.H.....'..f._..1....U5...'..;....(.$.....+.w...|G...IR.8n......Eh.Zp........Zx./.CKu....x5......`.<t...D.$`...@.0.C.},...W..{-4.G.....Q...Zdi..y........luD...............I..J.>...F)%PK.Dn].w..BJ].z_X.%F..4b?.7.V7..32?V..6......'.....Uku.D}..0.C....aku.g....v.....tY.dm.K.....`.H../{..........2\.JK.T..Q..D..W.....H.\.mK-.....J.z.8|.:.g...........p.[.$K.$.BR....c?...?k^....S.$.l.........!.?.. .Q$.........dm.o.q..YV.=p....W..=k.Vc.+....O...$.d.D.#"..G.5&........e.pS.$..m..Gf)..^G.......+3..3C..j..dxL..'|u4..`.)...\.3)T4q..a*..N3E...I...1[R.....<>~.B.)...v..r.1....A......6F..x.VZ....(L.Q..~.. ..... .@q.i.j.Y!....H. M..W!.P....6,.[.,..e........{.........Y.X.@.f.^6@?KD..@.K4..-E..hX*d[K....YC..FkR....!..G.r....J.+.(2....8.@.@.... .,P."...#.2.l..p.de$.<9..l...%.k.M..wl..C9......ldTN.=.2.x.Nw.=..u\5..y...v....u.&C...:......n%J.B.".....#.......a.gP....._...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1886

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (7862)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7889
                                                                                                                                                                                                                                      Entropy (8bit):5.3539189175758715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:EIJHXkovHIdcC9vaE6cyxqI1qwLcIRAKEFkNB+xb+25CqqBFPvAxOn:E2kNdcC9J6co91qwLcI6KgkixbdjqBFH
                                                                                                                                                                                                                                      MD5:FD4F902B789F81BAA379B0BA42C21ACD
                                                                                                                                                                                                                                      SHA1:9F5C7F1B6E8151ED8D54C24A297B27177B38EFB0
                                                                                                                                                                                                                                      SHA-256:6E61BE2F374A0122510025578940BAF7EF8DBBCAF3ECC5F5535CFC81BD1CFD39
                                                                                                                                                                                                                                      SHA-512:6D88550E1BDDD52E4BEF156BD800C97147AE7BA30AA0EB0D0B31815250A119D8C5D165A777B7AA195BB70DF2F2DCC159204F6A3E47EF71D24D7861EF58171CF8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/js/lazysizes.min.js
                                                                                                                                                                                                                                      Preview:/*! lazysizes - v5.3.1 */..!function(e){var t=function(u,D,f){"use strict";var k,H;if(function(){var e;var t={lazyClass:"lazyload",loadedClass:"lazyloaded",loadingClass:"lazyloading",preloadClass:"lazypreload",errorClass:"lazyerror",autosizesClass:"lazyautosizes",fastLoadedClass:"ls-is-cached",iframeLoadMode:0,srcAttr:"data-src",srcsetAttr:"data-srcset",sizesAttr:"data-sizes",minSize:40,customMedia:{},init:true,expFactor:1.5,hFac:.8,loadMode:2,loadHidden:true,ricTimeout:0,throttleDelay:125};H=u.lazySizesConfig||u.lazysizesConfig||{};for(e in t){if(!(e in H)){H[e]=t[e]}}}(),!D||!D.getElementsByClassName){return{init:function(){},cfg:H,noSupport:true}}var O=D.documentElement,i=u.HTMLPictureElement,P="addEventListener",$="getAttribute",q=u[P].bind(u),I=u.setTimeout,U=u.requestAnimationFrame||I,o=u.requestIdleCallback,j=/^picture$/i,r=["load","error","lazyincluded","_lazyloaded"],a={},G=Array.prototype.forEach,J=function(e,t){if(!a[t]){a[t]=new RegExp("(\\s|^)"+t+"(\\s|$)")}return a[t].tes

                                                                                                                                                                                                                                      Chrome Cache Entry: 1887

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (35464)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):92271
                                                                                                                                                                                                                                      Entropy (8bit):5.559532105118669
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:JDM7pe9RXdwJiUgCah2xjEwk/1BYag5sN320CpF6nq:Wpe9KgnhNb/PY7f6q
                                                                                                                                                                                                                                      MD5:E056CC81B8D1539CFE6499E7F16FAD60
                                                                                                                                                                                                                                      SHA1:ABCBCB9FCC2C17A5A27AE7C51DFA825BAA6E042D
                                                                                                                                                                                                                                      SHA-256:6544D13DF64551FDECCABE9089DA03BC88E67DB08FB6C811C1BE57D4E6B28F2D
                                                                                                                                                                                                                                      SHA-512:E841AB341BDA1009078EC6ABB101A2457050739D8A9BB00C15B1B340F4FAAA0F3C71A1F5AD2659FD7B6D93140CADE88C9342779DF70AED4A4F8D12CA8EF8D89A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/tag/js/gpt.js
                                                                                                                                                                                                                                      Preview:(function(sttc){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;var p,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ea=da(this),fa="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),t={},ha={},u=function(a,b,c){if(!c||null!=a){c=ha[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}},v=function(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in t?f=t:f=ea;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))brea

                                                                                                                                                                                                                                      Chrome Cache Entry: 1888

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3954
                                                                                                                                                                                                                                      Entropy (8bit):7.926287913144182
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:lToD9Fqu02+zQEwJySJetiou/PdlZtnFZ+V5Ger5mwU:+7quY+JHotEBZ+fGewF
                                                                                                                                                                                                                                      MD5:463D102C2E3AF82C3DEE392FFD3C53A1
                                                                                                                                                                                                                                      SHA1:66AE16A12DCDE11C88E34E3B8DC05FA46934A3AA
                                                                                                                                                                                                                                      SHA-256:1CDB07169FC995D28B2182EBDDDFB00ED75BBC6C9D4912A8047AA718D3EDE580
                                                                                                                                                                                                                                      SHA-512:BEE8520C6CD8D6CE3EB18B38467D400D3F1D116B79E1052712E8AEC067D6A57F0E2FD6DC064A5263FD49299ADEB5CD6E12F9BBC1078225103EF96234D25BC154
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/curriculum-vitae-europeo-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFj...WEBPVP8L].../c....`.my.[km.......rw_....nu.w........w....8..K.*.....<....2...}.:4.a.w...v.l ..q.....".G.?.I..6..........T.Pe..a.A..T`.&.5+..r|!..K..@p .`A._P.w...K..ionoonlnn......b.P]]0T...A.:!.c<...$!...@O(%.D<.MMS2....zj...B..Nc.&J.....Qu......mG#....!P....g3.v$.@..wP..+.C,C..e.B.....R2.d.h.dI.D.Add[....@0d.S.).....S..).O~.BD.p..d.X.F......:....+.......<..0....pG....Vka.V...))@q.&u..YX..fk.1..$.k...G...?....[... ..s4..1.KL..U.no....?.{.......,dO&.z&O.H...#...!>&VMAh5k.j..<.:_.q..O ..K&.R21.d&f.....).v.Z`MJ"...........?.i..Jkh....$.).L...O.........i.v@,.C.O A.$......bI.&F..Y...^o.SWE8a.......e..?..Bq......F|L`_..Z.Q6z<(J.......$.F.5.......N...*h.'.Kx...-lMR..\.`f..qds4.3..>..<DD^..9.~SC.W.W4...w>..X.<.A4|.=..(.ry....j,....m].b2.B.\.$3x.ff={0........Op......}...|.>.E x;...H..xo.%..w..b......y.^!.....K..4..y4xp..x..0....).....s...m...<...M..9,.;...hn.KrGp%.CX..(..K.O!......L1.).'.d.....`........o.D..P\8.M.W..ky1.......4..R.8N...p.....d.&.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1889

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8474
                                                                                                                                                                                                                                      Entropy (8bit):7.975212901892653
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:IupOraCs+c8XFSr2Kdgh8q7HxpGe4Ydc6i9cFSOc7iHux1+n:9pOraCs5ySrfd3q7HLv26iSE0I+n
                                                                                                                                                                                                                                      MD5:DFE8AC9FABA54E04AAD03CFF60FD2886
                                                                                                                                                                                                                                      SHA1:F3E18B6FB93148E5930AA667B99E9A463353D103
                                                                                                                                                                                                                                      SHA-256:D21873317877FEE9763345C695E1DC2D38F097A6D97C9AC7969A13D6096CD991
                                                                                                                                                                                                                                      SHA-512:DD976856AFADC6D3F19B123069E5DB32842E12AFC43F1F527E0B5A92BFF42249730AB6EDD80F75DF1754EB95BA3CF211205C09C2A8E57F579EC7ED6D6E45E0FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/visual-boy-advance-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8L.!../c...M0.$...Y.....".?..1.C)]t..Z..X...$y...g..6....(..HP.*....nc.V........9.#.....6.mUY.............0p\.V.,3T..q... ..*.s...)....w.7........o'.?Ms...a...._.j.5.E..d....K.....4...U.....B<v.}.......".M .....V.k.j.-f[.j."..%..z...>..m..S..m.m.L..uU9......._.KH..Q.Tk.....@6..D.P..x7....m.)....C....[..T(....YCC..u..q.f.K..?...O.p.6.....Y..P.8....N.i;.....i1.";.>.r6..g:.P....\-..~$e.`..9~p.*..$I.$5...O.....H.$9."j.x...:.......=m."Gr~..*..y.{.v...............06...b.d.9...J...|af.....2sGE..a...eX(c_.m....;....wvt......ef.233...m[.dm.6.:p.qFDFFn_..n.....%....m..{[.F*22O...g..M.m+..K...k.m{}.m.![1........@.c..:*JN1........^/.54..&...+.'...b.h@.$$......$.l7......2|m@.a..@..HcBJ.q....Gy..d..R.S)8x.P*.E...g.8<.,Z.I..g^X. &..#.$......./|.A.yK....f.+.z.H....KR;...}..dx...z....~l4..S... F..'..T.@...?..W~.h.o.`.H..Z. @.f. n...:...... M.u.p.....C.L....~..e.'.N.._.P.d..&q.......fP.4@}J.........4........vy..b+3.AeY....J\..,..tbK...B

                                                                                                                                                                                                                                      Chrome Cache Entry: 1890

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9965
                                                                                                                                                                                                                                      Entropy (8bit):7.96672303597607
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:6ASuD+bOpzEp5mQuanrKSDFEzanLlx1w55k0BtyWgL0a2XR/EUkbVndM:61vOzELmeNFXL31s5jB4b0aYR8jVdM
                                                                                                                                                                                                                                      MD5:CD234879A27D4D07BD49C6FDA03C4246
                                                                                                                                                                                                                                      SHA1:F13A524AE32EBCC2D267B0A1F20CB2336492F2DF
                                                                                                                                                                                                                                      SHA-256:A0768B24C7358BBF498554E3CA0683BC447C4A0F0DD2403AEDCCA394B752A17D
                                                                                                                                                                                                                                      SHA-512:EAB0FBC65B5B6801560BE05E4C617605DADE36F060FDF62FAF04F65688BB758B0DD9ADD207E840902D478569FBA88E537271748AA01B72FC231FFCAAF9C6CF9A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..&xIDATx..}i.eGu.w.9.o...zVwkh..@ $!$.1B..`..$..2..x.....!..'^.ql.`l&A0.......t..nI=...7.w8.j...s....A.....?X...=..W.v}..{...8.9......X..:..9..u..s.......:....,.s(..Y..:..9..u..s.s`....X..0...G.ji...Y}.HU...........x.a.J.....A.a.3L...z..U..$X."?X.@ bU..[..r........Ng[....W.....A.?H...@.&.'.T..;2..~..~......{O.#e..g.;.'9.:.5..wd;>....~....p.w.....Z.j.N....&.0.....w~.........~.&BF.....?. rV......e\....0..B.....e.....7....!.N....5{Vf...v.t..........}../?..[.w....i.0Q1.?.5.6^...wEA.Q....o..............R2.yU.6p...V0.........{...u......!......#C.....#.....\n....Sk:....J.c...Oe].PY..;mB....)..Q...{...G.W...K/......{.q.....UUE......CA{a..........|^__....e.........%...]...........N{2.U..b...Oda.'mlK.S.(x._u..@..N....Wc.x..}...D....y..;..-.]>..[..RL8.s.DU..l...H.....LP..l..`V/..w...Jl'F.G.fG......l.h.{w...o.67.....1A<.p(+.\sxjZ.L.)..W.=h....+..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1891

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8494
                                                                                                                                                                                                                                      Entropy (8bit):7.95881115136536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ihWXAQNURi+ygpiA81MKKDIr8MwFhMAqwX0bbq4Rdhsf/:iYQQNURi9gkvKDISvq1bbq4LI
                                                                                                                                                                                                                                      MD5:E4E405F3F0C0104A4276EDF4109768E7
                                                                                                                                                                                                                                      SHA1:E12CF36B9307FD9AE808EF7F744E5B8B53B5D913
                                                                                                                                                                                                                                      SHA-256:304362F27823C4CB88B7E4BD97F569352716E18C8CB30819BF056EEC18583301
                                                                                                                                                                                                                                      SHA-512:018B11659E15BE42160BCBC27EBF40EAD434EB30D15578F2346C9CA0894D6824A7A8FDBDC8701386168E5A09EBFDDC3BD177A05AFA72F0D7D71F75E998E5C682
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/bluestacks-3-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF&!..WEBPVP8L.!../c.....m.9........".?...*)....u..]).:S.9.n.<..9.9.Df...ml...G....._...;..Q..H.U.?......q[....mU....]v.;T:|.@... T...?....E...?.....;.....}\......ne.ID.l.}=.eO..$."...t+...a..d2...;._.oq+SN..8..i...w`..Wx.9/.Dd[.[.....gyD).G{.x..ID@...~..1.I-..).s.i...7.71...../.r.ve.....unn.Q.M)G.3..@...6`..w.4D..H.q.6....a..^...`...v.m.$.....&..%.bpGp..4".f..........C....)...Yn.r......r.C...........6?W..-m.c.....@........mU...w..Z..rR.....q$I.R...-.7..Xp.......N;.$Iqr....l..`...B.`........?....2333.FK..33(.]....ff..K........o..I&5.}..kW.>......{.."R..G?.......{....NjH..&n.#..T.vH.M.S.SG..2.G.F...j...j`.V...@lZX...@g.v..|..c.9.7.m.)m'...ujw.....mokj...m.$.y...?2".(.m.Xz.m....#..6..m........!I.Fd.....m.......=.:....6.Y=.eWeU:##&.n...$9o.[U=L.bf)....03..-...4U.kt...3O1l..C.e...bu...Lf.b8...<..I.Dq.....L...b@[Ip..-..v.-w..C..w..s/......k.X.Sk.+.@..8S.. .q.*.R....Lf...kS,.....y0..rW&%..I.{.K..P.8...".........r.....k[.c.s...."...~...{M.m.Vz...3

                                                                                                                                                                                                                                      Chrome Cache Entry: 1892

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9559
                                                                                                                                                                                                                                      Entropy (8bit):7.968359423127337
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:YQ+ktLdUQC6Ftkz8f0sg+nHsh3Jctduk0BH6oYkxoRhM5sQmBXdNm:YZktLiNIfL/nHsT60oc2EK39m
                                                                                                                                                                                                                                      MD5:9B9EC7E4B03DC8F2A25E3414F7A9CF67
                                                                                                                                                                                                                                      SHA1:6556D65745E130452599BC872356BA10C809D139
                                                                                                                                                                                                                                      SHA-256:1201055200D1F514722B7176DCD0F5A1E7B95722474E251BF6313D4674AD3E03
                                                                                                                                                                                                                                      SHA-512:CCBBFBA9374C097618F15656EFE305772E8AF4C39981D59FA6743F3791BAFAA6C7FB8494E5D8A11D1EF6A6B5FD7CB3123E09A20787584FF42245A629943AD918
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..$.IDATx..}y.%Uu...Ug.s....(.6. ..(.<+Q...g^4F.KL..y8.....h.QDE.....I"...M..p..g...z..p.L..n.^r~.w..9u.T.Z.......H..%..[?....i......o....e[.}...!I.(;....+~...u.8.B...rj.?.N.......ag..yJ.(.....p_}.o.....T.}...a~G..3.6.su..1......l.y%..u...m.w..C.......o....3!../w....*W....^Q.y.M..j....CN.%....jZ..._OO..?.d.Q..QRR.Y.}....O.....^..Uo...FD...I.Xs.1[...Q{'4x..=.@. ..].....9...Q...a......*A.....A.E..k...<....!....y..N.....U.]r.vPp!P,)....-3...."....H...04...]..}.......C...7..U..n....l.G.-..;*".?...Ph..-..81N).d....O~z..Q....2.A.U.3j-..P@....] .7|...ud....~... X6.vay{.Zb....8k...Q..g>..Lb@.4..H..|..'~^k.....D...]p}.9..l.>.RI)Zn....Z~.^..k.ELy.G^....Z./.M.,..I.*..g,}.g...Y.......y..;...G4.*ztKS....Q$....*<`TgE<.....z.......X&&.*.`/.k.. ..*.$.L2....T5S...`fx..(.U.0Kz....A;.$#{k..v.....@..L;.....5o.#. B..Y..}J..+.k.; ....tf/.....*{..rp..L...E..(

                                                                                                                                                                                                                                      Chrome Cache Entry: 1893

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (39773)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):39774
                                                                                                                                                                                                                                      Entropy (8bit):5.464532853024407
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:MlpJQbAmWDDKOOgVePWHcFS9GRnLxk8BGrUWzkcZBVyfAVzrOmF0x48:aXwv7dnLxkvzkcVyfmOQ0xp
                                                                                                                                                                                                                                      MD5:2B9C746C710EA31ACEC0BC8385941834
                                                                                                                                                                                                                                      SHA1:DA7F0972E0AB0BDEF4D4C0B5412C54226E4C7F95
                                                                                                                                                                                                                                      SHA-256:412E7D7CDE179DB8F01FC9BA4453D4CBE4D713B9C9B14F9A281DE1D5587982F4
                                                                                                                                                                                                                                      SHA-512:12583AB0A36714CBF658BFA4BC6BF41A7A7D4B4DB3F8C56AFEAF571AEB3F9D170EED38D4C9884ACCE06E521B15F05AF31A38FD51A38CF232787B87D0318C875F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310240101/pubads_impl_page_level_ads.js?cb=31079134
                                                                                                                                                                                                                                      Preview:window.googletag&&typeof googletag._gpt_js_load_2_=='function'&&googletag._gpt_js_load_2_(function(_,_m){var IO=function(a){if(!HO.test(a))return null;a=Number(a);return isNaN(a)?null:a},JO=function(a,b){return a&&a.source?a.source===b||a.source.parent===b:!1},KO=function(a){a=_.eg(a);return.05>Math.abs(a-1)},MO=function(a){var b={bottom:"auto",clear:"none",display:"inline","float":"none",height:"auto",left:"auto",margin:0,"margin-bottom":0,"margin-left":0,"margin-right":"0","margin-top":0,"max-height":"none","max-width":"none",opacity:1,overflow:"visible",padding:0,"padding-bottom":0,"padding-left":0,"padding-right":0,"padding-top":0,position:"static",right:"auto",top:"auto","vertical-align":"baseline",visibility:"visible",width:"auto","z-index":"auto"};_.bv(_.y(Object,"keys").call(Object,b),function(c){var d=a.style[_.Oy(c)];("undefined"!==typeof d?d:a.style[_.Mz(a,c)])||_.Nz(a,c,b[c])});LO(a)},OO=function(a,b,c,d){return NO(a,"fullscreen",d.xa(952,function(e,f){if(f.source===b){if(!

                                                                                                                                                                                                                                      Chrome Cache Entry: 1894

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):165770
                                                                                                                                                                                                                                      Entropy (8bit):5.7505584298905505
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:5UymJNCri6fBc0xw48e4GMyOIXCJuHugfqtsh7ozja5HakQmJsug:51W+hx3OIdugi2hUwFfg
                                                                                                                                                                                                                                      MD5:9B5F7C92A5829BD53CBCE05B4F3C24E0
                                                                                                                                                                                                                                      SHA1:5167BA12252FDE13AAA6B3DA9009B0817F0F2EFF
                                                                                                                                                                                                                                      SHA-256:F10CE78B8BA7A54A12F6F6FB8FC705A6C946141D08A4A7A89DFBC9B1FB332C46
                                                                                                                                                                                                                                      SHA-512:53442EB85E38D7E61599A21E04534D5AD4DC7CFA4747ABF9C39591ED52609C998ED49DF6EE4081DD361A8DAF980F78DA33B5FDE26A786ED51B3A91E9D26CEA12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Sticky_Refresh":["html",0,0,null,1,100,970,0,1,null,null,1,1,null,[138327306428],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CLHd14CfloIDFUTyswodfa8A4w",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20067;&gt;8&amp;&gt;`dopb/%&lt;1732261!=|vqc)!7201061?&#39;9efotm(&amp;20723;&gt;:&amp;&gt;`dopb~&quot;]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this||self;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1895

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (21084)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):21257
                                                                                                                                                                                                                                      Entropy (8bit):5.218656398361519
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:knMQG5rwVO7dV9nNbRGCB9D45Hkn5vj2xpOxvIAgD75zBi5vISg3gzopL9TidOg3:P5sg7X/jD45eSxpOxvKD73i5vTzwL9Ti
                                                                                                                                                                                                                                      MD5:84415B7368FD6FC764CBE86039CE0626
                                                                                                                                                                                                                                      SHA1:62F238E73348C77EB9E865426A7D1B7DE23CBB2D
                                                                                                                                                                                                                                      SHA-256:C776195AD46333C6C9A9FE3C74502FFEA9A02FAF122388EA3567922CC65A3060
                                                                                                                                                                                                                                      SHA-512:8423F7A626064813EA9D7CA974AC4A3D23B304717BE6853CC10F356BA3A21971C531E2ACF7FF0285B81897BA54BF02265C96F4DCDE1BB35A350F399BA2479E17
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/js/popper.min.js
                                                                                                                                                                                                                                      Preview:/*. Copyright (C) Federico Zivolo 2019. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=e.ownerDocument.defaultView,n=o.getComputedStyle(e,null);return t?n[t]:n}function o(e){return'HTML'===e.nodeName?e:e.parentNode||e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto|scroll|overlay)/.test(r+s+p)?e:n(o(e))}function i(e){return e&&e.referenceNode?e.referenceNode:e}function r(e){return 11===e?re:10===e?pe:re||pe}function p(e){if(!e)return document.documentElement;for(var o=r(10)?document.body:

                                                                                                                                                                                                                                      Chrome Cache Entry: 1896

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6128
                                                                                                                                                                                                                                      Entropy (8bit):7.9600880415306445
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:/TlWgUNNVZ1MfPVBVRZ9yAdx0sF6N1WFkl9zqkkzbMEO4hpqoL2gRsoOgGTeWU:/TlWxDZ+lZZ9y6G1lfq1NpqoLlRsoki/
                                                                                                                                                                                                                                      MD5:DEC29F6E4D400EA77642DBBC49B18A0F
                                                                                                                                                                                                                                      SHA1:DEF9FB66D5F6113AF3FDED9238A801EEFB003C2F
                                                                                                                                                                                                                                      SHA-256:5E1DD3DC854696291FA46960EF1A1C446E3FD51D09A7849CA6A36D2B15262C34
                                                                                                                                                                                                                                      SHA-512:DB4E4395EE1D7B56B5738AE81CA22349EC63C32030AE9FF1A32E66259948407DEFA7344EF231FA8A1BF7F69DA922B6415D57E4EFEABA221459A4CAC0FE5FF88A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...{IDATx..][.nGY~.w....>..K.B[j*.\xa.....[.n..]..........(. ...*...Z....xcb...!.(...Z..wO.v...5....5k..}.w[.}....43.<.a....A.I......|..'.Z.W.....i....].Wff....9gf... ...iD ?...t]..s.m.4m.;..j........ "$_..W.........n...o )d.5.<)...#.|.K_../..?x......(.R.ax!5I...K.+.}@./p...[... (.._...-~..RT....4......^...W...7..sf...<......}.....#..9...h.'..;%U<....F..l.... ..c....dI.*F...Iw|.........7.....?.......}..g..f.A...E.xR!!_*........."k.s....go..{...@......#7...#R."j..VK.,c..uT[.Y.....R.....v4@h\.\z..w..{...w.{..._..?8....GR....Z.P.z..g..&.'..psE3.%..h..W..'.|..........S...q*d.=,#....2.H..ua....BH.cf.`$.T..x../.|.c..o|....?j........b.,8....xM...l..P........&f\...Z......W....|..W..".B....oh..&z!Z.Z.xr.f....aMaW..U.._'.h2.......w.sw....~ .%..Gh.UMYu%...O.U.(.b.J.....Do\$JUO..OH....~....G..S.4M....0#K9.YV/. .B...".......~No.._..........}...p.XU...../Tse=^b

                                                                                                                                                                                                                                      Chrome Cache Entry: 1897

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.001150; 2014Roboto
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):162464
                                                                                                                                                                                                                                      Entropy (8bit):6.524438741684788
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:x6X+/XYXXXXXXP9kPbVQdSZr/OkS98QSADOy9w4zb4VB22knj+1NmLVhygfTZluN:x+yZQMOJZDboVB22k5zTW+w
                                                                                                                                                                                                                                      MD5:D329CC8B34667F114A95422AAAD1B063
                                                                                                                                                                                                                                      SHA1:0A1793926E2EE724CF2FF3FC7ADC745348659F82
                                                                                                                                                                                                                                      SHA-256:EF2AB0E402D5CB9DE893E263A2C44E57F57FEC3974B0D981BFE84DEC3DAE83A1
                                                                                                                                                                                                                                      SHA-512:34B78978F62FD447C60654E4BE36877EB95AE9B7F616CA59858D2251C47825EEEBEAFD04D317D1E36D4C0FA9122A94D0140A81B2EE69FB08A3237EAC4279BCFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.rtbrain.app/fonts/Roboto-Bold-700.ttf
                                                                                                                                                                                                                                      Preview:........... GDEF.5.5.......DGPOSZ.61...<..Y|GSUB.2....b.....OS/2..........`cmap@&Hr...|....cvt .N$.../....BfpgmS.W...-D....gasp............glyf.u./..9....vhdmxWHS7........head.......,...6hhea.&.....d...$hmtxT...........loca....../.....maxp........... name7.c....(....post.m.d....... prep.6~.../..............F>._.<...................N..0.....s.................l.......0.5...............................N.................................3.......3.....f..................P.!....!....GOOG. .........f.... ........:... . .....d.................-.|...@...@...\..._.@.G.K.?...|...(.....^.9...#...n.S.~......._.......F...@...7...i...d...=..._...V.B.}...9...6.....".x...-.).K.b.......<.V.3.......b...s.^.....U...x.(.....U.............V.).....T.......E...(.D.t.;.....#...........I.9.x.`...9.....,.......4.J.D...o.,.B...B.S.H.......E.z.h...m.....F.o...~...o.{.i...B...o...B...o...8.....z.h...................J...0.......".0.j.B.....c...c...Q...........\...].F.V.......M.i.~.F.V.......~.L.Y...7...0...e.......K

                                                                                                                                                                                                                                      Chrome Cache Entry: 1898

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1899

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9434
                                                                                                                                                                                                                                      Entropy (8bit):7.97790805462771
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:wcAdeysbIOg+DOfesaDUDjBYIek7V0hVfaXYRg:wcAcjJg+KesrDjFGhVfl6
                                                                                                                                                                                                                                      MD5:6923E82566A33CFFE4B1A3ED357E14A3
                                                                                                                                                                                                                                      SHA1:8B7ED9AB58BAA9461672F457C37D6870011701C4
                                                                                                                                                                                                                                      SHA-256:266B290D024808348C02E75193A03BCDDE32353A9A012F38BEC507841C72FBD4
                                                                                                                                                                                                                                      SHA-512:A43DAD2C3D0878D520FD607EF23FC446333783493FA19D2E96035AB263A5036F7B052E22D7D83A35D590DB5FA5049A137846981F0E7B6C4528671AADF17C2047
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mycam-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.$..WEBPVP8L.$../c...M8l.F. ..$.....!..........W%..@w.._.-.M......He.GIl..I..........y...s./...>.n=..p...,2...y..'.<..~..: G..H....2o..3./..pO..m.n...b."._..W.1D...=.......k....C..&..}.C.u.$....}.Y.g..%...2+.k...s....2.+.2...0...7.....U"..>..x`..2.&.5%..4rF..i(IjU..........X.U._mQH3.~.`.d.<....Nh....dU...nN...S8..{.....|..B.1|-;..5KY>............a..R..F..C...A......S....=.UE.fZ./..!tD.Ei'..l..k.eK.....G.}...../X.P.......{6...j./,.Cu.........M...VL.:uTS.......?>S.XS.P.....iS..>.M..C..F.&.TP.&!Q...%.3.C.Ms.....a..jp.1..h.!..KX..H}.i....j.E+...-..l.....L....N)G..H..<.{1:..}..#.8...x.2.v$.m...>O....7.?.Y.......r..O....r./.sb.=..S4.9..9G.:T....u..{.u....F.D.<.t...E..6..9A.....MEev.....P.i&.M.ay..u..aO..y....2...>....z&.....a.....1........b.y.....^.t.p....8R..`........L<.........m..In~......"333..}g.U,..>..'ff..4`..;..]]..A9.$G.d...{r....h.'.......p.u..!..@8 .2..!S\1...g.#...vb.?.H.>;T...c..'P.E<72......P...V....JVvR.N...k.............0I

                                                                                                                                                                                                                                      Chrome Cache Entry: 1900

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7580
                                                                                                                                                                                                                                      Entropy (8bit):7.968109691964937
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ULfHOERNudT1Jhe9Ob4PYS3EIIbb/iMrVZXR0dor6eJdCI/:U7uERQdT1Jc9Ocg2hib/isX+dUZdCw
                                                                                                                                                                                                                                      MD5:3828A6594A74C732398A5164F7A341EB
                                                                                                                                                                                                                                      SHA1:2A720E2F7790FF034B8C9E12064BC542FF06A5BA
                                                                                                                                                                                                                                      SHA-256:CAF0845D5DB242E977DB0F96BC597A9813B015CB8751B2321C3F0CF082FBA9EE
                                                                                                                                                                                                                                      SHA-512:42BEC2A5FD011572D53850F6355E5A87FA774D2746D59CB5B2627CB4620174247CA04884C1C5BB363C77B289A269C3270E91563976B84BFF8AF72764B276BE07
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/cmaptools-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.....m.F..>9.n....".?..YO.`..0...$S.t.$....i. ..{....1..i..O.V....I.....p....G^.u.,q.?*.N....F..)...x.r$I....`..Px.......0.?'...d.........?.....w..G?% ....'.x.b..Q...8}....XHp.q.i...HS8a....t...(..&.........tj...*.6.9......t..O..8.bh.....i.....".L.DR..(".L%...H&.%.H$....m.H1...ADL@_..,.D,...M[s(.U4...k...-.Yk.n..<.tf...8.'.f.0....<....^`.O.....18.....J..0mA...6.=.(...\...*..d..'..Ni..o.%..u.S.u..=.....DrsP.Mu.a%...5U..v..<.NS..EE%....\........)XK. .. ...A......^.$I.dEf...{ln.;..*......#.M.U..gs.iV..9.s.B.9'.sN.9.s.6.*.g....-.....j..l..W06-../.oc:...8..u.9...}..l..H..aOa..>C.CEM...N{.Qg{.....s..9,..t`S..4'...u..^*8...9Q_`.u....d.p..}../`*(<.Kia.dH.....j..m..+..m.m..V.z.]U.AI.$G...Y=.9p........p..te....y....P.[...}+...o..6......[@@yiC.R.n..+...C../...B....P.....x..n|>i..vi...y.OX_.n........_<.k..J".J.,....L..?.*.l....Z..hY. YE,. pz..u"..,=a.Z`vq.EQ.g|.....^..3-.C.(...A2.h5.[....q..N.<...)Qz..."..-I.d$........w.....k

                                                                                                                                                                                                                                      Chrome Cache Entry: 1901

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):20208
                                                                                                                                                                                                                                      Entropy (8bit):7.9896805850882195
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:og76DFeiy2kFcQXSaqQayfk2YslMRGp1Zzq27UeJISD:ZuZei3HQCT2Ys+GnZeuh
                                                                                                                                                                                                                                      MD5:7352DC964234983208BD4E840121ADE2
                                                                                                                                                                                                                                      SHA1:45D4BEF165E5A1D2AC6117BA045AD6AE8E1C739F
                                                                                                                                                                                                                                      SHA-256:A335BBCB4E97F4091390010D3BA8C9CFB8446E3E3A918B82C5DAA4D862A2975E
                                                                                                                                                                                                                                      SHA-512:6B5BE6774DC4DB41E6B921AEE709163A1CC0DD04B8A9FB2C46C29A0C6D49C73AC65CBE1CC8B5975E3460659E8D24C2ABBBB270823FA1B3F5CB6842D6D0E599CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/efootball-pes-2021-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.N..WEBPVP8L.N../c...M.m.6p.....'i{BD.'..d..F.UKZ/>[. ..nc...@,M..."I....H@.....Gj$9R.$ER..]s..?n..q.H."..6...<Xh....D=FVd........d.A..!....A.c...J.......L.z.../$...vm...3..%..m.....w@......9.c..bHD.bF...d.c"..6!.~....x..x..I.$.............$..P~.....$...P........H0f.0..M._...BDL..........`.^:.&<8...gm...m..~.#...6[..=F...c.g0Fzd=...Q.QUP.QJ.......-I.#.m...Gd6..c......h\...f.[.$.m.2..R[k}....x..X.......[....P..2fx....k....'.......X.........333.1...X.i.09`..-.Xz...n.m.J.nC.,...;...N......... ..[..~..f.sM...Vk...."I...GdfAwO.....w...'O..E...>.d.d.-....vgg.. 3#".... 4..D.......*.r.Y.....w.\/....s.\?..g..c...:z.E..+....-H.X|.x...x..A...z:..'....C....u=....__....g..r>.c\.%{..}(.x...o.z6~0|&L..;..n..CG(.B.jk.J....!....<Wn.=.......x..GBC..6.p.+..K........2.L.O....<......8.52R...Q...Z.....SUCZHD...w...8.R'......A.$.t.....r..|.y,w<o.o2g.O.Q.m'.....j...U.V.h..:.S.d..NuJ..K7...../..6....B.(e#...r.V2.~.......&...^p.v>.v.{...vf..CB.l...dMM....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1902

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14404
                                                                                                                                                                                                                                      Entropy (8bit):7.974468832219289
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:nVWY87hiHy04p6JxQ9Dlvln8B3EOp1/QwOYf:YR7pZKxwDlCBKwOYf
                                                                                                                                                                                                                                      MD5:2CAB020FF473959CA0DFB3689306FB57
                                                                                                                                                                                                                                      SHA1:3CF0C35B820046B4AFA6B2D00EBE75479617109E
                                                                                                                                                                                                                                      SHA-256:1B9119CA51A176F1045AF2F61BA97C8CA909F2108F2FE5640AF3DCDED6F82ACA
                                                                                                                                                                                                                                      SHA-512:63D40C95F77F866D3DBBA73AC3C5CFEBB44C7BBA0A0E2CFEE6F332A72F18BFCA136F722548751FB1E135605ED38558F7E89E9A8E65B61774AE1C97BF5CB205FE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..7.IDATx......i]....y.w.}.;.<B.b(&Q..%...8.g!m..^.bV...86.f.[cw.;..N.h.....P.Q.Dd..j...Uu.s.g.g........NQ......?...K.X.....$..C...`..C..*..%..9$.2..K..?....F...#...@...0... hQ....0.........R.m....0...2H`q...q.....'.@...... ...R.m...2.:. ..d.a...8.kJ. I..%.[..`.0....K..?.....$.j.].&mk[.d>...C..rN)I. $...&.|AlK....A`...F.0 .@..$...q....y..=.......]..Z.h.W....[>~r.....d...N..d[...N9..H2.0....`@.......9$l.-.Y.dW..=wn..._....w}..C..OwF.../...}.2$G.D.Gc.Giii..4Z=V.x..g<.g...y..7....R.6..X..0.O2........R.).mK2.:[....4.....7...~..wg>M.Y., @ ....2. .......6M............{..g>..,c.& U)9..Q.......m. .%...1..$.`*..\J..{.~...........P./ ....u...0..%...D.I.e.^.>.@.Ci.4J<..........|..z"'.8,%.T.".nA.X./.l.......*...(\.x.;.......?t.|.K`.r.......D;....R ......$5R+.P...9-'V.0*1...w.............fu..4..O.....J.H|Ad./.A.Z..J..Y..<..o....q...!...J.Z......W....)../@

                                                                                                                                                                                                                                      Chrome Cache Entry: 1903

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12620
                                                                                                                                                                                                                                      Entropy (8bit):7.966720797941534
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:bWtCNQyRiYzwnTAG0xC2VH4qPVsToA2DPq:60rib0G0Uc9qoA2Dy
                                                                                                                                                                                                                                      MD5:464BFCA4134A0720FA660A833E6BCE84
                                                                                                                                                                                                                                      SHA1:5EDC0B3DFC27CB1649BB089EDFF07A042EC6D5B2
                                                                                                                                                                                                                                      SHA-256:1F63FF460976630BF5DA34BE2910609DE796547A9B85754522DC63BA155650D9
                                                                                                                                                                                                                                      SHA-512:9B4AE198077B341216C2092CBD3DD2FCA469939D4625649D55C94C97A4FCDAF0EEF0D73B0DE032EF18FBA45DAE257397FF91CD50C181AFD24460221D576A07D3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/recuva-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFD1..WEBPVP8L71../c...M8l.6.`]/.G..........$.7\3I..%..... ..hD.IW....].....O.....U}.....Z^....y6..X..$I...........FZ#......=9.....p".DD/p.F."9......q4..... I.!..$..9..b....a....2.....$....L..,.'. H.v.7.J.....|......B.^t."..p*._..I...&n.....d.t)...m.....5.v.i7..]......|N.3.l...f.r....6 .$.~v...i. ..>].!......4K..^.....P.8....P......]..1..;R+.......X6.N..m..Z....sE.$.7.affff.>.c.x...cff..`F...k..K..... I.$I..(....?...1..$.$...".......p.`...e......m.m....[.}h2.q.>Pu..m..o.e.m.:YF.I..:.dj..{o.....I.mk}./".n...pc...[.....E..c......BMU..<i..H.m[...of.A.LI..Z.T\MX]Y]`..*..*....3.d.si.q.2#........s*@...B..q@.q4....p.....a..@.h. 6.@`...-.s.`@.#.g..2. ....z6....!.@.S&..h.k'[8.....$.....xf.a....L^...p..<........3x{.}...=...*A2..a...3.aw.YY9..-.L....4......i.0C.m....]....I..zz.m;..........E."..Q...`.de...........jJ...>.3..1h.....O........n.........N.4.e.d....u~.....v.w~.u.9j.0..X....N..*%....'.A(|b..M.....t'R..R.B4.......q......]~.....g..~...O.../

                                                                                                                                                                                                                                      Chrome Cache Entry: 1904

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Web Open Font Format, TrueType, length 48240, version 0.0
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):48240
                                                                                                                                                                                                                                      Entropy (8bit):7.990905550316269
                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                      SSDEEP:768:ZnFjkiqRyE/mKJ6xM+fH0ZWvp+aihktwIuKU5mtsqk4WRS1aLAsR0SxyE2PJYFxz:vVqGKox5uWvwaijIufmtZWKsq3qFMMPv
                                                                                                                                                                                                                                      MD5:351E9A80BD41ED38F558AE9A8C72D4F6
                                                                                                                                                                                                                                      SHA1:6B46F6F929BDE787AF78D57107CA5AC08456E0AB
                                                                                                                                                                                                                                      SHA-256:C1826C77619422CBFC2D6C86317F35C583411ABD2F75DE81A7EE8BB309CD9135
                                                                                                                                                                                                                                      SHA-512:5317BD8FB5EBA7255C6F3D79685EB899CC689B71CC378BE45834670E34E4B1FC8C67C00698338643919F7F3B25D718D7ADBEDB107ADB656EA5530963DF0DB78C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/fonts/35117E_0_0.woff
                                                                                                                                                                                                                                      Preview:wOFF.......p...................X............GDEF...D...v.......,GPOS......#5..f.`.xGSUB.......#...d3D..OS/2.......M...`i...cmap...(........T...cvt ...0...C.......<fpgm...t...<....vd.zgasp...(............glyf......xd...hV...head.......6...6.W4/hhea.......!...$.{.1hmtx............LM>.loca.............}..maxp....... ... ....name.............!~'post...d.........H..prep.............1-h.......T.........N._......................._.<...........#.....\B......z..............x.c`f*g......................|....3 .P.p?.....S....1d3oc.......cRc.....x....?...x....K.Q...s.{.5.,51...^m..?.6."*"$.L..!..*.....7......".u...A..em......^..VF......mZx..xv?8.... .V..>...N.... .I...,.+X.....X.....S..1.....t.9...(.IQ!.E.8)QJY"..K..WeV>..._TFUTK!)JQ.u.9...Z..#.e.Y..=.\U.Z..f.....0{.A....^.[Lb5*l...9..x./`.f.6..O.W."!.zM.k.EM.k..5.^3....^SI5t....,j..5.hr[s`......G..........\.%~...y~.O.1..].;...s.;........F.`S.....~...)3j..}3d..]s.dL.i0..F<.....A.\.....9=...A=..|[....4.....?._nN/.x.c`d``....!

                                                                                                                                                                                                                                      Chrome Cache Entry: 1905

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16471
                                                                                                                                                                                                                                      Entropy (8bit):7.9734359251327485
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:mvyTU9nqM3JIcvVQ0qTogg5NTmDcE+blcD9qS0HYn5tIi:syTUNqMCoIogKNT2gODMS04n52i
                                                                                                                                                                                                                                      MD5:898506CBA9812CED855EE0519F2243A1
                                                                                                                                                                                                                                      SHA1:0B82174FE3285B85AED5558B10FCD79F38AC6073
                                                                                                                                                                                                                                      SHA-256:94888655D304A079BEBD74DFBBF7ABD512EB5022D6CB4FB7B1616494EEC7CB4B
                                                                                                                                                                                                                                      SHA-512:3BFC2F3B5F24B201686615E6654B7525B6ABCD9818DC58FA05E64193020DA8B1AEBFB05B765B7DF726DE6BCCC133C80D0EB33D81B8AF596CF63801B98179C196
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..?.IDATx....d.u%.....gVVVUVWwW.+{..$5.........%H.,...C........20.F.mA#Q.EJ.E6I..n....U]{.[.....g..#....[$EJ.J.2#3~...}..{.7....0.Zk.q...<...!..~....+..^E0.H.E.."..... ow.......up...?.Li..(.......*.{.P.<.~..2..!...nC........ax.ao:l..(.....,... T>y....1.R.cL)....(...PJ....V.....i..lt.GJ*..R*."..eY....,.1v.7..#..(.....$...9?0Sy.......:...3I)...r..RZ.M..W.^]_[O.....x....u.z.~...f.9...eYyd.h....{...d?`c..."t!._.D...P.K&...~..{{{.m;..h4\..J.(#....+...h4..YJ.}.;.....".(..<....G..!..........<..4.SJK3.J.0....W..j...e...c..LLLx..6....{.^../."..+W..F.Z.v.......VZ..t.P.;F7..H.*.u...4-.,L.,.eYZ....<..3..n9.l4.?....W.k.`......X....k..8....m....|...w.}.}..o..J.$.r.-na.F.3.;z..b,}-.*.....#.Y....Qnm..\x.....|.I..)#...s.@s...7x....9..s.=..+..>}..G.%.p.,K.Di...c..<.........R.Eh?....Zj.....0..xee.W_i4.O=...L*I)-...O90..Nt...}m.u.\.R4...|..V/...o.y..n....u.0J..3..m

                                                                                                                                                                                                                                      Chrome Cache Entry: 1906

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4555
                                                                                                                                                                                                                                      Entropy (8bit):7.940398105338876
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:M22khYvBovA48f9k6pRG2Ecy+L693i/mnlstsg3/hKDViU0OgJxF:EOYQAPfGKGsLA2mnlstzAD6zb
                                                                                                                                                                                                                                      MD5:74EFD87844A85FA752C8669DB24C689D
                                                                                                                                                                                                                                      SHA1:3DB3E16EF06B6C195D6233995C3455AC8A69B13E
                                                                                                                                                                                                                                      SHA-256:6793EFE0AB0D4B3A7D41D6E02BA0624B9DF1343C2E43B45C7F996BA45CE82429
                                                                                                                                                                                                                                      SHA-512:68CAA255D42C0AF340E23A2F7C80A6FE7B205036AC0B4A23C8F00A224F3A4B909ED5648089EBED1279C14E867EA219F90AFC3252AE570F0875FB9F0199C71193
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...VIDATx..]}.ewY~...;.{g....t..v.-..b..D..4....`.......cH....A...T._Z.5JP@....?P)_.......n...|.{.9...sg.kv.kgw4..df2s..x~....g(..ms.. ..5.k.....X#.F.....5.k.....X#.F`......h..zv..$.p#....FJ.Hn.4..)..@ %m.6wv.$]..xm.6.n.%.._<...b..._.D..x....x..N..M1$!....x...{........#...'_y.{...;.cr....f..:=...>78......e....W..Cw..q.1......Y..P....Y$..'.:..?2^d.q.....L.....g.........2.A?.h.... .H..Cs...MoFk.{.....ia......d..D.$Ipo.%9..cSJU....f<....Le%.`..,.d..]...RD..T..\......V'..F..."..t.cC..{.YV.g..X........W...-O..........Y..A6...AK..y...3K......@.].E....p....|0.\^...O..T........$j.B *.j...5.p.$....F....h"..a.......4...]Mg.E."...Y..\3.2'm.v6n..\.g...o....G{.....u....P;.....0..W.....Z ...........Yr!...........lk..KhO...+..hin.).....$..!.WC:6.26.....:...1......G.YT+z...cm`../a.8.....j..B.....".{...4..3.;1.[..%._8.;..`v*...6.|U. ....t.*.....N.......%.....6'.....^....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1907

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17
                                                                                                                                                                                                                                      Entropy (8bit):3.4104172527605203
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:x3FrE:dFrE
                                                                                                                                                                                                                                      MD5:0AC8DBE31DD35419AAE219847ED029CF
                                                                                                                                                                                                                                      SHA1:C2BA43631D389A1ED40D64F7CE0E457C1C1AD185
                                                                                                                                                                                                                                      SHA-256:2E5B50C64FCC5F4E0AD3E6CDF3D28655A271DE28F234B26F365EBF6B1A4A0F48
                                                                                                                                                                                                                                      SHA-512:3A9AB6AB378A6357A489252D1402587BE58CF6648400BA173AADACB9050533140216EF223736F065315C2E84A99BF67F85864DEAC53A71E235AB7A6B1F03D907
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:missing (v)ersion

                                                                                                                                                                                                                                      Chrome Cache Entry: 1908

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):16132
                                                                                                                                                                                                                                      Entropy (8bit):7.9850954510945655
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:gMgxq/sXsC/L9n9JeiFa5GXo6CGKysaySywAWOOj:iXDj17e0Xm1aPy7WDj
                                                                                                                                                                                                                                      MD5:83264B4E7E326041B7F6C7B4297D3CE7
                                                                                                                                                                                                                                      SHA1:2EC086FB0D99C0F1F2227F31E019327E5DC0E73E
                                                                                                                                                                                                                                      SHA-256:D5C52538C1E2672B456B913AB195EB71579EF915BDDEAF42E1ED586DFB17ECF1
                                                                                                                                                                                                                                      SHA-512:8078A5D82966BB4428D86D6436DC4AAD1C7ED7417ED40CB57EB307AF04FE62A8C5359BEFEFFB3E002E25911ACFE9AA12093DA35ED844D22218F9BAFC725ECCB9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/toca-life-world-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.>..WEBPVP8L.>../c...M8l.F. ..j...gwk.....,A..,0.d..Js2$..u@......o....2..77r.U.J\..0S./.9..(.........~1kZ..8.m.n...L....].F......./..m.q.dW.....+sP...H.....T.....R.....%.O.j..X..~..{?z...v..O..........#..T.>.}..9..^...@.Z../....d;.y.E..J..M....q.x.^.I..I...~I.u...i...o...=.K.~=..2....{.g[.>hll...gDD..s....K.c.F...jm.a).Q...........9..v{%..e..K.N.XM..W..i<..$bp...H...Z..o.{..b%..AzM.5....HI@.,........&k.@...\....<....5.K.UU]U-.]].....q.......[...Wu.r.k.5..........^.'..K...v.x...........B...;\.o<.....pw.../..v.L+......:..d.v.xq:E.....e..1v..E.w|...p..H...sv.....?.Q.A........T....E...'.8T.C...\"w..R..a.;.@......}.u.$K..0UaN.0'...hfffff~....;.f*.'.b[.,..:...m..f....q..us.i3i...m.m.m.m3..2..4.d..[.u........0`1.....V/.d-L..6..V;.....V.<R..;..k.....:"...i...4rKfW...6.@.l.1...Ll.....3.pJ(..F..J7...I.. ..I..Ht ..f..D...!.:....h....D..E......... tI|....wZ.O..GXX;.Z.? T.7.I..7.(h.}..,.'[%).f.+8X....+9b...Y0/e..v.....a..+....|..G"\..+

                                                                                                                                                                                                                                      Chrome Cache Entry: 1909

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7955
                                                                                                                                                                                                                                      Entropy (8bit):7.957724180209998
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:1uOR+UDKfdCvrPOY9YJLRxse3ozSyYB84RWZzJW7GQTkQWO:IO/f4L9ozSLBHWQkW
                                                                                                                                                                                                                                      MD5:798D7333ECC93DBD5454AC7F528E0147
                                                                                                                                                                                                                                      SHA1:707CC5FF74527607F6202E661EE0BBA2872887A6
                                                                                                                                                                                                                                      SHA-256:48CC84803C55E1BEA78DDFC642F1F2B455DD8AAE8A9B7034025A26F0AF3EC54F
                                                                                                                                                                                                                                      SHA-512:08CDDA301A10DDA7BEB46C21792B0F22BE7D37B1C4FD0891FA7312172EAC0AACF1DB46F71107278E9F1A1054F814400636FA7BB027CDB44294FAAB7E7F26F4E7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}k.e.u....q.}...{...g2.....!...$..(.....H..@...%,..?.d..(......$.9.....{l...U]......{-~.so.....tW...........Zk..[k.C...{(.@..*......P.sUU:......s.9.@UU...5.-.Gq.0(..(NT.P"..o.)..\.A.o......'R.....x(.....^...D.K.k.g..A..{{{.Z..M...X3.Iu.2..+.w.,..s.T(.U....@..FD.DEED!....cDD.V..y.#.....D<...M.}=..>.9RD....E..Sb.jQL.+1.@.....ys...$Q.L.D...{g.U...=...:x..X.)"RQ.z.sEQ...*."..R.*s..~f..L.GC&.).........(..Y4.x.?..B|..^io3B...EQ.E./.,KQ!R"...(._#.....!VU.2....D..b..W...R..<....{..k/.8n...5.2.J .~.O.......47..Y....(b.L.'*T.@.T./.(,dD.E.{)..9W.*..-/.../....._.....;bYs.,.r8..F..(|Y.(...W.CtfF... @A`2...... @+(...UqN*o...#.J......T.o..Rr....d.|..@.........(...T..f&../...4?.v&.,...{f.<..T.,.(p.4..Q.M..p...7w=]8.7.c.....8..8.....=U......".!.0.......a...~;.p.._W....H.Z...t.$...;r}F.m.....Gl....:{qn:/je.v.{^..$.`Vl..#c....E.......p.5.5.84."...j.X.s"jHA.p5t.PD/z

                                                                                                                                                                                                                                      Chrome Cache Entry: 1910

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20270
                                                                                                                                                                                                                                      Entropy (8bit):7.975334241671506
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:R3DqLACm0fWUU8738OBf5YDC7GtolLxv3IaXxyq5YCLILh:IOXUUwtEDPMvxyq7LIl
                                                                                                                                                                                                                                      MD5:D7F42273DCC0CDCB14EE4ADD21C81742
                                                                                                                                                                                                                                      SHA1:43AB579223B1824F64E11FBA2A314B172CC7D8B4
                                                                                                                                                                                                                                      SHA-256:19DA95E17200A0B66DCB2BB06F29D099AE002979A88ED0860EFEBEF862F34A49
                                                                                                                                                                                                                                      SHA-512:367A230DA9821FBB83700525CC70E59300CE0E141BC7162C02F1352272FFC65F1579C23FED724EF02073D78A6FE87EA55F598C0AD8D7527421BCDB5676A0DDC2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..N.IDATx....d.U&./o./.....}W.$....d.m..........@......3s.sf..3.........-....e..J.*UUVVf..{.[.m....T..3.reUf*.....w...[.q..R.3..D...U2A..R...>.&.......}....9...8.!.0.(.)V.#na.`l!I...kY.....1QJ)....`BH..HI$...!L0EHI%..pMD...BA..!.XJ.0F.'I..Y..B.Ea>m!.$.....J.;.y....6.6c.s.1.."..<I....l.k.....y...e..)...(.?.#,.6..;Q`3.....R.......V..QQ.!.k#B..X.)F.B.a..B6FXb....G.E.eY....v*X.......R.c)).(m...*$2.BRJ.....u.T..E(..*...3&rN..s.....R..0C.#...R*so.KD.DR_.........@.L}.O...c......B(...;1...).......3..9.._........<Em..i....!.C....!$0...M....nB8X....G..o.>.t..!..E.6.v+.....BH..j.YX.p-....z....,.....E.D.Z1.1....R...h'E..S.~....+.I..q)......<.o..=..u77.:s..r.,..#.HZp..&DQ.Y!.....GGDy.R...,.<.AdO.)...XJ$....8.3..L...."...w...+.&.8|./....p....l....I.&%.RH..8....8.R.sA...... ..K.....U.bFr.pL..>.J.8.`T..%.Q..KeQ'..x4..."G...xU.....+.A..G...'...;b)..$..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1911

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2316
                                                                                                                                                                                                                                      Entropy (8bit):7.799595341240873
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:MWbdkqW7+tSe2KC0hxMoUom1dLvno8PxtvNNKbH4/LCSh6mF:/xWqxbUoGjo8fvKbudF
                                                                                                                                                                                                                                      MD5:FA24A784F6CF55E70ADBA83733C4BD2A
                                                                                                                                                                                                                                      SHA1:B2B0A19E0CA2C69941AA8DE3E25B02FADF81F322
                                                                                                                                                                                                                                      SHA-256:5EF8BC566A5DA929D4A762E93A09FA3A99261FCE130EF43E8A11E37BF63DA25C
                                                                                                                                                                                                                                      SHA-512:829DE830257B02E33B3F00C5EF0168E3974A64E1FC538358356070BD9BA5B91731ECB426F7AFCFB943328E01B326042993A93101B0C7F7F230CFC6E8A467599A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/images/5cei5r.gif
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8X........1..1..ANIM..........ANMFb.........1..1......VP8LI.../1@....e.....[|.............v.......6.s..n6.6...6.6.paPcPq......P.i~?if".?.:..BU.^...?......=...o.F.....[..T><r.=.(..y.....a!`p..A./..m.0K.......8..;...X}.........._K..#.+..O.l.....7mH.j.....|h....m1.0Q......^.k.n~.L.~..?...{E....?+z.'......Xd..O.Zo}}..l.^v`?o..S...W....yVK.k.#.;.C..+......b.7.Qt...#..:.00X._...3 )%.-'...M......s..y....=I.+.<..>...[..v.=.+..^..=n.3#.6I..&.K....o..Og....].<.}....y.q...j..a..u....[R{.=!./.....v......m...4#Y.&.~..!3Ie..mU........+2..L..;..M....I.8H.3F0.v...q.f.4...;.. j%.#`9.0|..m......;.?4R1.......u....Q....H.l3..'.<..=.z.....Z....Lr0.....=.G......N.a.v......x-........P..m.~..M.p.......+l...60=c^v.mb7..3...".._.....Td..J.....]KR..;.......|...-..D...|..$}N....._....I*G..U.g`.7....}.........7.F`.I.8....H`.....;0.0.u....~.....-%i96....R{?...T..~.e.$3./.@.....rOKG:....MH....s...q.iu....L~S>...3.U.vd.i.#..MU.?....).I........&..h{tE.`{..+...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1912

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):32
                                                                                                                                                                                                                                      Entropy (8bit):4.601409765557392
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:HeiCkum0KthMJGGQ:+ib1GQ
                                                                                                                                                                                                                                      MD5:47C3F0AFC4EDD9A1B52609F31824AAED
                                                                                                                                                                                                                                      SHA1:1C39E5A952CB1D3B76DDB636518D001CA2D33E62
                                                                                                                                                                                                                                      SHA-256:A30231CB8E128C470D509E1A7777D362D8CD63C7F01C74A41EA1C8E1A63CDB01
                                                                                                                                                                                                                                      SHA-512:1D8D22E211FDB059258BA47BE23657E83027C491FE0EB3AC0CE92B48C8253638D73899A11623FFCE78091CF169FF69FC56F564941FFB298E58676A6A6F8D9A04
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAmwZ9jyRZwYjBIFDRepaL4SEAmcm1KstdUDnxIFDbIlc2s=?alt=proto
                                                                                                                                                                                                                                      Preview:CgkKBw0XqWi+GgAKCQoHDbIlc2saAA==

                                                                                                                                                                                                                                      Chrome Cache Entry: 1913

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10051
                                                                                                                                                                                                                                      Entropy (8bit):7.971110959358596
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:fGQ/id0/tU01zc5rPXjdiCk9g5JAvniuKuP863V1mnw9p:uWiditU01Q5rLdiC0Dvnicnsni
                                                                                                                                                                                                                                      MD5:6F3307D0ED4E578C7DD3E2E3C011B5CF
                                                                                                                                                                                                                                      SHA1:E754F678F6F62793CBD03F560F0241974C374731
                                                                                                                                                                                                                                      SHA-256:46B5BDF8E626615CD5F350597B6E613B17F0C83CC515166EE85AB9471B1DE539
                                                                                                                                                                                                                                      SHA-512:45F84E8C2C408648F521A6E310434797C1A35CCD536AF74661AEF3160F6A4598AF51E9B1C92C443DE4E38B579DB194B0D0BB704EAB13B01197C361CBECE12F43
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..&.IDATx..}i.m.u..s.....}O.J].$UIeYV..5.#..DB.$&..!.K ...0......-.|..C....q..$A.m...JR=...U..u.={..s...9..*..0....=.n.^k.1..s.zu.....@A ..)..@R.w... ...ev..@.\..|...?........N0>.G......p.j.....e~a..0... ..'..rA.........W~8...O..t.I.H....y....d...]........7.W;?K.5].@.......sP.2..b&.(c....*f......f..%~.)...q.4+mp..I..T>A@(V.`;{...I.U........\1.........j.nf....A.hr.!.|..8}.@P..I.H..->.Ap.......,.......$.N....&.....F#).a.....l.V .:.sn:.$P.4.]R;2.g.....R...q..r.Idf.J..r7+1D.......b...(.y...\n1.....s...xP...!.....N...Q.0..37...i1m<..d4w.@..m._w.n..y...%.2Z7..{a.(.O.A1[c........u<..F..............%..2$..k\\NIw'-....i..C"a...o.... @.J.:.GR...T...E....,a..f.b.\....%.....s2..sy\...u...0.%u_F.p.5g....H.s..i.D..?%.*....{.=8....du'X.i..aI....G..N.z.Q...u~.9L..ls+.A.JL[.....).=K......*7.IA.^..[}...8.....bE~.$.{...\.V..jv..'.9.t(.<Wq.L"...4.1.d.....b&.'.X.5M.d*..:.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1914

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8791
                                                                                                                                                                                                                                      Entropy (8bit):7.969811163127012
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:6NRcKOEkICLQ1FehC+Jkakv8hsHyulN+j3OWsYUbULdZxNx:6NRcwZ2Y6CqkfUhsHTuiTOdtx
                                                                                                                                                                                                                                      MD5:45C3A244BCC2F5469BAFF7F0725423F1
                                                                                                                                                                                                                                      SHA1:2F7A9F4243FCC0C91BEACCBEACAAB52C84167E6F
                                                                                                                                                                                                                                      SHA-256:B2833588C3FD42D05DA24B232B0286888523D4F414F5879ECC4E9B7943473A61
                                                                                                                                                                                                                                      SHA-512:0B6FA003AEDCA58C3638BCC3D28705EEEBB9DF6A0D610906342378A1A2096CC20E6E076E9E83834EAEA984B296565E2179D4644E3B7332DE98342440433EF92D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..!.IDATx..}Y.%.u.Z...3.;.H....$j.L;...r.[....c.A..~..;y.....=@`.9/A..A .B...b...(J.H.d7..t.3....:...$.dk...4.s....j}{X{..}..G.]...G`..t.G`.)R....]...Xla..G..(f=r...b.....#7.+v}..P.II....@...w...;5^$!.r....$!.5..;oYF.....W2.6.SY'...%...j.X........S^.......0..:..66....$K$.r9$`...P..`.p.....*.n.=.,Q..A6..m;..9..v.:.A...e?.5-.... H8..$.b...i.q8..{...f6..d..m....i.I"..0Jj.|...(.."f.(........!..P.q.C..p.r..<...8l.t...o...I#Q...jo...+A.W*..(."..v.>M}.fV...w?s...@.....7. ..$aR.a.m......s..M..Kd..:.-.. <xv8...qQ..-K.j.-.$..%............?)....H$E2../*......vzf...(.'..... ...QN..z.>...}.y.$..0. .yX.<...=..x.<HT..;,.......@.$.b.".;c;.....l.l...q.DP.^-....~k.~......q..). ...'*_.}m.3/.0KBniE....&.......Q"en.<8........K.b7...v.;k.x.m..v..W.1..^....bno..;.G....g...........LP$6O.YH.Y.d....&I2M....bp..... ."T..Q..AR...Q....F..Q..k#[....3..H .rIu.....1.:.....t .`5/.:..2

                                                                                                                                                                                                                                      Chrome Cache Entry: 1915

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1916

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1223
                                                                                                                                                                                                                                      Entropy (8bit):5.3911322530072985
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:Y/ppLgOkNp7FOqAJgnzoIxeSPf5OtZtI0IUYSCWSV3045:YBJdkNFAh0e+uaESF5
                                                                                                                                                                                                                                      MD5:3B40F6F9E7BB7EBCBBDB2C3262EE82BA
                                                                                                                                                                                                                                      SHA1:26C962A2DA2836637AF304C2D327CF49843A788A
                                                                                                                                                                                                                                      SHA-256:284004738CAC4594B4D7626350C62AEE4644D1E2761D75236BC69A1D3ED35F71
                                                                                                                                                                                                                                      SHA-512:39AD35300129195DCBE1F294220EE233DA343AEF1046521F6B11A2B2B8EF19F1239DB2C277C42970BEDA9814C23A53C7571222ABD314F5B5077596269F1ABB96
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/gampad/ads?pvsid=343331062718654&correlator=317277012025903&eid=31079134%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202310240101&ptt=17&impl=fifs&gdpr=0&trt=2&iu_parts=5302%3A22764537101%2CTD-desktop%2Cdownloadit%2Cdownloadit-it-defaultpage%2CATF_OOP_Interstitial&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698410155259&lmt=1698410155&adxs=-9&adys=-9&biw=1017&bih=853&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLFtdLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMTcuMC41OTM4LjEzNCJdLFsiTm90O0E9QnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjExNy4wLjU5MzguMTM0Il1dLDBd&url=https%3A%2F%2Fdownload.it%2F%3Ftyp%3D1&vis=1&psz=0x-1&msz=0x-1&fws=1026&ohw=0&ga_vid=1995881029.1698410155&ga_sid=1698410155&ga_hid=912521144&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRjqmYmJtzFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyLDIyNzY0NTM3MTAxL1RELWRlc2t0b3AvZG93bmxvYWRpdC9kb3dubG9hZGl0LWl0LWRlZmF1bHRwYWdlL0FURl9PT1BfSW50ZXJzdGl0aWFsIixbW11dXV1dXQ..&dlt=1698410151758&idt=2908&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dgpt-interstitial%26hvi%3Dfalse%26type%3DOOP_Display_Interstitial&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26compliant%3D1%26ad_session_id%3Db6413f29-c277-4fb0-8970-dd98c320dd64%26pv%3D1%26ab_upr%3D7%26segments%3D%26personalized%3D1&adks=1180878096&frm=20
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_OOP_Interstitial":["html",0,0,null,0,0,0,1,0,null,null,null,null,[["ID=ab6fa74fbc841818:T=1698410156:RT=1698410156:S=ALNI_Mb8Cro2xCyVtZQx2LztbCmz4KFEZw",1732106156,"/","download.it",1],["UID=00000d9cf0d58b29:T=1698410156:RT=1698410156:S=ALNI_MZtiRx6lYLlfA8bMgvpi375NeG-9Q",1732106156,"/","download.it",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGsnQrR_7vBcGQybUgKgvOydpKb0LJoFokWGdm_v3fvaj","CJ_H2vCeloIDFdHrswodeF0G2w",null,null,null,null,null,null,null,null,null,null,null,null,null,[null,null,null,null,"ca-pub-4515672822323741",8,null,null,null,null,0,0,[["i-fvs","true"],["stop_word","ad choices;adchoices;advertise;cart;checkout;conditions;contact;copyright;desktop;disclaimer;faq;help;log in;log off;log on;log out;login;logoff;logon;logout;member;menu;policy;privacy;register;registration;setting;sign in;sign out;sign up;signin;signout;signup;site map;terms;top;install"],["qid"

                                                                                                                                                                                                                                      Chrome Cache Entry: 1917

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5332
                                                                                                                                                                                                                                      Entropy (8bit):7.940902992534038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:WyUY4CDYlccF2kUpU9xti3cVySA6qCpllK4Y5Pj+lhGQqr/6gI:VGC0ccF2kUUxtispAnR+I/6gI
                                                                                                                                                                                                                                      MD5:6127E189F833E6031A2D47076EAD000F
                                                                                                                                                                                                                                      SHA1:43AECAB077435B99059FC6BFA071F6EA963262EB
                                                                                                                                                                                                                                      SHA-256:70EF113B15C3C4C7494ADA490685B1A369582029BD19B79F2802B21B1371893E
                                                                                                                                                                                                                                      SHA-512:94B01E53F671F9CE016D4A690F9B7781ADE3FB38DFCE57A3580E9F290C3A5C21BAB0EF54073D19C3EEACC07E5F7DD35E5189193DC822B7A12E5BBC0349E43B5D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..._IDATx..]{..wY~....3........K-PK....*..%1.`.xAA4&M0@......FEI...... B..n.H..j.Pi.1.[....ngo3.|..}...}..93{f.Lw.9..=..~..^..y..7......p.>F.N.V...u0ig.2....?.G..bM....Y.v.p...]7<.].._.....k.....[...`.......1k".[....L....,.,.....M....YkV..........}.53.Y%'.}sO..l5e,$.*.-...U5.....S$/.,o.v..)..2$.)%I$.S....H.4...deI .e!.....^>n.....j.......j.Gh..7b..a....UU.H..u..YVA...?x...r..c..Md....P.<C..7.52...^..A.s..`916c......O.f......./.T.n..W^....7+.L...1k.)..........m),7..Pc ........$Z`..?..c.....QN...jj..(...._;.....h).*.n5. .Rh........O}..H.$.4..S..X..9b...;:.a...~...2r*$n...@....\5[GF.......PZ...Z.........[..I.(1..ZQL...v .$.`.H8..)....YB.......t..../h........o......a5P..;..g.".[.M.f.2}R..<).X.H...4.X.....K.T.l.....`...&.YQ. ..mS...-..I...q)......(.4.U.3...d.E.....*.^...Ls..H.DD.E...6.2.Mr..R.J......0![..!..Caf...P.."U..)....q.iY...b.....%%.\]h..%h.B..,..I.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1918

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6581
                                                                                                                                                                                                                                      Entropy (8bit):7.964810614782834
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:yaPU0B1CQhCK5+ANELIZ9vXsA3mwSgJb2gdOeQNjhN:FPHC4CPDkvcAD7pHdNQnN
                                                                                                                                                                                                                                      MD5:2537AAC0863AE03DEF0B7896BB4B367E
                                                                                                                                                                                                                                      SHA1:8C58AF874AAC091A3B4CF2E23FF6FE9EFA457134
                                                                                                                                                                                                                                      SHA-256:F7769A97DA2C7D5354B40055EAA2AC78DD969E09D52D07E6D57637C22A02EB3C
                                                                                                                                                                                                                                      SHA-512:3229390760E494E66F09945094D25DD97F2BAFBE14D28EFD42538302F9FCC0FD755DFE399A1F47FE45F8242C34DFDAE9F79D7F5ED081E13CC9604A9961A43FD4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...@IDATx..].x.U.n...$.....j...q.....d.q... .HB...{gO.......(#...;*..(2.<#>..$.......{owuu...tw.<.........s.s......z.....J..>..........A.&.......}.^.....?...<....P...F.....0. p... X..0.*X..(..Y......m4.?....h....g.]..[..#f.gZ./\.'..'....!P1.-L?b....{f.......xvO?.3.........7..o.Y=:n.o....L....7.....D.?......$....$...^$...C+S.S........e....j..@..........._H..................n=A.y7 .....2.....].u]2t.o.U..eY..P.t..,Y.....u.......<.P.}.[..F._R..B'..if....v.-.~......Y/>mbh..Rk.@2KBx.....e.we.....=.......Y.e)....j_8:.<1."%.21.rmx}.s...A..@.A...$Y..:{"rWA..cw.G........,J.....).....gb7.E.N.......5...r....}...:.S.`...v....`....{..W.8...4TH]1..t.W....P.7J..t.....5V..> .-.k.B..]..C:2....;.5u..]./JV.=*.BD...uo.65.$y.6c\u.....9...$.<.h<;N..^.eY.w.D.....Q..Fud.wdo..MY.yI.......O.|/..#.,elI..).......E.?0..]MoK.sxDq.........H....3|k..=%.]..x....+...^...[.F.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1919

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):186583
                                                                                                                                                                                                                                      Entropy (8bit):5.828483518055583
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:Vyz365BTG3FnWzCjH5WQ7eK1gIa5OFsU7sdz/jomCjlxahLRO/Pmu:Vyz36bTG3FkCjH5WQ79gIa5Ysksd0mC5
                                                                                                                                                                                                                                      MD5:48417FA1C3DF035BBE33C42C358B751B
                                                                                                                                                                                                                                      SHA1:F35FF9DD415AF0584CE3BE25B3243CF8BBF3F3A2
                                                                                                                                                                                                                                      SHA-256:B346358963230B6B4C29561C75949A30BB523E5AE05289F0831BC8F9B965AD16
                                                                                                                                                                                                                                      SHA-512:88E3B066B6BC01E1A068FEFA899DBE6CD3C2A18499E418270B7B8FB35DC6F005791EDF02EA8B81872FF5FB770B799830D7516752372CB8B49EA1C8C497BAD116
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_OOP_Interstitial":["html",0,0,null,0,853,1017,0,1,null,null,1,1,[["ID=ecf744bd90888695:T=1698410158:RT=1698410158:S=ALNI_Ma8iEruw9y-ZQ3h_d5J6394Y5uaNQ",1732106158,"/","download.it",1],["UID=00000d9cf0ab8d39:T=1698410158:RT=1698410158:S=ALNI_MZaVSNZReulKdapZIahuBQ_ay8ssQ",1732106158,"/","download.it",2]],[138337886745],[5598400973],[13617419],[327760139],null,null,null,null,null,null,null,0,null,null,null,null,null,null,null,"COzYx_GeloIDFVP3swod8BEH4Q",null,null,null,null,null,null,null,null,null,null,null,null,null,[null,null,null,null,"ca-pub-8132844949421936",8,null,null,null,null,1017,853,[["i-fvs","true"],["stop_word","scegli tu;scelta di annunci;pubblicizza;carrello;check-out;condizioni;contatto;copyright;desktop;disclaimer;faq;guida;accesso;disconnessione;accedi;esci;login;logoff;collegamento;scollegamento;membro;menu;norme;privacy;registro;registrazione;impostazione;sign in;collegati;scollegati;connettiti;disconnettiti

                                                                                                                                                                                                                                      Chrome Cache Entry: 1920

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11880
                                                                                                                                                                                                                                      Entropy (8bit):7.952274784576122
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:l7RJZfGBI0GRcTqKCekvqDpLWpxkeDwoQ8FhED8v6KeIiFlcLqVx4MBRG9P1zGL:l7RndPcWZdepagSwqSsbyjYqLL61iL
                                                                                                                                                                                                                                      MD5:21D324A444E3EB36C801D03B08314D4A
                                                                                                                                                                                                                                      SHA1:9B0D8E0AB63831EA80A5945394115526814F06A8
                                                                                                                                                                                                                                      SHA-256:40DCC902295CA4997F793481E76E3CD4F9DE8183827885E3E5B568920F9CA9DC
                                                                                                                                                                                                                                      SHA-512:9B8A69C574910909D8214E77DB2B35491543A0333C91312C3A70BA3F61A18A948F09192AF01144AC9D6C29526AF5E3A630F11D27DBFF67FFE3F44A9FFCCF0C26
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/winrar-64bit-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF`...WEBPVP8LT.../c...M.m.6pV........O@..6E.I......?.}.....1..q...$)......".2..@Y..H.$.I..Y.4..y...$..N..IR$..i..8X.e...R(..x.........z...M.l.....X..BE....)n....v...........j>...0..c...-.........A......T~......]c..t.5.i#R...iC'.&8..=.. 'daS{..E...z.......X..0...*o]i+...N..|.P....Sw;....P)...Z........D".. ..#.H.........$I?I...m..?.m?....v.,hJm&Z..bS..<...8.}..RPR.w:.$.*.....H....=......$I.$I-zg..w...Q8.r#I.$I.....T\5....I.$.-IB..}....9..l.6.......9g)... <I.$.-IH..9......$>.o...={+..$.m.....|....,.....k..Z-...Y..D.t.z.O2....%.d.....y..?.I.q <.<Z...E.C$.Gx........Y.d.m.2.(...{.cLX.......7.43.].{...Z...[.$.vm.2..j....cq......K..z..s....F.UU.Gl...c.._#.e....lkO..'.;.@....2..%....X.5./b _.@._.x..4.....D@lIM.....Yb.K|...[.9F......^3.,7......n.I...,..l.{J.P61...'...7...g..1.._....^.}.n.1f..9h.2.@.....d..;..g.._>..._.e_]_..O..G.0..F.o...._?...o.r...e...?.X.....{....._.......\..[.&.8.`i.`...l..7?..]..uQ..t..].....s....B.2.,?.........0.........~.....|

                                                                                                                                                                                                                                      Chrome Cache Entry: 1921

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):668
                                                                                                                                                                                                                                      Entropy (8bit):4.979421659625902
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:Y/QaKd4zW8gajmkjfwtwwUVYqcX3oYstwwjqq3Xnz/io0rp:Y/ppLgNkjfyUVsYYWmqnnz/io0l
                                                                                                                                                                                                                                      MD5:4C246727DFFF3069A5FF61B880669E02
                                                                                                                                                                                                                                      SHA1:316EF4933CB5BA7F537FCD4F14A504A918664AA4
                                                                                                                                                                                                                                      SHA-256:01B08A795EFF4BD810197E432AFA9401380FCC418D40543C1407C5345966C8F9
                                                                                                                                                                                                                                      SHA-512:6607904ACB8C9C3A0D0A7BCAD30FD0420BD0BD40F12FC39912738D816DCA4E7472ADA8F8289AA5DE203D9A7BF477AB568E59E4EB9A9E23510A944D296D0CD591
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/gampad/ads?pvsid=343331062718654&correlator=3610464042138560&eid=31079134%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202310240101&ptt=17&impl=fifs&gdpr=0&trt=2&iu_parts=5302%3A22764537101%2CTD-desktop%2Cdownloadit%2Cdownloadit-it-defaultpage%2CATF_Leaderboard_Second&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=980x250%7C970x250%7C970x170%7C790x250%7C750x200%7C750x100%7C728x250%7C728x170%7C500x250&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1698410155287&lmt=1698410155&adxs=44&adys=98&biw=1017&bih=853&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLFtdLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMTcuMC41OTM4LjEzNCJdLFsiTm90O0E9QnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjExNy4wLjU5MzguMTM0Il1dLDBd&url=https%3A%2F%2Fdownload.it%2F%3Ftyp%3D1&vis=1&psz=930x0&msz=930x0&fws=1024&ohw=0&ga_vid=1995881029.1698410155&ga_sid=1698410155&ga_hid=912521144&ga_fc=true&td=1&topics=9&tps=9&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRjqmYmJtzFIAFICCGQ.&nt=1&psd=WzE1LFsyLFtbIi81MzAyLDIyNzY0NTM3MTAxL1RELWRlc2t0b3AvZG93bmxvYWRpdC9kb3dubG9hZGl0LWl0LWRlZmF1bHRwYWdlL0FURl9MZWFkZXJib2FyZF9TZWNvbmQiLFtbXV1dXV1d&dlt=1698410151758&idt=2908&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dtd-topbanner-2%26hvi%3Dfalse%26type%3Dtop_display_leaderboard&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26compliant%3D1%26ad_session_id%3Db6413f29-c277-4fb0-8970-dd98c320dd64%26pv%3D1%26ab_upr%3D7%26segments%3D%26personalized%3D1&adks=135233075&frm=20
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Second":["html",0,0,null,0,250,970,1,0,null,null,null,null,[["ID=0fdc66d1f8ac8cb9:T=1698410157:RT=1698410157:S=ALNI_MZRdGIz-nKJ0k8_76ZQ7GYdo9-WCw",1732106157,"/","download.it",1],["UID=00000d9cefcfdc57:T=1698410157:RT=1698410157:S=ALNI_Mas9lFx9paYGQocdROztWuju1aO_Q",1732106157,"/","download.it",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CJP74fCeloIDFZLBswodhyEOAQ",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"3",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1922

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):14102
                                                                                                                                                                                                                                      Entropy (8bit):7.979974522027534
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:vu4M1VSoEXmzv+hGTMtI9/2x2dydjLIqgVbvmpN9XCWGCBHk/YF6+8:XMubXKm4gG/ZdonIqgBm5dS/YO
                                                                                                                                                                                                                                      MD5:C9F71667B6CCCDFD542F0509049C31E3
                                                                                                                                                                                                                                      SHA1:6D32654BA7F89C44468E94B6992C2CBEDD808F5D
                                                                                                                                                                                                                                      SHA-256:9F536D5DDCBE0A69DB3D15B99DCB17F8809E3D04973F53C935C32712973A0185
                                                                                                                                                                                                                                      SHA-512:D4B27B3AB5AE777C721F9AE1E23D46707F610A5339CE9923D1C725A2404C2155FF7B316F65500473ADEDC72A24E3D06903DB0C77C38E9A439475C7B7FE19ABEF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/internet-explorer-per-mac-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.7..WEBPVP8L.7../c...M8h#.T..qj....!....eF1 .e......m.U...NZ....O..T..~..j..U..... .e...q#I...{.egB...Z.E'...*+.....~...BME.../.#.V.y8..........V.....BE...B..(H....d.f..W......`...-.......+..t..X...[!G.z....R.Q..A.v.6.$.X.y4#/7/d.3:..0...._....dB.^.%....?.."...N}J...:=T%j....HW..HU...r.b/x D.fr.1 .. QH..........W..Y...I$M.\..x.P.v..,.@.mR.g..CDL@.j...j...6..M..C.6zeC..2+eT..BeL.Y_.#.Vm...\j...of.h......[.f....Z.%'..Z....%I.$I.-dQ...Wv.ffU.....$Y.m..Jm}mf.....c.c..z+...Q..3..,..lZ..qp..YY].m..jl.g.....M/.m..L..|.].G..'[{.I..d23.......4.{....33...M....].dVDF8...G.E.l....37s..H.....C.WJC....0J..L.h....5$f.....n...E`.m..&I{_.}?..../.m..5........m;../...yn\.y..$Ir$.-Q3....h.....W..'..Z.......n..$Ir,I...{......~.A..&....A..|.n.....=P$Q....P.t..... "&`...6.i..!..Lbm.03..+.".B.W.%.H.AB.HX0L.h...s.7..3..... B..P.&..%.rb..P...:).dpP.....>......*.Y.M.........CZ..H.&`......!t.p..6.N`..Q.`.M.Dh.+......2/%.jqA0@.dJL..3.......@@A.%c),...Y$tg.b...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1923

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7447
                                                                                                                                                                                                                                      Entropy (8bit):7.967591030870953
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mCfneNqwwHlfKgsvYf3cUaj4tvZlCxJmfA9VNgRT21:mC/yq/HxKgEYfsUajxxJsA9VN91
                                                                                                                                                                                                                                      MD5:1EE11CE54E4DF824B0BC767F207E134A
                                                                                                                                                                                                                                      SHA1:ABCF239782788362653342E11187F11126088DFF
                                                                                                                                                                                                                                      SHA-256:719A0B74E300CAA19D52E3C081617452465C3DD02D1D888AE63F6BD445EA4697
                                                                                                                                                                                                                                      SHA-512:07B2BEFD3866F92290D79D9BA5D2BBD7F749BA3EFECC9DCB1C705610EEB88579BD7299D842871024D7CD4FC5E14A0A1D13EAA3394955CFCDB7FDA4E8C9726E6F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..]...U...RK/.ef..I......vB.. . .,..)......6|....y...r.*....D$".$.(.@X..!.$..=3.]]U..w.U..==k&3y..:5.U5U......."!...2.......g....4W.F.LY"......h....u.f..Y...#....P.....Q..^.w!........U..S.!.c.s..#,!S...$.!X.N..d.....a.DG.{.|.v"e.\.!....0.... j....A.B]JT].....ZF....XQ....>........a.$.).. ..9.d'.%.........!/.o.>..6.`U`R......}...$....*.........~.... .......f.n ..t/.{,.......M..[sB..5......n..J.1J..I`D..0.....}..3....<..x..f.+bQ...X].#L..Bm.......C.......B6..I..&9........f...0X....}_.D...1.vs....w.?U...._..60.qEx.<....._...`.."...\y.u.......(8.8d..*.."..`...>>...1.....`.K...}....[\..Z.#.....*HF.*rV.N&....b...x.c+.'.e.. I..Po..}.1..D...]r.`..E=...].B(...Sd.x.....?{...V.k....A.'%,...8..^...-+'..*.a..a.....i.Nm8.8.....H./<...0.$..8.4'..g....3.......F.-..3.'.)....fE1...).~.~....q......0.&.8.)0.......\.8.....V[.f....b.....`...X...r(EPr.. .z.y....~_z...2.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1924

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):17769
                                                                                                                                                                                                                                      Entropy (8bit):7.977968248575907
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:B4kjna+7SYcDTic7gAAoFp/DapQ4MKOZ4OUrThasQhHaw:BRjna4SJhzAwJacKS4OTH
                                                                                                                                                                                                                                      MD5:27D1EEFC24F851D3B896837D9DFC6BD5
                                                                                                                                                                                                                                      SHA1:F3EED584532304B2F445D0A3E39A17EBE2463FF6
                                                                                                                                                                                                                                      SHA-256:4CC66390494E9CE807B7718D7DB7A46127ED729EB405B9AE7790A2E0D871C2AA
                                                                                                                                                                                                                                      SHA-512:73A74C084DF9B78786E5AA3760573D79FBAF381BA85C6A48642A93301DFDF1CBDE993060CC193395F3A508EB3C9EDCCB6C5D7D11FC580221C53A30950334389E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..D.IDATx..W.eY....>...H_Y..tM.tOs.H..l.3..f.....r.D.......~.^D....K...xr....e....q.oa.....=2M..LGF.q.>{...o}.j.cD.o.."F8.0~.~.W....F1b......!.1|...}4.k.M.d.:.).<F.Q&p..3%q$.....<..c.#A.8b.....7.0..a.Pzk$..d|C...ID......p.... ..M..o.....(R....:.\w..#.....v.r...../...I...e.q........."..p{.c.........5.~V.....7..n.....2.......o.z./*.k..G....n.>9Y?{......4.&.......x.....L..$...2.......v.y.....~...j..o.O..V..7F>....>.gY.....;........pDb..R1..)f1.OV?:....../..0P....Z.#A9A...;o<........N......I.....S=n_....^].O...*..^.q.P..X,..0.l..O.?..o.....W......P.......O.O.v'...r+J..j...}D.`.....JZ./fw..w.z......c....B..H.u...g.....q..tW..5.k..M.-r...g~...g.kL{.".H.....|._~..=9.Q?lg.zykY.y9-)..i:.w..@...a.J....jP....._z._|..{.-.i.......I.".v.~zu^.!.j..W..3I!...L..... .PzK.i}.D...6........]{.vW..!...l..'.|Y..d.k..V...z.`.1...a.."..>..|....W...7..c....`O.z=n.v...|.k;.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1925

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11272
                                                                                                                                                                                                                                      Entropy (8bit):7.964732755133301
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:j3mQwoXEJ/OpAFvESa5fszG27/KEt2qjgNPNf2+ocYw2G7e97kuAugFYV:TmN/OeVEnKyTqjg/f2+odyeRktugF6
                                                                                                                                                                                                                                      MD5:AE99B9E28E7A4DDC6E3CC82F6FE1F5BE
                                                                                                                                                                                                                                      SHA1:DAB65028D7EAA3D20BFF04ABB1B2F8D3B0E9B5EC
                                                                                                                                                                                                                                      SHA-256:EDF0785AADDF0402A4C810E4C45964DE1C31A17FAD960582C3B6E67C29F6298D
                                                                                                                                                                                                                                      SHA-512:1D39B3A21B4C41CE3BF13F46831541BD99A4588A7C83E4FB9DC3E97752A4CFFC340C8C35CD439420B0429C7FDDA24866BD7F4C19F2BA7B0C1215DC7FC0B7D12C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..+.IDATx..}y.\.U...Kw.M...,Y.-k..8v..$@.*......!.PC(..f..a....a(..j.a.*..-....6.I./q.y.e.l.,k}z....{.w...}w..'.f!]7.S.~..=....;.s..*./U%"UUUR.AU.+D..%f%r.e.,/.. ...D.U...[g..."...... "U......8f6lld.H.i.3`.%fff.w..@.I../h.KU..P...q.........x.-..J.p...,.LHE..E.d..0T.o.W..pM..../m...J.`..Zh}ve.bi.7.j.......n'.aQ.,..c......jaU:.^T\Q(....;.j.._>.w...G.?r..3Q^.....bRQb".JR...N.....A.D.+yL..~.......j-.Vw.("kb.c......%...z.....,Mz.c.[c..6A@..=..AXMI.=X.9..(.C..>.../~%..d.:p...D...d...*..*.b..(.(....*.....2.....4.....M.%/3%...$bS..z..v.o{kr.w..o0.Z..Zk.56.....nP.$%*.9e.............?$c.Po..%..7[..e"....J^....!@..>...$QT.A..N.EAk...."._...@P..P..0.D..T...l..^....|...]kl.Gl....X%/....8.....>...?....'AF..U.VF......d...k.....x1.6LATj...RS"S....Q....J4..Pf6.\a.{.n..w..........$.....j...]D.+rU.v.....3..4?u..D..Q.>.R.J.%(..H'....o.=....*.TiO~c.h .....b.<..~.{/...6o.&I....c....l

                                                                                                                                                                                                                                      Chrome Cache Entry: 1926

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12292
                                                                                                                                                                                                                                      Entropy (8bit):7.9512600752517715
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:Nny8BxS83FPEYXQh38+ioytCsi3b4iRvqkS0YUD9:N3/3FUh38+zeiLRRGi9
                                                                                                                                                                                                                                      MD5:0E03E99F96A0818755D4B26D5DB4D9BF
                                                                                                                                                                                                                                      SHA1:0E6A922820E763E2194484109983A895F57F9B9C
                                                                                                                                                                                                                                      SHA-256:E3C40B76A23E9BA0564BF9CBC992204763C42821897A539A32FA5E18942CE5DC
                                                                                                                                                                                                                                      SHA-512:78BA399A9EE14699713B7A0B214677716A7F66CB420B395B8BB4698BE388CA349F86EC97096F8C2D28FFDF5BA59563EE0C72D09BF6E0B3A34A17EC642C71CE1B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<../.IDATx..i.e.u....{..o...z.K...8t..C.4ME.e...H.c..,@..'..X.._A...l@...%..DY.(QR....k.W..;.i.k....U...(P..7.w..^k.5~....].. ......................7n*..s...;@.......|..Dpp.P#8.R...4..........)....o......N..}..A& .....K.h.._...S$.?m.@.. {"...j.......u.).S2.*].5......1....G..C.,..R.S.dO.D......Nuv...3............@dO:.Dh..X.....k@..1...&.e.&.../....|!... .0.1"!P........(E" ((...B...Wu...]A...(x......x.Bd...... .[.B.Z........ @.F.d.D...l..m....Xi..t.r....;.._....g&.G.-..N..((.....v.z(..F@P..&..xs........}...^.~.,.]O..H.L.."..".,...gk..N.A.QDD...l...s'...]..#.5.f!(..<#..".J@...DP..8..8.....kW.c.(.@H.$@..B8{.r.wW.....xjh.... 2"...C.DF!E......#..b..3SF...".I.;.......SQ.:..(.`..$...Ia....Ab-K......U.G..:..F..n...`..T..!..j-.6*'..x.. . ..m.7/..%........E..=.7....F.....T...$.3.0.0.C.F...q`..].X8.L<.."DpZ...ZO...].A.. ....X...89.QN-..@'K...9'...+[......2A..N..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1927

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (30062)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):100682
                                                                                                                                                                                                                                      Entropy (8bit):5.480442581835999
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:1536:PfrpiyUxUILifHnEuSZKRLsINoqqG3uISdkIhlPe2J6C28rW1G0+:nVg3LinvSgtsMoqp3cdkIhZBx
                                                                                                                                                                                                                                      MD5:E1E675A2E133AAC4599785E5B846EAFC
                                                                                                                                                                                                                                      SHA1:FF077E399851F67D83C7D2E413B14ED293B39278
                                                                                                                                                                                                                                      SHA-256:AD574CD8F4106D7AF8CFEA351BBDF5B9F51E9FB8F8F3A8CAFCD4E4459BB0FEE7
                                                                                                                                                                                                                                      SHA-512:12DB84DC422BD39EAC7CAA11DF2F512E46E10F3A31A34454BC8094395DEE52194D489FECF7B67A55D780D49B5C21C5A446B9BA99431C873CD0521EA581DDF1E0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8" />. <title>Topics Frame</title>. <meta. http-equiv="origin-trial". content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=". />. <script>. ./*.. Copyright 2022 Google LLC. SPDX-License-Identifier: Apache-2.0.*/.var m,aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a},da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find

                                                                                                                                                                                                                                      Chrome Cache Entry: 1928

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):165724
                                                                                                                                                                                                                                      Entropy (8bit):5.748058677514723
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:LUymJKIri6fB5Mxw48e4GMyOIXCJuHugfqtsh7ozja5Haj43jmug:L1W3ix3OIdugi2hUwzg
                                                                                                                                                                                                                                      MD5:63ABC27C057754AD3871C6ACCC4FAB4B
                                                                                                                                                                                                                                      SHA1:037D0CDB412BC6EDE04CFC715B26B8A55BE30309
                                                                                                                                                                                                                                      SHA-256:7DC9D409947667D770BBA8F1AE6F9ADF03B54A4F3E1ACB9B24BC92B3DDE59509
                                                                                                                                                                                                                                      SHA-512:629366AC48E5B1857D6AF0780A2E252E5D596128A48AE76DB5B8C268DA92D56BC250FBB20C95863F9160A835E53069169D87855C7A50760A0FC28E1ED66433CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/gampad/ads?pvsid=343331062718654&correlator=1872723317613884&eid=31079134%2C31078663%2C31078665%2C31078668%2C31078670&output=ldjh&gdfp_req=1&vrg=202310240101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&trt=2&iu_parts=5302%3A22764537101%2CTD-desktop%2Cdownloadit%2Cdownloadit-it-defaultpage%2CATF_Leaderboard_Sticky_Refresh&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=970x100%7C970x90%7C750x100%7C728x90%7C500x90%7C468x90%7C468x60&ifi=4&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D0fdc66d1f8ac8cb9%3AT%3D1698410157%3ART%3D1698410157%3AS%3DALNI_MZRdGIz-nKJ0k8_76ZQ7GYdo9-WCw&gpic=UID%3D00000d9cefcfdc57%3AT%3D1698410157%3ART%3D1698410157%3AS%3DALNI_Mas9lFx9paYGQocdROztWuju1aO_Q&abxe=1&dt=1698410187904&lmt=1698410187&adxs=24&adys=870&biw=1017&bih=870&scr_x=0&scr_y=0&btvi=2&ucis=4&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLFtdLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMTcuMC41OTM4LjEzNCJdLFsiTm90O0E9QnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjExNy4wLjU5MzguMTM0Il1dLDBd&url=https%3A%2F%2Fdownload.it%2F%3Ftyp%3D1&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&psts=AOrYGsnQrR_7vBcGQybUgKgvOydpKb0LJoFokWGdm_v3fvaj%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1995881029.1698410155&ga_sid=1698410155&ga_hid=912521144&ga_fc=true&td=1&topics=3&tps=3&htps=10&a3p=EhsKDGlkNS1zeW5jLmNvbRjZp4mJtzFIAFICCGo.&nt=1&psd=WzE1LFsyLFtbIi81MzAyLDIyNzY0NTM3MTAxL1RELWRlc2t0b3AvZG93bmxvYWRpdC9kb3dubG9hZGl0LWl0LWRlZmF1bHRwYWdlL0FURl9MZWFkZXJib2FyZF9TdGlja3lfUmVmcmVzaCIsW1tdXV1dXV0.&dlt=1698410151758&idt=2908&prev_scp=pos%3Dtop%26countryCluster%3DA1%26td-slot%3Dcustom-stickylb%26hvi%3Dfalse%26type%3Dbottom_sticky_leaderboard_Refresh%26refreshCount%3D1&cust_params=medium%3Dorganic%26campaign%3D%26source%3Dnone%26medium_campaign%3Dorganic%26medium_source%3Dorganic-none%26compliant%3D1%26ad_session_id%3Db6413f29-c277-4fb0-8970-dd98c320dd64%26pv%3D1%26ab_upr%3D7%26segments%3D%26personalized%3D1&adks=47427054&frm=20
                                                                                                                                                                                                                                      Preview:{"/5302/TD-desktop/downloadit/downloadit-it-defaultpage/ATF_Leaderboard_Sticky_Refresh":["html",0,0,null,1,100,970,0,1,null,null,1,1,null,[138327306593],[5332046802],[13617419],[327760139],[434442],null,null,null,null,null,null,1,null,null,null,null,null,null,null,"CP7ukYCfloIDFQ_yswodwTkDYw",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"4",null,null,null,null,null,null,null,null,null,null,null,null,null,null,1]}.<!doctype html><html><head><script>var jscVersion = 'r20231025';</script><script>var google_casm=[];</script></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>window.dicnf = {ebrpfa: true,};</script><script data-jc="40" data-jc-version="r20231025" data-jc-flags="[&quot;x%278446&#39;9efotm(&amp;20067;&gt;8&amp;&gt;`dopb/%&lt;1732261!=|vqc)!7201061?&#39;9efotm(&amp;20723;&gt;:&amp;&gt;`dopb~&quot;]">(function(){'use strict';/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var q=this||self;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1929

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2838
                                                                                                                                                                                                                                      Entropy (8bit):7.917685968871843
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:ZOD4PToDI+hCW7i8AOlD45ZYBBHLmmRqmz2qN+bLzM3vQ0VjUoRi4z1swyPLPchi:IDEoDI5W75ASL73R+zEo0xUog4zByTPF
                                                                                                                                                                                                                                      MD5:EBA7414A3B3AD1493B0127E7A04D9F3D
                                                                                                                                                                                                                                      SHA1:998AE5C98685F9F49634982264D0476AB8595662
                                                                                                                                                                                                                                      SHA-256:7B77DA87BDFF7FC3DC24280CB74BEFFCC9518C820AED50998281A2B9146E0F67
                                                                                                                                                                                                                                      SHA-512:57BA8F8A23CD9B391B2A78CE77CE05298F6E0C2591AC9020CBEE3B2BD580708E9870E7D42A04BAC34BBB2024DB3DDAE37567E32ECB987179D1CDE035E0686D92
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/kanix-play-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c.......m..?.. "&..........]r....t....m..m.m'.....3..]@...w.g..:<[%.I.,!..al..La..Yk.F..`........v..6...5.).}..r..m...?..FR.e8.....m.u..v..U.zuW...m.l.6F...m..m....&}..,......4:....C.. N:....8kg..alm....J.m.t.{.G..m;..m.m.m.'..Q..!..4:..]..............)...........n...6p..:.............c*@......o..(PXF..,...Q3.B8p.hP.....!....H..tXd..c8..$.......\....XET."/%...~.8J9D_.D.f...KI.... ...*.^e..G.oE. ..hB.L.P..../.........}...s.......m.....iF.hC4'Z.$...n."..'.g.`.K.N..`.;.........j...f..Z..m8..dt...w..yb...N._:)0IT!......j........;..+.z>t..?..4.T..{...Da.z..n.<_.....|..m..4...B.zj`Q.....@.V...>.-.{..#......oZ..C...j0Io.....F..tQ....hG....Q.".#.....e..r.6...8.dE..q[.MuI..1.(..2`B8...n.z.....s....#@.0!4f.5..<5.....o.i..^.....dt.oGd..y<q.8......Rd.......k..Tn.....ns.\..).~....L...;w..|..q.;L...a...LS..FN/.:..d.r.R..K9...y.l.R.2....vG../...SV...:...X..y=..8r,`.H.a.;. .:.v..L.....H..n@.....J..E8...B.(......a....>.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1930

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):27980
                                                                                                                                                                                                                                      Entropy (8bit):7.982740096077441
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:qOpMDtiVr/DP3rmG7zOapywT+b8spnTB7:q2MYVnP3n7z7ywT+4SV
                                                                                                                                                                                                                                      MD5:0AC49BAA1C92796E3E29179EFB0A6F05
                                                                                                                                                                                                                                      SHA1:6EB5F7C58CA938AEADD2A54EE123A29AA6B7D557
                                                                                                                                                                                                                                      SHA-256:A09AC6D73837AC350123442D47142F336AA1BAA9D5A95D53F4A79893C311A467
                                                                                                                                                                                                                                      SHA-512:BA7DC8182FA7FFD07D3CE03218682C685FEC52AFBBE7AD069B2B585061D860FD7B499443D41849B952CF88D16B92D92209715AB4BBB4213255541B9D872400D9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........5........................................................................]...}.m..:..Y....s.....1.}d5..^...7.N.......3..Z.+kxp.\Z-.So.o..&k.3.*....y..|.......L]{T.J.G.].g.9..l...hk[..k.H.sx...Z.V...OP....Qw.WH......v:^.....}.>.;m......k....r:?..= ..:{-.&./*6\.."..s....~..I.....o*"c....L.<.I.,..J....,..Of..=#.....D.ymY.=..I.......[.x...L6t.z.R._nW....^.........{...1..,.E<.......V.\.T..NC..cnY.....s....g<{..|.\.._D.c..k...Wm_.......s..(d).Z0.R...].{.....3.....m..9..+y. .......-......^.c....p...I..<.(.-.R.[5.+...=g_.~.<..;1t.q...6!k.V.7.IN.....q|....Z.o,^t. 1.......w...^...}...\Ry......>...m".l...C....%..#..I....\e...bN._Z..J...h..j.....]..+.y.X...Z...a8.v2.:z....*..V.:DDRI>._....=..gY.....i..y......,.FEq..c..CBp+.A[.}......i.......=....*.k.....z.'...z?..-..>..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1931

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):13012
                                                                                                                                                                                                                                      Entropy (8bit):7.963752835067185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:aNpCzsvbGtYhN7eISTqWjdCcIUlJWB3qteapUkEgZBQQ3fEiChxGkxqSW18Xn44D:aNpU+1pWZCEdegzBxv7UJqj1SDMO
                                                                                                                                                                                                                                      MD5:97D4AEAB104A97133017B5086B16F22E
                                                                                                                                                                                                                                      SHA1:02663BA34CEA135EDB647A10400D5E19A9BC5203
                                                                                                                                                                                                                                      SHA-256:C99782186F36F36D4A73CEB688B1B78BFF1917225290C41764C4910525BBC008
                                                                                                                                                                                                                                      SHA-512:8AC020DC72EE3CD96B229A5562C0D241BF875285E25FAE9250F222993ECC321350F7FDF14123B821595294D4101A81697248EC26802C99B11CD2B6E3DCD45571
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/assassins-creed-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.2..WEBPVP8L.2../c...M0l.6..............x.W.K~,...A.#;.>..9k.. i-~.$O..2.s..K&.}.=I.U..%u?......-....A$I..N...@...mU./'...p...Q:t'...Mp.!.B.*G.'....C..D...4..c.0!..U..7S.1".3!d...J. ..!.............aJ.......a......!...&...J.T.(h.`....u.R...B|-Z........t..-`.....(..`....m.$..z.O!"&.p".6T.J....J.e.0.).\.B.Jz....o.'C....SDde..3.c.5{.e.m....m..}...X...Bfef..$.l.D..#...Y...&M..>Wc0..*3...s$I.m.e..Z.sc\..M.$....<m.6..6a..e...O.m..-IV.c..>.0.$....$A....U......=....ct.4..$.$...<#....c=.Uu.0e.$Y.$...XDU.......]..7...#.."I...1"...w....Y\..NF..U....ffX.......@'..G..$.$I......../.L...$..~.o87..0....9)."I..=/....>...~.o...{......O....G...............i....S%..<.T..~fbo9x...h.M.....C3...K...gy....-..2..AA:..y....................}....@&.0r-;.../.....yL#..%.G..X....}.._.......w..}(...Y.S..B,.sR..Dr..Xs.e.0=M...)h...oW/c$..{.U....@D.q.........o.]...g.......@.a.H...._~..~.......0:.1`.!_-."..C.X...#...>c...y.W...:.Y...+..z.@..3-.W2..t..3.=\,

                                                                                                                                                                                                                                      Chrome Cache Entry: 1932

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9570
                                                                                                                                                                                                                                      Entropy (8bit):7.957853587749129
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:r4OpTGT4suw1J6YxnUVcdtrxmhoNmBBsZ0OHS5XEPxPxAw:r4OpK0svwYldd1EhEmBmZncXEPQw
                                                                                                                                                                                                                                      MD5:079287B25FEBD7475EA35C46EBA8C28B
                                                                                                                                                                                                                                      SHA1:C780DD3FCCC3F505204A8ECEA2AFF07614E633E4
                                                                                                                                                                                                                                      SHA-256:26B8810D115576B87D6C81F54143D5FA47AEB8979F6FF6C5B714CC2E0611CDB7
                                                                                                                                                                                                                                      SHA-512:5C4E56C525E09E79E047562D59B6A5FF6563D9B46817AE355EC8DE05268506910482A7332E69D6F89CFFB4EDCAB87494BDBD59D35ABFF1B0E43428341EFEDDCE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/seterra-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFZ%..WEBPVP8LN%../c...M(j.H.t...O.......Nu#&V.AM......$..z.n,(K]...w.}X....`te...S..m.6.3..m[u2..`../J..".t*`d8.$.Q..........'.?.....5.{A.u..V[P....._.i..u........8uk..~*oN...n.>..._...S..8.O....w...d.....5..o.}../3~.,..P..|...@Q.P.....BQ...R.@.(?(m-S.....aL..E..!.v.........x....A.).f.'I........8.?.........?...ADL..J...B`...I......@k[!.....-m.vL.t>...U........l.\.Kom.3?.3+.....}.#.}..6V.#Ivm+Yk_..o........k.Vm+c.}.O..w...i..%...p.p)...r.^3..m.H.m.v..xv....m;&I.....?"....m.....[[=[...f.3.e'...w..>.o.m...m[.m.1..<.m...+.W..h\Q.B`...4.....I.$....#".....Ycf8.\`N.$2....%.]....3##...En.)=....$J.l.V..g.m.m.m.6.m.6.w....$Ib......)I...m....l.m..AS.m.F.&g.{.......-m{.H.~..1%i.aff..#....=bf........j.....$I.$Q.y......F9.$G...57.;.y.`X8....6Rt...OH.u.!a\. $....../ .....zI..e....M......\..k|......N..n..d&H....o>..s.....L.0.. . ....Z...w.wY^...Q.}.<g...W.^-V.O}...0....7m..y......j.!....l.Y.%6..\...o.|..{..\...h..}.9....i....k...?}.p.|.......

                                                                                                                                                                                                                                      Chrome Cache Entry: 1933

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1134), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1134
                                                                                                                                                                                                                                      Entropy (8bit):4.867930815156351
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:sZO1PvTF787ityFyUFCXChOr/rXq8hD35XlGWzzD8b:sZO1HJ787iMy3XV6GDpXNA
                                                                                                                                                                                                                                      MD5:4904BA798FC6FC64DE8844CF9B43668F
                                                                                                                                                                                                                                      SHA1:F6211957DAE5164BD2DAF40F812312A5EA0BC83E
                                                                                                                                                                                                                                      SHA-256:9D35615D83672E5CEB1BF88FB84A9DA3A4C243148B10BEA4B651F624BAC3D674
                                                                                                                                                                                                                                      SHA-512:E2D346E832BA71EA6958B7592FA2C15354D3AD1FC4063B14A1DB6E50960F077836CA815F1206CC9B298C6A757C605FBD8825DA916557B25B76ADD141F36A10DE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/fontello/css/dit-logos.css?v=1695907987063
                                                                                                                                                                                                                                      Preview:@font-face{font-family:dit-logos;src:url(/fontello/font/dit-logos.eot);src:url(/fontello/font/dit-logos.eot) format('embedded-opentype'),url(/fontello/font/dit-logos.woff2) format('woff2'),url(/fontello/font/dit-logos.woff) format('woff'),url(/fontello/font/dit-logos.ttf) format('truetype'),url(/fontello/font/dit-logos.svg) format('svg');font-weight:400;font-style:normal;font-display:swap}[class^=icon-]:before,[class*=" icon-"]:before{font-family:dit-logos;font-style:normal;font-weight:400;speak:never;display:inline-block;text-decoration:inherit;width:1em;margin-right:.2em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;margin-left:.2em;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.icon-down-open:before{content:'\e800'}.icon-android-brands:before{content:'\e801'}.icon-down-big:before{content:'\e802'}.icon-icon-arrow-down-solid:before{content:'\e803'}.icon-icon-hellipsis:before{content:'\e804'}.icon-ok:before{content:'\e805'}.icon-cancel

                                                                                                                                                                                                                                      Chrome Cache Entry: 1934

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (5511), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5513
                                                                                                                                                                                                                                      Entropy (8bit):4.943039864717121
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:98l9f+VQ5T6AQg4jmVb5jxXO2F7aZ+a5U5qEQlxqHLD6fmKWFVFAe3PSzyML2Yn:GTGK5+ANXjxsZ+a5SGA3ZjvFAegLn
                                                                                                                                                                                                                                      MD5:97E8224FEAE287A17488068A939E94B7
                                                                                                                                                                                                                                      SHA1:1467FA58B32D69B93B0AADA8B43A137AAC8A7D5A
                                                                                                                                                                                                                                      SHA-256:39C1EA040FEF293C6F3EC05AF16A4653579D1FAFD007FDF4E55DB0EAC19939D3
                                                                                                                                                                                                                                      SHA-512:CEA55F250298B630D5111A5B4E44FFBC1437D4F86B56547AF34E8F6C1DB1EB0A27D3150CF65160131C59C8271859304C78114E789AE6B59DB8094CA315752BCC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/css/appmwshared.css?v=1695907987063
                                                                                                                                                                                                                                      Preview:.carousel-cell:before{content:none}.flickity-button{background-color:transparent}.flickity-button:disabled{}.flickity-prev-next-button.previous{left:-40px}.im-carousel-wrapper a{text-decoration:none}.im-cast-carousel-cell-info{position:absolute;top:5px;text-align:center}.cast-carousel .flickity-viewport{}.cast-carousel-cell{display:block}.carousel-cell.cast-carousel-cell{transform:none;height:120px;width:120px;margin-right:30px;background-position:center top;background-size:contain;background-repeat:no-repeat;border-radius:50%}.carousel-cell.cast-carousel-cell:hover{transform:none;z-index:inherit}.carousel-cell.cast-carousel-cell h3{font-size:17px;text-align:center;top:120px;position:absolute;width:100%}.im-carousel-cell-info{display:none;position:absolute;bottom:0;padding:5px 10px;background-color:rgba(0,0,0,.7)}.im-carousel-wrapper a{text-decoration:none}.carousel-cell{transform:scale(.8);height:268px;width:198px;margin-right:-10px;border-radius:5px;transition:transform .1s}.carousel

                                                                                                                                                                                                                                      Chrome Cache Entry: 1935

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14913
                                                                                                                                                                                                                                      Entropy (8bit):7.9464748365257405
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:bAHLJZQoXNmfjmh5vaoXedT5Q9zTJZL4zi6MU4YeA3CtmiWh0nnJ+aPDRcnr99NC:GQTfjuNao/n8D3s3mjhsJ+ar2dQdIO1
                                                                                                                                                                                                                                      MD5:7A27F66E17B378ECE938D68652C67E72
                                                                                                                                                                                                                                      SHA1:1BD2F2680DD34E6DB4A4A231320701EE750FB061
                                                                                                                                                                                                                                      SHA-256:172E951F323297FED40F21C004B503B64E950F9CC9564FBFDAC6943BCEA43BCC
                                                                                                                                                                                                                                      SHA-512:9E64D03688F25CB1E115D43D45F54D3DEFFB511CA73DC03E41126A49AAEEA7CE06381CCE8D86F14D1911DD48C3D8525150C19D5BC3E7A31F13645A780F420084
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..9.IDATx......}......].u...Y.53.x...I.I.g_B..j.4..... ..!$N8..B....!H..P..T..M...M..'i.i..c.g<.{...\.......L.Y.'H.^.....$...CZ.RH.(....&@...... ...H.l...@D.Zm...2.`.).;....%.6.$....k.J..5...U.z(..a..c..;g.]0....}..0.N+.,..n|v....`.<.ma.)U. ...jp)..w..R..l.!........i."...x....\[-.$.N.P...+Z/.....~..<.%......+..-...v>.TT..^J..P_z..-.6.$..L.......$.!3y....F......<......w.x...."T.=...h\RJM.0.U..`F.</..x.....$;....~._..E.....'+....m...Le3.....*..(.......d../|)3.]$..t.H.$...R..d...H..6LCw,..E...1../.=.U+.P.qu}.h..J 4.(Zr.:....Zu..Tk]....i.l.K..A..V.J)PLH.. .....1..(I~_f.mg.@|.l.2S.m...sI.N.K.>9.d.y..(...}[:..8....8.</X%..2..0D.....Z..6...|.6.Nl2mP...IBH..B.K.[v...$qI...6.".,.....&B!I..8.....pD.jK.....I2...H(:.....xrm.T.....0..c)gm..q..y......67YQ`...*6.)...v...0._.`.46....D.!$...T..`c;....)B.(2./.0.....=Edj..% ...@.n...d..vf...*.QU.Q.|.n.4...T.....jTG.J.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1936

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9078
                                                                                                                                                                                                                                      Entropy (8bit):7.961828259553641
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:u/LnUHTH9/CDatAmBPB94FsuFdiC184fs+nT8SfaKz:MUzgGtA+Pj+xF8Cy4HQSN
                                                                                                                                                                                                                                      MD5:ACCB53A31461776024CD101BA6F8DCA4
                                                                                                                                                                                                                                      SHA1:A9F38CDE2B5EE8254FBE4E4AA871BD57182685B0
                                                                                                                                                                                                                                      SHA-256:1D657191C13007A9843B5BD7EE8C92D1C082E8A2AE538B12EF65BBB1BFEC6B0F
                                                                                                                                                                                                                                      SHA-512:BF92F697A1E12F648D5E5FAB570095116BF3FDC1BAB676760E657D8B564DFE806273AD638EF25264FE412806C5817E866125386DA4FD7561234E5C1BDBDE6EDA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/free-spider-solitaire-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFn#..WEBPVP8La#../c...M@h$...._............u...xj...Vu..A.....i....j.B.....`.l..m..5m#I.r l.......I.$.....e.....p.#.._8Gm...k.............x...2.O...ie.}l.7DX..Z.n..X...._d.E.i.0/=2......>...QRn.&...E!.xt!..!. B;#..&>........,...x,i..D.....4. 66.......m.)..{..BDL@......!s...B........6.m..@Jl.m.a..=.{^~......{o%.:w.q....cO.$.-I.......N^u....j.w.b..$Y.......+.....@..(....b............'"U.j..G...X.m.m..m..i.....</.m[.$.....U5p\........s.....*2.oI.,I.l..U.##.....s.........m..1....b.0\.. .....B..pQ..!... .......'.^....~f..;....D.B..8..4h..0.C]tS..2.....= 7.ah.D....@...AD... .....+q.K ......>..K3H..Jb....[z./.`........@D....-...]..:#.....h.k...x:..8..|0{.....i...96F..0.=.].tn..b,..!..-......:./{.....Z....j..9.o..W....0utG...j....iH..P@..-!.E(..0....u...........J../.v[.^].~_~..-.zx.......~oz..rL....V.S....J...)te..)e..N.v$C...w...m.."...k...{Z..3....y.g.Im.0....e....,.$..9.#....H0....v..u'.!v{k.A#.taNa_..C..w..{V.....<.\}@....E$d..O..$.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1937

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1054)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2689
                                                                                                                                                                                                                                      Entropy (8bit):5.40021492400263
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:Otg7xBo1IN7Qa69Fa9FKYPCfmY/bZyf2jcju8m5I0zRHkFRvEJG:/N7QaaiC+Y/jcju8WhRHMxEJG
                                                                                                                                                                                                                                      MD5:9EF158292B617D358506529B02C73629
                                                                                                                                                                                                                                      SHA1:843852D8ADDBF1A7F96C5607179E1C9423ED8A4C
                                                                                                                                                                                                                                      SHA-256:3164DB7EF9EFC7121CE85192340A653C6CB87E34CAA05849C8FD47B7872F9FC5
                                                                                                                                                                                                                                      SHA-512:D4B0E6E8900043C9C4EE010ABFD00A51D891FE4B4F424418DC1A75075E3DF931D0558BFB3E983190079EDDD0BF11D7604E70CEAF119351690812EBC21D7EAEB8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://tpc.googlesyndication.com/pagead/js/r20231025/r20110914/client/window_focus_fy2021.js
                                                                                                                                                                                                                                      Preview:(function(){'use strict';function f(a,b,e){a.addEventListener&&a.addEventListener(b,e,!1)};/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .function g(a,b,e){if(Array.isArray(b))for(var c=0;c<b.length;c++)g(a,String(b[c]),e);else null!=b&&e.push(a+(""===b?"":"="+encodeURIComponent(String(b))))};function l(a=document){return a.createElement("img")};function m(a,b,e=null,c=!1){n(a,b,e,c)}function n(a,b,e,c){a.google_image_requests||(a.google_image_requests=[]);const d=l(a.document);if(e||c){const k=h=>{e&&e(h);if(c){h=a.google_image_requests;const v=Array.prototype.indexOf.call(h,d,void 0);0<=v&&Array.prototype.splice.call(h,v,1)}d.removeEventListener&&d.removeEventListener("load",k,!1);d.removeEventListener&&d.removeEventListener("error",k,!1)};f(d,"load",k);f(d,"error",k)}d.src=b;a.google_image_requests.push(d)};function p(a=null){return a&&"22"===a.getAttribute("data-jc")?a:document.querySelector('[data-jc="22"]')};var q=document,r=window;functi

                                                                                                                                                                                                                                      Chrome Cache Entry: 1938

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4115
                                                                                                                                                                                                                                      Entropy (8bit):7.9323641692452895
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:oxnIiIko4cwrweQJwSFYO+3/ZlItJI4MW4mIM+O4:oxIx8weQJwSWVZPNWB2O4
                                                                                                                                                                                                                                      MD5:8784BFFEECF446834D83B2C569A4E3EB
                                                                                                                                                                                                                                      SHA1:C365B61EC7036A99BE2C18957AED22F5A38E3D69
                                                                                                                                                                                                                                      SHA-256:5247FDBAB473362C660253E4923B3B33CCF3B53A0E18D7AE38DECA9BEF98D474
                                                                                                                                                                                                                                      SHA-512:6A1F300C48E730A8611946C140B77140FADAFA80518429F5AD119AF69D35E516A3CC40A952F63A1E4FAD3A32DF7E9A814590980429D4E0DBD148BCC25BE95513
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx...p........$..tR:.h.'.e....-. ..L.PJJ..f(...P..B L...0-!m)Ph'..P`.M..JKli....o;..8>.[.....O..:V.cY.A.............V.hp.$_)!(.*.*.*.*.*I.A.V.V.V.V.VIJ.f.+.Z.....b6iA.C&A*LC.a v.;5.......T.y....b...%\sq.M7v=pm.;;.`......w.}A.f...w.Z........S.......,.....4L.W...D.).)R..h.*.T..*t..Bn..+.6.N.R.E.%%.%...U...{...,Xc.. ."..U...\T....g.oV.%*.ddW.".Q9.(...{@\.`....F......u.T..1%.m./:..e..*.!...V........@.<......IJqX."c....h.....t.>.aQA7.zK.X.......\........_.^?'...4.u.Z.fG. @C.....`.._vu.]_.~.G}O.4.v\...4X.a.=.8..,.ZM3s...0..X....%X.....l.t..F'.HT.a@r&....g.r.. .....Y$^E5(D...cY.gn.~.%r..?.1i%.........oj....z4x.....f,w..R;@.= ........T..y........l.my.S ..T.8_..F..t.h_....7.8..Nc...~B$..Xe.C..j..,.2..f.y1..V...i{p.YQ.i).....E..,.~$6vo..e.!Z..Z<...,.D.....VL*...-2..._.....X...U.DH.,.XjC..e.....aR.W.i.i.../..].>k..G.X.s....@t,.a......3..L.d%/.%..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1939

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12618
                                                                                                                                                                                                                                      Entropy (8bit):7.97216934632035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:J5pZIPnNoAhD7SNBjOrODJ5q53XyOxO27PJZ:J5pZIFNoDOSnUiOxrPJZ
                                                                                                                                                                                                                                      MD5:A549F13462AB161F25E62F572F01EAB6
                                                                                                                                                                                                                                      SHA1:8B3BEF22D0E47EB79FB51FA3F763F6B093D7AD28
                                                                                                                                                                                                                                      SHA-256:D9B16ECD302A734654CA9D94B1678E64CB36B368458E2CA781C028CF2867B798
                                                                                                                                                                                                                                      SHA-512:F118ED48D54E47B9EB66E6CC6B231EFA7478E4624BD7BB6B65589A60B7B3A9CDA09FA8D109C524446D753C4116755B2AC2AC612F913E6E983B09FA0943DF9628
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0.IDATx...%.'.;..xK...."...Z.i.......=..0.......6.alc...0.....`.h....g.....S.(.Kq).E.X\....UY.........F../3.D........".=.,..;'$....!(....D..H.RE "...(D@...D.5.~.%46.... p.....4..R).BL(.B(.u@.!).....@@RD..B...].!!...x.......H.! .F.L.s.H.....72.....]|...N}.`s.\.......7....!l."I.D`J.P.....A.n.Ny.]2. ..x.$..Dh..j. -..@Rm.t*I.A:....(..A..Yp...A.$ ...$....:..*4i...&...$.m.FL.H $..X.j%.99.J...v.'..(...!VE.+!fK7.|-...!..Q.%U.PL.......DuIVi.S..E...d(@.\2J8.J..K~#yy...c..rbf ]4e..!.L.&.@E[%Q@......1.byc.N3............L4..i..0.Y>XkNy.1.mY\.........F.x.....X.i9.VI.GR...m.2Ml...i....J@|...c.S..t..!h.P4.G.....*3..',F............y...I..6..r....1@....p.I .Oh.U..4@..N.. 0QS..RP..q.B.B..RI..`....w.tad.y...@.l.a.....<6z..|.R.].d,. M.0_&.....9....ak.(.0...4B..Ea..P..b.K.C@........".. ..L..]..Zgor...M.....A....1,..N.......6..{|.b....%aGMa.... .....#).U.Q'B....Y...tJ.F..N..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1940

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9646
                                                                                                                                                                                                                                      Entropy (8bit):7.973427344955512
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:QYUpg51E2xU3us3M9IjHbCILvF26DGONXkXYT7Ew4YD0DEQVsQn:QYUO/va/M9IjHbBL9IOWc7EwAvCQn
                                                                                                                                                                                                                                      MD5:96998B3C066F7630363E6855EE395466
                                                                                                                                                                                                                                      SHA1:212E311E63F3093852AD03B00BB5356BFD76D84D
                                                                                                                                                                                                                                      SHA-256:DA9CF00BA8866BAB65898113BDCDB71F9758DE181D1EFF1442A905CC5CFF8215
                                                                                                                                                                                                                                      SHA-512:82953C139046F5CB93B2B3EABF161C43F954BF7027FB7F75AD234551AD218DC6DF127430CA747F70C603240864EE47C44880C7DB0A66E3D6EDBE73E35CF6A78F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/ciao-amigos-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.%..WEBPVP8L.%../c...M8.$I....k..&......e.!...6-D.........^.Fe....n...R....ml.....#t...#..n..G.$E./.2.T....J.....UU.3".....!l..'....TH.5`R........U..z.7..?s...-).?..Fe.e.O`..O....6?6.{..=Q.<.4..8._.....7.T.......Uy^.om.<...y.........='9cv+.Q..WP.CX[Q.....0.QV8.BQ..(P.1..m.$..z.BDL.`K.Am......XX*.....$.$..e...fc9X...`...HUVo.....x.#Ir$IjY..K.....p:.b#I.$.z...U....T..Gr..N..Z.I....k...m..C.dY...I.........<..=.8.....\.=..p.'&Yt..>..+R..m..l.V... .7..........@_....... nqmqk[....81.....l...g..6.m..1........I...&.s..v...)o..7.].....7.C"C.D...G..lm.i.........6{f/-...0. -..c.l-..U.A....b#I...>...g...$9.d.....^...K#..m.......{...0..6S.#TaP..g.'s."......P.i/...QD..[MY.)AA..V.V.M..L.2..:..A-AK..49(X.....g6..0...0.$....J.\.F.8...N....US!...j#.".....R..|.Zv+&M!.w....].$0..f@Smm.;.J..V75.%/.h......Z.,..Y. .P..$M. ..@...D...g..Y.:.......=..U..(.u1.@P...x.<.-T*B.^..pI.....i...n..Fv`.>...B(.;U.(&...`..BU ...J....4B..vJO.U.".K[>..d.....n..Dum.X

                                                                                                                                                                                                                                      Chrome Cache Entry: 1941

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8216
                                                                                                                                                                                                                                      Entropy (8bit):7.970134061115969
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:JUi23Muf48H8UTjUSLiVcsyRS5J4n3PI6vU2G0FXf:2i98Lw4i58SvGf
                                                                                                                                                                                                                                      MD5:C1F3CEC19E84F628860FBC43FDF4DD22
                                                                                                                                                                                                                                      SHA1:01CD5763F6152DFA4E0F1BC4A2D54D9DCEBC2545
                                                                                                                                                                                                                                      SHA-256:8B92D5551626409D5612C1ECBFF83DFEEDE64F98402BF83A9C5ADEAD28426A38
                                                                                                                                                                                                                                      SHA-512:F3B1468A26F1F1C290D081351A1D5BAEFC7489F8216893F3C7FD958679C39EF033BBCA28059D2F4EEBC978A1D9D6B2ADDF6E6EDBBF46B3B8218D176A3B8518EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/steam-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF. ..WEBPVP8L. ../c...M8h#.TSu.....O.".?..o.P.}..J..]...732..px.<....P.K1.....i.{...`.m$I..T..@.......$.8..&#+.d(...!JgS....#.R..?....d+"o".#......@.Z.....<jS..d.5nU....t6JC...&i......IU,..X.b..(.b...`.....(.$../...gI.&(....:...Hf=..V.....-g.m.-.D.K..z.D._._T\q..../..v^.3..k~.c..j...py...8r.....k....>...(kq=..|8..K....<.......@.6....=D....l.BP%.z*..c.P.UT.7.....-.q..$'..Z.......<.4..Zs*...{...........(40(.@.y.E.i..X..x.....e..8.....*...l.l..$I."Ij...7.m..{.!..$I..j..]X....N.b.....8...U.....a\fff..033333'.......=...h...=.....>.H.......P.;0j..H.....W:...._.;8r......A..o..A..ot<.@.....k..I.m..~..=<.8..6.4.Y..ys...Q=.}...&.p7.....$.l.D....j..Zx}..M..............B.T\C2TQ*R.....=g^s.^..W.>....{....o..:c<..g..?..gHcHP..WH.!.T..X.p.*I.h....:S.....>/.|~.>X+U.....C)....z}...30.>...JR...$.#4$..3..j..:.8Z.;.9.z....2L.Xw.......Z......`.....g.FN..i=>9b\7.c....7.J...T.A!8C.pv\. ......Hhs....\.....Lu.....e..u]6..\.uj;E..Y.[......M>>c&....N5..L..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1942

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):4915
                                                                                                                                                                                                                                      Entropy (8bit):7.913429679041709
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:1X72eTllQwdfxOFQZwJZWrQ9FOgCISohpqf0Odde+:1ieTllQwdfxvZusgdSEp8dde+
                                                                                                                                                                                                                                      MD5:2A146E383401D1B63C4D1E700FFD8E92
                                                                                                                                                                                                                                      SHA1:E2231F98C9CB239087A8231F579466A1BAEC303A
                                                                                                                                                                                                                                      SHA-256:E64D6E7EE9B24C8D662BC7EA79F4499C9E8E9331DD284BDAC9D8137099C85113
                                                                                                                                                                                                                                      SHA-512:00DC9326F23572064C1E1F8B27AC205AFCE0D08C2EABE76DA76FEF8D41F9609714E630FBB091510B0B470F5785D22B8C38EE7C3A9B5E165026FACC2CCBE096AF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx...o...gf/...i..(.N[.%...8...:h..%.?..j.(...Az8>..v..r|.,9.II....x,.=g..q.E.....x...AX....|......,.i.,..,....e..`Y.,X.,....e...X.,X.,....e!.`Y.,X.,....B`.z...L@0 /{......g_9X...U...q.mHI1..W......|O.&.*&."R.$,@O.....5..4.RR...gDy..3.^..........A.2$/....~.D....". ..;/qZ...4M.u..cl.F..Y.....c\k..Y....l..L.K.yz.........8l.:dB..k.?FL]+.UE'.#@..FQ.,.e!..c.4..A.B.BX.0..B.0..p..2.X... .t$.>...e....e.PUUM....B......B.u..:A<@.B.}.D.......!..&...j.^AM.8.#.P",..fI.Ju.....X.F^...0TU..a...W.........C=|...K%.,Kv.M...BM...l"`X...D.ai...CEQ...q.a.J%EQ.B.@...(.W......QC.u..8].K...0..9.c...8..0..1............v.}>...U(.O..Vf..Tf+.....(...RwK...s......y...0.m.1`.. .X..=C.c.._........s...n.ew...Z.BX5...@....[.n%....,.v.............2.........jo!..E.z.._......{/...].b...m$...F......v.8=[\O.=x...a..._;.t...PO..Xn.Z.5.3.....}.Y............8...6.?nz....,.P:...?...F=.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1943

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):27980
                                                                                                                                                                                                                                      Entropy (8bit):7.982740096077441
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:qOpMDtiVr/DP3rmG7zOapywT+b8spnTB7:q2MYVnP3n7z7ywT+4SV
                                                                                                                                                                                                                                      MD5:0AC49BAA1C92796E3E29179EFB0A6F05
                                                                                                                                                                                                                                      SHA1:6EB5F7C58CA938AEADD2A54EE123A29AA6B7D557
                                                                                                                                                                                                                                      SHA-256:A09AC6D73837AC350123442D47142F336AA1BAA9D5A95D53F4A79893C311A467
                                                                                                                                                                                                                                      SHA-512:BA7DC8182FA7FFD07D3CE03218682C685FEC52AFBBE7AD069B2B585061D860FD7B499443D41849B952CF88D16B92D92209715AB4BBB4213255541B9D872400D9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-trovare-numero-telefonico.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........5........................................................................]...}.m..:..Y....s.....1.}d5..^...7.N.......3..Z.+kxp.\Z-.So.o..&k.3.*....y..|.......L]{T.J.G.].g.9..l...hk[..k.H.sx...Z.V...OP....Qw.WH......v:^.....}.>.;m......k....r:?..= ..:{-.&./*6\.."..s....~..I.....o*"c....L.<.I.,..J....,..Of..=#.....D.ymY.=..I.......[.x...L6t.z.R._nW....^.........{...1..,.E<.......V.\.T..NC..cnY.....s....g<{..|.\.._D.c..k...Wm_.......s..(d).Z0.R...].{.....3.....m..9..+y. .......-......^.c....p...I..<.(.-.R.[5.+...=g_.~.<..;1t.q...6!k.V.7.IN.....q|....Z.o,^t. 1.......w...^...}...\Ry......>...m".l...C....%..#..I....\e...bN._Z..J...h..j.....]..+.y.X...Z...a8.v2.:z....*..V.:DDRI>._....=..gY.....i..y......,.FEq..c..CBp+.A[.}......i.......=....*.k.....z.'...z?..-..>..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1944

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5334
                                                                                                                                                                                                                                      Entropy (8bit):7.8655769515658545
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:LbNlQNpmUC8CBg2JGgL1KEmsMAU7V4uhP4K2d4yZqTk2aLpM6TtKHy:PjQNpfwd8OKEZDiquhP5262qT5al/tKS
                                                                                                                                                                                                                                      MD5:197653687769711A547A73D0D80AA720
                                                                                                                                                                                                                                      SHA1:9FEE5DA105159F3BA9AB77068F4C4145878145CE
                                                                                                                                                                                                                                      SHA-256:9E7551F41C5B2C840C86D0EF07123304655357FEA375C962A9950C3EBDA276E0
                                                                                                                                                                                                                                      SHA-512:F14A9B60F90D31F6F51FB1A221EA044F194AC494F470F27EBB23242A8E7DAC4539C686A677177518B88CF1EB95CAE5ED7659C3B3BA9BE900A7A2AF84F42E9E72
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/iptv-extreme-pro-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M(j.HR:...G.'...O...1+....*......v....*..s.6.$EJ....F<&.......d;Q...L4/...A..l.IRT1......3X<..........|l! ...#t.9se.. .;....u.H..:eFP.R....D...s.<%\%PD..r.i.....<....I.\.....m.&....#....Wy.|I5.D,..}}.<....L.www/.....8....:.b.....a<6.....c_....r$..*k_.j........C8.%D..H.G...8....NJ..{..........=...l.....m.m.....w.,..:......!...z...........r...=.!....x.m[.mK.j..\...3S\R .."q...>3^.{vO.m..mIRm..g..C..Y$*...oaf.....^=&......S.....L...z...ha.X...s... .9..<.S.Om.l..M.........F.Q.m...^.Y.I].^..w..8......-:s......<.......s.{/.T.S.D}J.1S6..J...|.W....3.\hP.$..7>........M3...<.z...1..X].....iX....O...c..o...Ib,P.#P.1H..X.F.......U...o.F{..f .Q.w.........:.._{6...L.uXo..P....C.m.Z..Y.t8s...V.....T......V.....J..M.0....:.....N.r..g.....q3|6.Kc..2;.gwG.R.Zy..M...J...c."....2...=/aj9Sh.5..h.-G-....X>B.v..Zh..@G.j....A..J..v.T..6R..@....B ...r.....C.....`.12&..=$...X...h."..T"1..}...1k.....].$.H.87.....&.'......:_.O6;K?d"...*.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1945

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstiexV4-tQ57yp7gf0ucSFjZrU6UsB_EAZSxlsbBILapA9MQ7nJYAKkUCPBxwv63QFynFR9Fjr9kb1j9d6V4l6ZgsPlYDtWLpft6V-l&sig=Cg0ArKJSzNt9hyeGAD3WEAE&id=lidar2&mcvt=1012&p=753,23,853,993&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20231025&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1791997687&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D&vs=4&r=v&rst=1698410156887&rpt=3126&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1946

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11020
                                                                                                                                                                                                                                      Entropy (8bit):7.9718405152258
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:pdsOqtmCw2gq7PGrnBAmrBv92dXY/xwO3BfHWOUJxcx2JVyV9ZA9yX:E7EJQ4BlrBVCXY/7B/7UJxcRPA9i
                                                                                                                                                                                                                                      MD5:6CA50C2FB8A16D86AF98D7A26A58792B
                                                                                                                                                                                                                                      SHA1:7A749B2A2A181854F4720CCB83FD2755FCF7FDAE
                                                                                                                                                                                                                                      SHA-256:FDCDAE836D6D7D4E663963B1E61DC7201C0EC18331AE2D193F1E98B7833DC377
                                                                                                                                                                                                                                      SHA-512:8E3A7AE8BFBED24878D0C846A0964A61CD357DBB2C3AC67257F7066E68AF6BDD61BC9D0FD5E50885C6783C4F4F3B57DBE79D10EE8F7C832EE7DEA8EC3B3A4290
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/os-x-mountain-lion-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.+..WEBPVP8L.*../c...M8l.6l...,.....!....\.wf.......N..&..L..?$..UG.Q3.%)F.(.......#-...}.`].|l.1hZ4.`.H..:>..O.>.....d9g....8....Q.B....$I...Y(....?.....:.~..<_{....'........n......9/......L..gI.J..&..$..p..........y.z.!.!C....0...s...S.....C.AxQ....s`..._...>..m.&....v..1.|74Tj....GMK....p.B....t...l.#I....$w..bfn1O..V.(..W.......w....\....H..I.ZV.....G...t..$9.$..}*3....w."..m....7.....-).$....Sx..3W.0=3..<133.$gDd.....}.oA.,I.$...{f.._.aB.%I.$I.-$..........!&MX./K...p....t.'......}...m...m..<.]+e.v<s...;.m.m.H....d.^.,...K....Zr.%I.#.m..yDf.._.3`.~.~a...T..i...%#..#L `..]>.a..L....@..$cv2. (......1'(..LCK`.O.x.$`..H.=.=....0 LKG"..,....!`6.c.._'Wd..K...,h1.UF.D..)......D fLI&FL..a..7<...L.....|.G..$=ACR....c....c..@i..c.W....9..0.*..k..'..>J...4$..<...A.6G2r..L...6.._...g..x/..12.....W<.%...=D.H....0.u..#`..M....~..4..}5...&Iv.....#...,y.?0.~ZD...=...t..q....8.R.....P.....pA.IL.JT.vM...E...6.......G...I.......T....%>.v\ydM56.:P...E=..0.5aFF&&.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1947

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8680
                                                                                                                                                                                                                                      Entropy (8bit):7.968602165225233
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Hs85Ll4EYAgap6N1QRAbVeNuCFpVr/2xOEwbPeT1ev+UNFuad:B5LvYAgFvQRAwNuOr/2xOEwbPeJev7LX
                                                                                                                                                                                                                                      MD5:F671ADB1F7595FD7519B6F0C47E1E148
                                                                                                                                                                                                                                      SHA1:9C6EB15133C5A1FC128C08467B0BFE3FBD47A440
                                                                                                                                                                                                                                      SHA-256:AE2E0D0E77DFF3BB69494AA796AE612E6812BA8FE780EF17B054899A0AF7D5B3
                                                                                                                                                                                                                                      SHA-512:310FCADA3246E589818C88A453E5B751F5961255325CBE13E4BF4D326731271ED5309001B89992CB094104BE32DD251DAC595ECD7E59A7C3011F0F4EB673F8C2
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/tuxera-ntfs-for-mac-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.!..WEBPVP8L.!../c...M0l.6.Y...?p.......5..Y.k|]..-..0...........@.....U.....H..(E....ZD..h.....$I...9"..R.D..8v.."I.$...F..ip..)Fjq...iF..C.!j..r.."p...z..`.=D.0...\y=.2.1.R.....M.......bj..Vw....".;J.<.....6.Maw4t~..M.....K..z.n.......C.......!C. ...d...A.@.@....._>R...... ..m....{.O!"&@.K...~..|.F.:.....&g....w..Oj.! ..t..bf...@3gvZ.n.U'M.%......;?b..-.'.Q#.d..Ln..K[7...."z.W....X..J'..n..9g.ik.I.#I.$yd..c:.O...k.uW8.6..I....~...."&......H..Su.5....q.i.Nz........^133c3...7.8.}..y.....<.j_EG.Z...i.J%.Z^..J.e...e.dYC.L.3V4t.yw(:.L...Zf..5y...j..m.m..r...>..m.w....m..j-.$I..Hf.Y........0.....tUxL@..).).....`J.Y.......fI.^r.....s.6.G<....h...x.*.As..iWr..,..cm.>....k..N...%q.....*E..:;g...&...J6eiz.#...5...'d..m!.L.z....Q.U.V>[..(.6..h.......Q..O...r.jcv..w.2_yHi.r}v..q.#]..L..+.y$...g5*........U.XO..c/.x...m....Hu.<.......x..k1|.........bpq.%O.s+.iU..X.h.#...<`..Q..G.R........W.....(Z.,.!..:....!...G..w.\.)..t...<f......\~.p.}.89.0

                                                                                                                                                                                                                                      Chrome Cache Entry: 1948

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12443
                                                                                                                                                                                                                                      Entropy (8bit):7.974138715511142
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:kYyc35dk/2tP5yq7aHbj1rrtiWL7kqo1OWrhxStvIzb2dFqTOf9Jjr3+xPLYmhfC:kYblXubjpr3PkL1REUoFqeQXpG
                                                                                                                                                                                                                                      MD5:15C712D605BCBA85DA606035956EDDF0
                                                                                                                                                                                                                                      SHA1:606C5E4DCFB5EA52D9C828FFCFFC6B4513B3D453
                                                                                                                                                                                                                                      SHA-256:1C0E0F9289FF637E272D7C13DCD00D90778E0604EF4557E39EF9CA44825A9E33
                                                                                                                                                                                                                                      SHA-512:E666B07D94C70038D431E95919C0475A334472CD53A8A6685CF99B5215F34F55CF0320D32D8933B2F3AC3D876DF064C1CA012E8E3E58559F1B5D2CD2E620664D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..0&IDATx..{.eWU'..c...<....J%..<..g@..D..>...(.J.J.nn...E.k7.h.WmE.i..o.`...y+..".Q......}..{.5....9.c..J*!..Y...>g.}...9.1&.*...}.~j.....a....f..f..+.}.K.}..l.`..n1...:6,......w................m........W_.kGo.3....t...-M.GA..y..2..B.........?v...}s.. ...?>.w....Ln....1.....~.M.f........u,..*...dP....e/.,B....#..uq.cG...._~..S...^..?...._....]k'....../..B|..n$.......0L...@..(....)....(.....K.uNr=...;O.>9\.|..v~..\.....-.......m.....M.{7.%}9.].0m0..@.q.....L..`..g"."(.p......q.U!@F.K..YV..cG..*..N.....>s.......i?...{k./..Wgj_...&.K....Ee..@.d....`JIh~(&04...D.UE.... `....0..h..p../.:.4........./. .ejr...0..... b.z...a.S...W.....-..._.*.....X..b:....0....x...a..)..._:.....~..... ?.......z....&In.:.....^.pK.1N..&.tb.@.."...HiKJ....K5.......E........O.[../].c... ?..#...........j&...'..!...u...87........F;B.`=F@N........hX...Zq....q....w....

                                                                                                                                                                                                                                      Chrome Cache Entry: 1949

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):28131
                                                                                                                                                                                                                                      Entropy (8bit):7.980542867743361
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:nvkTQURr1MKCSC2tHorXMLGn0jWdR+Nk6QfZQposeM:nM/CSC2EXMLGkW1LM
                                                                                                                                                                                                                                      MD5:880BCBCA23489FFAF037A76F019D18C0
                                                                                                                                                                                                                                      SHA1:F6214982065C790AE58C18C08C9C70BA16C5E55F
                                                                                                                                                                                                                                      SHA-256:68C1E5972AC259EF459715DD9DFE1257100C8C092864733BBBBD87782F6FEC27
                                                                                                                                                                                                                                      SHA-512:10EDE6E890615005E7F49DD58032A032E16F3505709CCDB294BD352913882BA5376BA634CC5CD2ACE1680CBC5D3E8DEDED55C7454EA1C7261340C44515C593E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-funziona-facebook.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........7............................................................................w.z.3U..F'..{_.y.v.l...X.^D.N..IT.@... . .6..#.U...Z.e....|..w...U.f..HT..8X.V..e]gY....M%.._...o..........)2..?O...^^.A.."DN.|..1....yq.J>.P.c......hIW....]V.!...x}........R[..f..s.h&/_..-..N...4.[.........-).....;.#=.;o..h.H.0.....(..c./>..........3.w.h..S=...........C.v...._@.r..s....KO.....:"J....(^S_.....v....M[5W<.v..Gd.i|..s....(.S%5i......E.X.u.a..5..N..3KC.........kw.iw..X.r...^..~.9.V.......n._;A.9..GM...~.6t/.Zw>...hb.M...........+...F...y.._e.{...2.{.X.>y...K.e.)r.|.p..N.%~..A.r^.".....7..oS...pJ..7.2..z.q..P.k...11...1....b.5.N0...<...O..Z...e...i.V.U..q+y..^T$....}.....j{......~_.WJGn|..^..4.Q.......C.....ch*lA.4.......1.Q....|e^M....w...z[...(x.}.iI#.... .{C.9w.t>7...d../.....5@B.@.9E.=;..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1950

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12338
                                                                                                                                                                                                                                      Entropy (8bit):7.964547745901017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:M6CIUxbs1J+HfoBwzxeDKkjvgn+3dT5y1WKK5+q:z8b/HSfDKkbVN4kB
                                                                                                                                                                                                                                      MD5:3069CFD8BD0F425E4F343F2A2A7E6F35
                                                                                                                                                                                                                                      SHA1:76980BE1050A9EC335C23077ACF427B59F48669C
                                                                                                                                                                                                                                      SHA-256:DAFE310E63761884F898591B066CEC5697322D3EE21C4CFE084D7E796EDAA14C
                                                                                                                                                                                                                                      SHA-512:EA5FAE00FA6801615563A57F6AD3694D60963D49DE96E874E9B235B452F66992624EFE5F9A0E5E3F2105F68E8B65D8B7FFC3F38204E44BF8F74787EE911FDC23
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/minecraft-story-mode-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF*0..WEBPVP8L.0../c...M8h#...aC...|{.".?..v.\......c....k5@.m...c...D..$....O..'.p.r...m.6.$'...G....a.W_h.p.I."eL.3..p...,...n.Hr$bp...0>.......)M=.......B0.G...a.`...A....`..mp..3...&..!&eU..t.L.I...........+..4X..[@..c.IU.Z.SLkzN...c.;...a..`!X........_L.'.H...B..y.>=1....R.....f..s-...B.l~.8...S2.K.!.M.....4J)......m.d.Y.1...........-...R.p.=0Yz.$Y.mI..D.>.....Z.:....H.Vmj.........<..$I.$I..H$......'.a.....%I.$I.-"...._....*M....9}..).".m.....#I.$.-V.1>.| 1.'b..9q.X.g....G..b#I.$.=kf.....t.$I...nv.P..E{,...%[.r..".`A_`q..cr.q}...g..e.I....m.m.n.........f..<:..^..$.$..E...y.{..[..g.{....f.".Y.m.$......{N...0.Y3..7..;`..I...............b+.4l..'.DQ..EE..09..9.#.R.|.{......M{....^.....)....D"ysk.!..f.'EP.6...P....Aa...\2..(Q.(...BP..|..@.....QS....*/J%P.LPB.j.MNq..E.....?+X.$. .F..\.x....u!...... .P....B ...B.\[.....m3M.=....PT.....1.....#....y.4th...!"..+..R...Y.T.C.I.Vj...j.*a.....n..T....I.3C.Bl.\..........o.........^U.Q.0..z..bE.......

                                                                                                                                                                                                                                      Chrome Cache Entry: 1951

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7308
                                                                                                                                                                                                                                      Entropy (8bit):7.954048752886611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vt7LR5AMEIvqjaLo8UHtfDz6rnVyuTjWGh9:vxLR+MDSbhNvoMQn
                                                                                                                                                                                                                                      MD5:606D432A877DE4EE874270CCCE224834
                                                                                                                                                                                                                                      SHA1:8E458EE8F3AD70A78FD7653014BD9DFD8A8B161A
                                                                                                                                                                                                                                      SHA-256:0A6882F2659B16F2E49840488DFB6DFD31A963DC9F04DA058637D4D197C2B47A
                                                                                                                                                                                                                                      SHA-512:241DA873DA1410D82420820429A3E3BE40AB75EFEA8B3B4389A953A23D75FFF48B13CB2EF952EA306A2C4E3FDCE881747DF3EA90692ED53F7BFCA5BC53A3345F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}yp../.v....V%...S....6.....Z).)[...Q..L9v..d$Y.uxe.LY.d.%.D.HY.E......<@..........@.B..p.R".....5E.fzzf~.............p4.P(...B.@ .....E.Vg"q..|~....P(....P.....8,L.K .0V......$I..m.Z-...l6.L..x.........h.ON..$I.'.N.......-.+!..0.JU.&,G..@ .V.....bq:.J.B..R.P.Tj.J...U*.R)..58.R..S..J...dr.\..).r..n0.fq.z..Ey<...KCFW..B.JX..Hc(.$I2..{.^.Ri0.DB!..5...@ .}.%x.@ ..j98I....,..E.d ....aZ.1.JXPL.&....f..R.d2..f.3Fr....r............D8..z.....y<.BA.....x< b!Z...J.G...U8.].....#.1....Ur...g..[......p ...e4...\>.o.../PdAZ.0...FG..@.$I.Zm.X.8.ah.W.FK.B.$I.H499i4.......+&_...."..#.V.l..1..5....y...D...q..D.EQT4[8...]..=@Q...j..X.\c....S..#.8.L&.........J I2......V......6o."......E"..l...`R..J@Xj.X..^.B..x<..zd..o....tmmmZ.V..;.N.....b.....0Xn......4.....]...(..........f........@.d2.h.x .'m.-l....y...h.+.`.c.._..%.Y6C..a.!.-u.[....4.Mcc.Z..h4.A.-.....X[.....|@*.N........3g

                                                                                                                                                                                                                                      Chrome Cache Entry: 1952

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (4179)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):189822
                                                                                                                                                                                                                                      Entropy (8bit):5.551035484076766
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:tYaU0lduI6RweFlNbRbM6yB9/8YGeuoX51en6Qy5:CYu/FL0WYGeuoXPA6n
                                                                                                                                                                                                                                      MD5:E143442FD53BEF804088959838DDC5BB
                                                                                                                                                                                                                                      SHA1:728D6FDE531BBD8ED21C15C28C6D187E8C871D43
                                                                                                                                                                                                                                      SHA-256:3B33A6AD784A16C019BE8F73C0DA37052FC474BE81215C4ED532D4981C1C8264
                                                                                                                                                                                                                                      SHA-512:B9454F811BF21A2DAE164ED1E156C058C1858A93291DB517881A85E64BA2DFE664EE3B8253FC162A6172FA8614747A29194328567722320E5BBA9876268B1F5B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.googletagmanager.com/gtag/js?id=UA-30374496-1
                                                                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":2,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_autoEmailEnabled":true,"vtp_autoPhoneEnabled":false,"vtp_autoAddressEnabled":false,"vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":6},{"function":"__ccd_ga_first","priority":1,"vtp_instanceDestinationId":"UA-30374496-1","tag_id":9},{"function":"__rep","vtp_containerId":"UA-30374496-1","vtp_remoteConfig":["map"],"tag_id":1},{"function":"__zone","vtp_childContainers":["list",["map","publicId","G-XYHRS06G1C"]],"vtp_inheritParentConfig":true,"vtp_enableConfiguration":false,"tag_id":3},{"function":"__ccd_ga_last","priority":0,"vtp_instanceDestinationId":"UA-30374496-1","tag_id":8}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"},{"function":"_e

                                                                                                                                                                                                                                      Chrome Cache Entry: 1953

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (22464)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):22589
                                                                                                                                                                                                                                      Entropy (8bit):5.425455390000458
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:BaqxjkxXps0ZbbTsuLpYuhdDDRvPM6Ajcmo6mFrkHdMm97eE+Tufchrh3FFdS:0+jkxps0ZdpYoK6scmoUHdR7Pfch/S
                                                                                                                                                                                                                                      MD5:D2756A11B15A4CCDB3CEE896827F4DC1
                                                                                                                                                                                                                                      SHA1:DA8D5A5F3A79BA36B5987B0ADA6F6ECE39E6AE66
                                                                                                                                                                                                                                      SHA-256:BA34ABE5F7DB9BCCC4E96465F09AB91BF5393F22DD0ACFC2C0E304DD3D94E66A
                                                                                                                                                                                                                                      SHA-512:0DBC44A4AB8BA5C5810D5AFDBF92D9CB4F2275F26F0CF80AB833C3687786A81142C932DCEF3FCAA7CDF32CD6908AEBE7B3A4A63B4FCA13B7BAA463DB7F4155DB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://secure.quantserve.com/quant.js
                                                                                                                                                                                                                                      Preview:/* Copyright (c) 2008-2023, Quantcast Corp. https://www.quantcast.com/legal/license */.!function(){"use strict";var e=function(e){var t,n,r,o,a=!1,i=!1,c=!1;this.then=function(e){return t=e,!c&&a&&(t(r),c=!0),this},this.catch=function(e){return n=e,!c&&i&&(n(o),c=!0),this},e((function(e){a=!0,r=e,"function"!=typeof t||c||(t(e),c=!0)}),(function(e){i=!0,o=e,"function"!=typeof n||c||(n(e),c=!0)}))};e.resolve=function(t){return new e((function(e){e(t)}))},e.reject=function(t){return new e((function(e,n){n(t)}))},e.all=function(t){return new e((function(e,n){var r=0,o=[];function a(n,a){o[a]=n,r+=1,t.length===r&&e(o)}if(0!==t.length)for(var i=0;i<t.length;i+=1)t[i].then((function(e){a(e,i)})).catch((function(e){n(e)}));else e(t)}))};var t=e,n=window.Promise||t,r="qcSes";function o(){var e=i();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(function(t){var n=(e+16*Math.random())%16|0;return e=Math.floor(e/16),("x"===t?n:3&n|8).toString(16)}))}var a=function(){try{if(!window.se

                                                                                                                                                                                                                                      Chrome Cache Entry: 1954

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12943
                                                                                                                                                                                                                                      Entropy (8bit):7.976392132891305
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:YluUlP7DSNFe7+Jlcj/b43O6vdjBRPCtFZFVV1mih81Tl9CkkQnkss:YluUBObA+kL0e6vxD2FZFVV1r89Nq
                                                                                                                                                                                                                                      MD5:FF7D26CD3F17BFAE21F1701E92CD6692
                                                                                                                                                                                                                                      SHA1:FAC0D1B0CD2A9FA691C6383CC4E3663581469204
                                                                                                                                                                                                                                      SHA-256:352EC3DA6BD23A26342657D91910FC3D08E912BF8514C3D4BDB2ACB38F31C3EF
                                                                                                                                                                                                                                      SHA-512:9DD1988E52400CFB180C071941039DE3CF4EBB4DC23219A319C19F4BD99EB34C4986D763BBC03AB23E57E8411057CFE5236DE5E1667C5474D049B7BCA33F78CD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..2.IDATx..}...U..]j{{...{.=..$..@." ..Fe.Q.e\AET........a..EDE.A.."K. !{...!...~{-...w.U..N...#_x....Sg...9...1...... .u... ..A..A.!..QJ.....`"..T*.k#...!.k....A.b.!.[........!...c ...........gq...A.!.' $....W.@.O..6?X.q".....w.{.3......kk:z....1.a........K.._..i9=.....0.....K....c.....#..b.4.C......f.R.0b.m..Q....!.z..).P..0.l]l.XE.....U*...]...!..&..?.........B..I1.t.s....._V.a..rE[..../h..]{..w..jl.hy.Wh.i6e).u.`s..../.a..y.H... .=......v.l...>....1...7..o......g...J..H.$F.Vs0..B.y..N.m.....U.`,.4td.....%1q.@.rM`p.K.z().1X^V.......@\...@.-U.m;FJ..!..p..fd...m..K...W...k.4k...^ij....Qo..5.mH.I..(!te..K.A...:....x.r-.6.%SBc.x<n:..(?.s.#B_4.P.Jd..ej..1..R..&V...5......E...CB......+...W...J.._...PR._.B]G."]..Eg..b....3\..nKg...IF.t.....[R;+`x.y....].P[c..j;....f....... m^|....zn..R..r....F...b,f..P.#b..u..l.V....Q ..._$u)01.._.`.%.6(...WD......$.I].....5..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1955

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (829), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):829
                                                                                                                                                                                                                                      Entropy (8bit):5.392082965715759
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:4Hks0TFq5/Jz2pRNrBZJuvu8goqc0ioNhc+ZddL4+mI:20wz2bNrVENtmN+kdE+j
                                                                                                                                                                                                                                      MD5:15428B087321BD765BEB5C5D671BDAB6
                                                                                                                                                                                                                                      SHA1:A361DA550D057ECDD21F65BD8BB2565003329EEF
                                                                                                                                                                                                                                      SHA-256:566F623B52DBA9D3C2200273868B9178CABF857CA13A7BDFF909C7D58D28FDD5
                                                                                                                                                                                                                                      SHA-512:A93E2C5BC5A15CE7B5B4253BEFE7154F66F3D1737204AD829695739BDDDB3EA34501242B832C0E7DA8BED8ADC8B9D9CA7164C17DC709EE7B16B12CD429069351
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://www.google.com/recaptcha/api2/aframe
                                                                                                                                                                                                                                      Preview:<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="o6eiEux5pJyr9lqQGgPwkw">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha */ try{var clients={'sodar':'https://pagead2.googlesyndication.com/pagead/sodar?'};window.addEventListener("message",function(a){try{if(a.source===window.parent){var b=JSON.parse(a.data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorage.getItem("rc::e")||0)+1);localStorage.setItem("rc::h",'1698410167630');}}}catch(b){}});window.parent.postMessage("_grecaptcha_ready", "*");}catch(b){}</script></body></html>

                                                                                                                                                                                                                                      Chrome Cache Entry: 1956

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1763)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1864
                                                                                                                                                                                                                                      Entropy (8bit):4.909740232721352
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:G9yzVumZOkUe33FByejgktMTucwmlm+tv2JTBa9i6deNaq0fb:G8z86VvjVMZMwi6Pb
                                                                                                                                                                                                                                      MD5:CB72F6CCABE78B7D8A0B84B128A82558
                                                                                                                                                                                                                                      SHA1:FD82503D06183AEE4CFC097ACE82EE24E0EAB31F
                                                                                                                                                                                                                                      SHA-256:11679A2FA46061BF9FF01CBB18BFEAEC969F52F96615866BDADAA1099F0EE7B0
                                                                                                                                                                                                                                      SHA-512:1351F069C9A857084D1197AC46FCD1AE91EA7EC7C203CEA8CDEF4E0E430B0C5D9E1CFA751A3387B1C72828BA8BA26D175C24CF37787594A64ECF22095D9F7EFA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/ms/static/css/flickity.min.css
                                                                                                                                                                                                                                      Preview:/*! Flickity v2.2.2.https://flickity.metafizzy.co.---------------------------------------------- */..flickity-enabled{position:relative}.flickity-enabled:focus{outline:0}.flickity-viewport{overflow:hidden;position:relative;height:100%}.flickity-slider{position:absolute;width:100%;height:100%}.flickity-enabled.is-draggable{-webkit-tap-highlight-color:transparent;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.flickity-enabled.is-draggable .flickity-viewport{cursor:move;cursor:-webkit-grab;cursor:grab}.flickity-enabled.is-draggable .flickity-viewport.is-pointer-down{cursor:-webkit-grabbing;cursor:grabbing}.flickity-button{position:absolute;background:hsla(0,0%,100%,.75);border:none;color:#333}.flickity-button:hover{background:#fff;cursor:pointer}.flickity-button:focus{outline:0;box-shadow:0 0 0 5px #19f}.flickity-button:active{opacity:.6}.flickity-button:disabled{opacity:.3;cursor:auto;pointer-events:none}.flickity-button-icon{fill:currentColor}.flic

                                                                                                                                                                                                                                      Chrome Cache Entry: 1958

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15067
                                                                                                                                                                                                                                      Entropy (8bit):7.965079613578578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:FARsUnfPBZIPJG8QUx7V2Z7zaBJh4EW5X4WAWc:FAR1puPJG8Qq7V2ZyBJhjW5Nc
                                                                                                                                                                                                                                      MD5:96AAD53FC57D2D92252BA99C094EF54F
                                                                                                                                                                                                                                      SHA1:79F078D3DF101510C3940B0CF3E9A0B4AE142EC1
                                                                                                                                                                                                                                      SHA-256:BC4BAD8973B8D5A3029B2FE2A3CF7A7A4C983369AB5C8EF633799DF2C136D933
                                                                                                                                                                                                                                      SHA-512:7CA56D8F5EA2E8C67A964AA31C6771D79EEA07BBA4F1244222D0877EBF2FE972571764AE4BF64177BA2A01FB14FC5005E816F89F625D0CB17BAC8D9207F02E8E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..:fIDATx..Y..I.&..f.W.y...Q@UWU...1...,."|\!..C.....w.....B.,wv....@.P...../3U>.{d$..=.5Lq ....wu5.O?.T.E.... ..L..."._. ....x.Cd..!.........Q@......)@....( ..".....B.A..... (V.T..T.....! B..X.".?y..\....h..l..=.2.T."......0..(dD.`.....'( .."..Z`v.B...[.q......!a.`@t.............C........X.. BX... ......... @..T.....8A....$SN*X.[P..B.....l$.q|px....<G$.xnaany....r(...... ......7&@.......@..0.s.~,.9.5.p..w.8M..{r..Yf3.x...Z.Q.4...:m.-......(..,B,...ah.....y::....$.......I.S.r.......!d.Kw...-..).C...j.o.@.:...51Vu.6..Q.x..d.{rp.=;K..9.s..t.gg.....w/.JS65.`..$.D`..D.$@H99.l}.l...U.8_)U,...).Y,.i.......[........ ('.($(....B.(e....%..S...A.%...y.'..O..8.=..s.1..iR.f.......k..>.....+.,!..3:'..g]...>...g.....1..=a...qe@.&d..G.'...>.....m.-.. (...Tl;..f, .2.n..B8......?......>{..r..T;n"W.]....-*DE..4.j...?.y.'7..4........r.`....r...=.FsM..)B#. c.J...!:vy..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1959

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16100
                                                                                                                                                                                                                                      Entropy (8bit):7.9723937671658245
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:KcvTieBFba9m7vhKqFdB0UpY5M3uWVO1ISNTtdmzMtRLrmT3EE9rdYhIG6RyG/Xm:K2rFbl75KyLjtwmnkdbS9qdxRyoha7CH
                                                                                                                                                                                                                                      MD5:9FB55E7A4433E028305C46303C02D543
                                                                                                                                                                                                                                      SHA1:EB87CF9C3244BD26C00DDE255521545E420FDF59
                                                                                                                                                                                                                                      SHA-256:C426C42913661FF112C4021BFBD83CB90D60D83D164AC0243A1E3C38652B3543
                                                                                                                                                                                                                                      SHA-512:30AD870E87F63C81E04A250412738FE7A2A437E029E091565C8E91A8E5BA56EEC84F161E65108FE1F799EB76D2B02DB2D6791C1CC8D2E16F7BD93CA029773DEC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..>oIDATx....\Wu'|.}{.Kw..i....Y.1.ec.0..0...I...d`&!..B 1.!..7.I2......^$.-Yj.-...}.}y.]..}....j...h7..W.{.9.s.....1Pw0. ..cI..o..BH<.......b.#..,N.!\...... .....?..^{......\TX.I..B.c.y...u.......]B...Rqr.P..j..bI.o....l ..\(......^a..[.........GFF0..Y.BB.. ......`.F{{{www.?..=...%.v-Y...RZ..oy1s.#.0.@mI......^...EWO.$q}...7....1......7o.{..[w.....-..y^.T..G).$I(....$!.4M..$..1&..&h....j2..;.U...MURL(..n.E.!..!..dn..B..G..G.T......\...8....LMM.^.<y....$I.o...;....j...).J.J..<...*B^.,..*V......Y...D"!......m+.5.A...v...Y...w(,.aY.ggg.o.......O....B~).U.BBH:...rCCC.=....W*..K..8p`.M7z......'.5](.......]S..0.T*.......p...<dl~GB.P..E.......RU...._...b....._m...T....T*.j..n...........}.{###.rq.....FM..y...-FTUU.%...b.@ ...TU..;.S,.'&&....i.X...s.%.Ph.......=V...z?P/.....o...Lf......O....6..$Yz[.Q.....f..c..Y....<....(.^$...QL.K.e.#..............jn...\.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1960

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7884
                                                                                                                                                                                                                                      Entropy (8bit):7.957029007466227
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:RPmz2LDUu0/CY0nHuM3NzfIAkjNR1KICMv9:RPmDu0j0HuMBFkjNR1KICMv9
                                                                                                                                                                                                                                      MD5:EB6000524378981AD90A72E6F310A0D4
                                                                                                                                                                                                                                      SHA1:E3A5A8348503715CDC7A09A2A7AC543EB6BEBEE6
                                                                                                                                                                                                                                      SHA-256:2C70550788EC629C639BF51D5FC910BB37CCF20B7435716F4AD978142CC1C141
                                                                                                                                                                                                                                      SHA-512:A511E430BB752E9920F8C57B9421EBC86C0962C9A0243AC929A6A77DB42015626A4794B404039B16DF74503F3C2E82E5D05A2D0A7C6348F26E9B7B5E4EBFB127
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/cmaptools-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c......$9.......9<D...Z..J..sO....w"%.%.7..I.......c.v+]~..!6....mi..o$5..q$.2.[.......q....6.$EJ....h..Z...`..m;..........0....?.. ...........Vi.1t_>L_5B...P.6_..#..../.W=V.e...|..-J1s..8..XQ..BP.8$8.`,.z.+....\.L.2..(.>..2..f.........Uk..5..ATI.@-.O.|h...O.8.6.J...k..A.Q...C..`(....s....A.......qI0..A.!....u(h.F....."b..5..M.A...}..n.e[P...J..d..K.s.gfs._...V....L.....zzW..N.D.../.....B...C.x,...X...M..u........b#fB.6..R.A.a.W.X.\Zx-........B.EE,.n.p#.vU.>UX.K~x.!=a..w!.p.7..T....kY.....m.+Ir..?'"22..i..=.{...fd...Kh...{...w.M....?...^...W .+h&...nz......~........C..........b`0]MS...rkh..\.LZT^:....b.....h.+a.@.P..r..^*(o..<t..\..7....U.A..../Q....-.8.h.@n........Z..m.m..s)......m.m.^.m.m.....h.....m..m.V...:L..:.....V...-..,..>,.={o..c......^C.)....B ..."..2.......V.. ......X.J..F.XF.0..T....,.0..k..aa.U....2;..H=,.h.j.N.. .r$a.#.T.d$..hLFF.m.cW.AV.oZV.D)...y.>.T.l....,.;.@.>..].%d$Ddt.c........}.$O...d..p..7..$

                                                                                                                                                                                                                                      Chrome Cache Entry: 1961

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):15346
                                                                                                                                                                                                                                      Entropy (8bit):7.977481679369169
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:jdQ/7+03bUo4ttNxpqJqC1ox6mxnWAH4r+cKoL9ycWek:jdQ6ejSts67DHSBWh
                                                                                                                                                                                                                                      MD5:E82DCAE2ED2E7E1BA052D7B3C5FBA851
                                                                                                                                                                                                                                      SHA1:F79BE4F6F0E2170B8F74D2C7CC3799FE595223B3
                                                                                                                                                                                                                                      SHA-256:6100641E64D430909B651FA0F1D05228DB539F93915210B10291A275B38AC961
                                                                                                                                                                                                                                      SHA-512:50BC80FAAD475D4FFFC89429E378950F866820190596F365ED0460583C2C3185658A61DADBF39517D90BC434809F99AF0C0DDA50DA67D1EE6D0A7C1C75E72CA7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/geomame-for-os-x-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.;..WEBPVP8L.;../c...M8h.I..................@..Q.k4}..I......z.;.E.KGgf.Y.3..TT.+..$...$)R....y.(.,....IR.`h......?....H.dUI.%.?...w..3....EM...V{.^....r':9......<.m.....X....@.N.....ZaM.............D.?h....c.D.n.......M.`^.]...\.L.0.../Jm...!W.2.....B..... .7gw55A..._...:..........JR.;{..^..e..0..m#%)...`.........k.%T..IK.....c.Z...U.hi^@yK.$I.$.=._...ua.I...>..b.H.$.l..A..).m....O^...m......q/.l.i[.....S../..o....6C.Z'`....m{.\.kb..jJ.....$I.$.%b.Qx.........cTU...%I.$I.-"V5....{.S..............m.ex.|?....!..O....t....9l..{.<.|....Y^..c....rU:#~...m.j$[.6.Z[...{...0C...$..<.y..%.<33...I.kMO. ).l....[DddVmfj.......N.....p7S.P...XT.N.%.`..mI2.9..U..df....j...}X...033.fNqRq8f[..ai.......2.I....-33s..v._........n.....'3Nl.d.%..7..|.........E...5..U..Q......AD.{%F.W..*..n\5.4V.H..`.0P.F<F`...}L*7....P..0h.1fA.;...>I....P.U.. ...F..x.|4%.*....c>.A..J=.U$....a.. QM)....T..h....*..CB......U5V.1...c.VbB)W...`..H...JQ....+~T'^.p...%

                                                                                                                                                                                                                                      Chrome Cache Entry: 1962

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12130
                                                                                                                                                                                                                                      Entropy (8bit):7.910664456307939
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:AV/hTRHeu5x3hFnXxWrpIKQXlXOZlP52vWkT4LnUECyntMJKi7zaa9o9HXIHYSgv:e/nTL3PUKHOdxU4Ln11OzU4HzgT7
                                                                                                                                                                                                                                      MD5:CE4B526F3773D1EC4600DDB9C3ED28A5
                                                                                                                                                                                                                                      SHA1:FD5F2F1DCC2CA1714865A4A09AEAE4B279D34905
                                                                                                                                                                                                                                      SHA-256:EFC3770AD8EB781D00D005CAFA56975BBC156457B87BED81FBB34B7CA8191644
                                                                                                                                                                                                                                      SHA-512:1170E956D0A53B868234079CE429413D1767881AEC94D273933C40D28228C63622E5AF810FD888631A64F916CB7DB1E5D80909B16733B794AB5A5D710B939291
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx.....y^....{]{.w.U.U.9.4G..B< .D`..A.....AV..W..?.J....X1`.Q.%.2....p.....=tw...{...}g.]U.....@..1..'1D". .1..bb'.6.+KU..hh .8.!.B..e{6..i... @...f...;....k...^.S..B.:...a@+!..*f..N.vR.d..i..6.. . 414..ME.E..i..AZ......].E..&.."{B..3..S\9..]A.X...NFIc9BKs .%Q......b$"..]f~.L...........lh...Q&.F..Iw..;Y..u.M.H...Ls.Sj.....&..$.TL.'.H.4.2R.).3.DB..a/ .GB.y..?(.J..TA..)......m.....S..ry..g.......x..l..........i..T5..)5..x..sR.:^.Q.y=].6.\..Z....dN&..n;..S...........-`.R2.... h.1... .c..T.*"ao....x......n/gw..k...x0]........6Tk..d..@R...5..;.."..Q..i.....\{.g..k./7>.:.5].qr...3.<...k..q..-LdJ..u.H:& .'..w.....Q.....D..:F...Kj.q...yz{{..../o..........s..IW.K..XI.bNU...(.:..c...IR...e.P.s..v#..Z....z}tr..^.g...g?..G.......stK..&t.H.<%...1.OS...A+...A.q.......~.g6.........zsw^.fw.Z..).ZM.t....M,.L. P...........@.B....t.....S.wcY..5.|..Q]}n..,.<.q.#'/

                                                                                                                                                                                                                                      Chrome Cache Entry: 1964

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7481
                                                                                                                                                                                                                                      Entropy (8bit):7.954012195779298
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:EBUoJEuRZCVS38iBpI4TA7my0kqQ8neznakz9Hfm3jil17mdvzljHNG85n3T3yl:ERJEyIS38iB7T+b0kqfeNzpGjU17AvvE
                                                                                                                                                                                                                                      MD5:A66D7188A985DACD00FE838817ED51B5
                                                                                                                                                                                                                                      SHA1:71E6F0BB75CEFE4AAA7B7AD4CBE81C7020B4CE41
                                                                                                                                                                                                                                      SHA-256:AE248DAC6F017095E1804F3D7D2A6A08B511EFF317F68496B7604E128B27AE4D
                                                                                                                                                                                                                                      SHA-512:00F117F98DB278B62579B1A88A6CA121EF3C1ACBEA419209840DA5FB10A989CBB4548DB6DDC66F7C49AACF1BE608D0D27CBEEB7915287B21352030EDE5A8D537
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}I.....Z[o..;..bbHA#..(p"d-.c....r....;.`....3...i|.........k8..E.,.0....$.t7P]..+..q..ef.. ..A.&.oDGuuUv.|.{..Zk...l.-.l.k.X[..2.....e.._.c..a..t...>.aO...........J5!t.SJ.}.q>.M9.S6..R...f.....7c....*.u_..=.?.0,L....x._.v....Zk)...3k.Ci...eY....A..X.'....q.k...k..ua).S.F..o.}.......g.....0....QJ.../..!F..c..5j.Ji.$...m.8q.Z..^.T...!. ....?......w..555..~....F#N.....'I".p...jq...YI....8^YY.t..s...o...?E...|...4..z.N.q]wyy.........Da .....Z. .(..n7..4h./aV..cccq..z=)e......0??.,yV.....`.h4J...8A..?.~.._........!fw4Pa;..8.!$M.f.../...+.f..^.....H)....y.v.w......C.<..v...F.....z..B.....~....`0.m...p.......4..q.!.....}..W.......^ozzZ)%....8.R......q.....T."....~.=.1.j. .(...t........V............f..w/...0)t..S.8...B5..n.;11qoc....R..z....6==-..R.........|.;..w..P..^U..hM..H.....U....T...c...9.B...:.c.`.`.O..G....v........8f....<y

                                                                                                                                                                                                                                      Chrome Cache Entry: 1965

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5234
                                                                                                                                                                                                                                      Entropy (8bit):7.686831645289366
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:sNIk6F9vU7f2qo97f+oilBauChhH8jy2bWYg4XioS0bJzd0BHM3lC:/Tk7tE7f+JzauCYVgP0bzos3lC
                                                                                                                                                                                                                                      MD5:4BFC28B12A6EA3D4741A66FF70191351
                                                                                                                                                                                                                                      SHA1:0B35A4E1BD3E4AFAEBD8C5D86933BA9D02628B95
                                                                                                                                                                                                                                      SHA-256:19EA3CD879755802208D2ECA460FA2F233D8DAA369B67A076AADF3D568C5C39C
                                                                                                                                                                                                                                      SHA-512:964AA745C3573245199CAF4ED83157F4E3C68E519D4D7096DE06EB533BB9E634A7716744007DA6727F1245475B460EF460556ED6E588D47146866F76A9E9A29B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/notepad-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFj...WEBPVP8L^.../c...M0l.6..F....AD.'.p....W....0r....hM.=..$..fSU.IF.&..$..Nm.4.$GJ....\..8......T...pk.V......*...a....?t.I.#...m.zX/..!-...`y..`WUU.C.\/.....5. .DD44.R".tI..`;...tx...C...F*Om.2.....R1.G.G6.\.Y..FV.!W...k.5.....D$.....-.=x.....3-..oa.......9...z.......$......c.....-...B{..t.sk....G7.e..G!.m.v5....ffNTD.)@..6P@*.b..>3\.g.....$).-.:.?-....}E..9EK.$E......o.w...=.1..m..6..\@Rq......x.G%.F}........F.$Q......Bn$I.$y.Q'../...u..H.#I........^.A.H.&..._L...........3.;....$...'..$.m#H....d..`3.Iy...0...g..;B..[.Io.s.'..x..+..?.7>y.'..}..-..D.s..v.l...y'.....)oy:.;.......!K.-.X5...m..c2. ...d.....L....."-....tpO.........?..'.^....F....... 0b ...2...L..d2d.u0..bA....<5...=...K.5..E.].o.X .2.^....x].....w.O.....p..Gj..A..r.0.r..3.c...#I l.......Vs....^p..f.... .0....<0...I8....(#..0....u..N?.mL.d....!X...#0ra........U...E....SL.....|....c.m1......B.K.......F.1. .hk'..V/.L......Z..........1r.@^0...y.....s.!..``|....3.f.._~......

                                                                                                                                                                                                                                      Chrome Cache Entry: 1966

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10996
                                                                                                                                                                                                                                      Entropy (8bit):7.941604716038424
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:SgqG2yvgpYNvydQ6lT9e1PkCfJsq3O5tj/dm++C7Z0M6gPlw4nhHNR+DfmM/wLuo:SgqGN3iYF+5tj/w+b1dCAHL+DuM/w5
                                                                                                                                                                                                                                      MD5:B2EE26D532CBB833031C3E71CD6F9E5E
                                                                                                                                                                                                                                      SHA1:24181A9136C4786165B85A9FDC71FF9811A49F56
                                                                                                                                                                                                                                      SHA-256:EAF0BF3AEC46EDABC6B59F5B96B9B551E5AB60FB29003C4EC34D60D9A019F2B5
                                                                                                                                                                                                                                      SHA-512:E9F253D484286579622895F2E084B5DAD4C042C1983E61A25FB11AA6BC1A83C05BCCAFF14D42219BF7CD4C8F70CAD4BC3E29342555FD8DB79E819BF812235266
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/playonmac-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.*..WEBPVP8L.*../c...M0l.6...^+..|7DD.'. @k...6."p.%..:.s].}.h....{...JP..5....M{.u..M..nl+.....I.....*.'..k"$<%.z.+E..l[U..p9H...C..~.r.H.j.w...z.|.....G................I...P.../.. .2.BHL.7..o/..o...b.].....=.......w.{X....d.u. .....C.n.._.c.&..Y..$.h..._...[.!6.P1!Q/..W.-..k<.)......5...n@...;...gd!........b./.....X..jT.E.......,4..|.Ci...q....$.....m.4.Q.....P....DG......`9.j-t..c..s.....p.X1.[.S..=....$Y...a..C.....W.s...=;a.....$A.$.z........T.oI.,I.l.I,.......q..2.c.|..J.l[...DD..733.N@|..........j.**k..7...$I.m.e.QJ.......;.g33=3.Z.Zk...%IVm.-.(........w.s...........Z.......=m.m....d....\...i...{.......m.4q,..g.m.$I...$37...j.@....=.../f.rw3.../[..F.m...l.....|...l.3.............#BR$I.$.....zk. h.6..C.^.m.I.........0.Q..t......."SD......P#R..R......m..1F....1.Q.Q%1>...@*.@.).0..LA..%....$...A0.....t..I........P...`...`)c..^.1_......&V.F.B..7...h...r..... ...@.l...J.5V..5...a.5_....O..O...[....k..~z.....UU.V&Q.....I

                                                                                                                                                                                                                                      Chrome Cache Entry: 1967

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8148
                                                                                                                                                                                                                                      Entropy (8bit):7.971921196352357
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:MiHW+vHe3rrLWoKk/t2JVEkTZGjkV9MplinuXu50kuA9nlFsaa:bWKebrXB2rLGQVyHmqj5Ol+z
                                                                                                                                                                                                                                      MD5:B318EA978690806E9E5EF0644C32CDD5
                                                                                                                                                                                                                                      SHA1:F32E7C8BA0E43D9AF2BF6FF38588289A46509A58
                                                                                                                                                                                                                                      SHA-256:66D54DD9C864A1240C34D4D3CDA30D6517662E13B2FEDF12697978C10B31D1E7
                                                                                                                                                                                                                                      SHA-512:672949E8F8DEB1FB5F6D59570BA7773BE413540E2CA6238381BA0D2556B854624A3429B8A0D99796F38E8516829B500C0572B331296E83E8A2D885DCB5F72983
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-office-2007-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c....Fm#IR../.Ox.].....|.........z.l.KE. ).~YsHb.1F~\..m[U......Z...u......H..*..pw.........Pn#IR.<...Q:.-.x....Q..?..C... ..rw!W..%=..5.c.......[.:qVKU....4..S.0.,.j..QGU...{.....h;.U..@m.\..]..*..^....nI....:...U.2.3G.lK[..=..QE>x...8?#....n....n._.w..U..|.pNw.Y...33ff..!....B...)bf{f....c...../.F.utC..t#m4Vu.A'3.LS5u.JTmX...Z..ml3.0.Y..w.(3...*..)/.1..0.X..=.$..~.vpTDQT5wg.0.y9.67..Y1.43eeCRdd8lK.-o...m.....{zP..H!.Rp..,33.....7fffff.0.dE.4...tW.la.vH.t.....Y.r...km.m....m...6..*.*3......l ...{.|.n.l .(D..>.0 ......s...ho...u..Rb....(.0v.M[F....`..`A....5...1.(.QD.Er$...Yy...^..r...4.I..k:..........".E.@....n.J."W. ...H.....h....r...E...%..W"...#..\R..c_...5w...x.'...bA....U.E.....u.).PY................\..{.|..}....D3?!.?l..<z....K.c....N...H..~...R\...0Q.........S.].A...m.gv..{.9..:.}`.D.....n#6nfff..&..)3.*.E..q...X............[/.ho.....q~.....y6..=l.[f.....e.%X6..a@d.0....1)...m%....O.......V#.0....>....d...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1968

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2910
                                                                                                                                                                                                                                      Entropy (8bit):7.864011472134585
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:YP7Ctv3sR5KWWjGpWThJ/deO2QWnmwXNoTQsCIUipBTO3qVUQJp8QpYWK66:We/sRkW3WtVdeO7YDoTI4TO6VUQJhpYH
                                                                                                                                                                                                                                      MD5:51D0ACFD3470036769422C303793B3D2
                                                                                                                                                                                                                                      SHA1:8D17BFB9E3D7B3A6C75E92CE627F58FB9EC26553
                                                                                                                                                                                                                                      SHA-256:CBDD5353675BB392D917F161529A0200DC415330C5499E91DA461DA78186648C
                                                                                                                                                                                                                                      SHA-512:63C3B069AFF4C2BFE0F71801F59095B3EE8785338E7925520742E2F19130A07E0AE64B2FFE4BDF8E747DF66427BF3E04264B75BE375CB9200D95A8C0A15CA2ED
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/microsoft-excel-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFV...WEBPVP8LI.../c...M0j.I.R.Z....s.D....Wh!.B.I.v.a6..V:.$.bX.....~..m$I.......B(-.{.8.$......x..H....8...[...{.X...O..;.......9....3.J&.oh?Y......P..rYK9.....m.sw..pR.P%..u#i..0n.P......C|./.j..J8._.O...n/.8...>.....I.>..?#.5.msm...{.g..'{O.m.f.U......S...=.9.m[.me........KLd1.1.d....C....r"ww...{...k..$.$..D....ZU}Mw..0...F......D4,1.......3%KX.X.....w......3.KX...=.._]..1.Ti.Q.h........&...^..?../.....Cb..r.:.d...8.c7...o?.E..t....|.;.w.......f.b$........................Lc..@H.2..\.....'...S5.....,....A]...d..AoZ`..0.e.L.;.Y.....0XI........'m#.v.&...;..Q.....%C[a.S4(.ah{....Z`.hW..V.Ss-.o;.p.m....a.9..f.........u.-.I..-G..i..r.......v\}g^}.WL.<$.a....(.;-?{.'..8~......$.f..*a....l.p..g....;......c ..b.&-......-.[8..V..S.aDa..\..>.}.......o.vN.<..F...>...0XN.Y4.a....).%$(..(...F......=...`N..h^...a.C../6...LB8...*.pRJ..5.....`N.".RUjM..h.f..F.@...@...1.-.$..h.b.........>.....0.#..)......(5j...q..[A.....H...%.#.jj....$Ln....w......TL..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1969

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):19960
                                                                                                                                                                                                                                      Entropy (8bit):7.962909958571326
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:27r6g8+ueEEoqUzhID2dkKUfkjZc3PkfhbdfHScYsWlN/Qf9kTu:27pt3EEvsg2dkzMj2/K5fHql9Qlmu
                                                                                                                                                                                                                                      MD5:CD84E21536477172E84843F2FDF75F6F
                                                                                                                                                                                                                                      SHA1:A67E0642AE53F69845444FF7D3D03FF7AAC024D2
                                                                                                                                                                                                                                      SHA-256:D050F0DDF5D859B3483034B99EC8682AD6259B30E45974E7BB32F97D9A7194C3
                                                                                                                                                                                                                                      SHA-512:6CB335F8C2ADF37B64BE9ACFA7C824123EBFA50641AE3892AED1B98EF7BAC309C2984D2A952ADDD23443B1374ACB26511381BA6DDFDAA3D9004D701FADF02DAD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............sRGB.......M.IDATx..i.].q&......W+..4..z!.E.k..RC-.{..id.R...{b.........K8..!..4cK.Q.(Q.E.l..f.wt..4..P{....L.......y@DU...}....../.~.......P@P...QD...`.._..?......( ......g.8.D..........DD....7.s.P...FD..@@.Zk.(....@.K#....V.Ki.F.u.={.<..x.-..Z)..B..;.HD..Q..9..5.{.P..........t..a.!.)%..D.#....'..k...ZR.9..kq(.............ff..A..;..v.m...=.c.XGF4. ......B.._M..#p.f`f...{_.....E...u...sr_..>.k..:.#"..._^.o.'.=n..........%. ....B..T.......D@@.@DD@.Z..3.L...^D&......4..Y..2..o....Z..}G..j.....9[..2.R.n..D.5)".fA.A....V....xf..@B.(!."..$2Ld..5.w......o~.......8c.~.......H...g.x..<.a.a.....P+R .....Z...h!R;uF.M.s.VE...f.`...X.....(@.D .H...E..}R....&{:....y.$"."..O.o..R.*.(.wd..A.=.......`.T.....V..D.k...BD.$.......{..d..=..e.. .#>p.".F..HC.D.D0.....y.`m..g...F..@...A..l..U....=...=CmB@..DH . ./..<#W\..#R.J).....c.@.u....}xm>.q-..Q......J.".=.,.,.H..K.H.0.L.B..N|/.....'r.....}...Q.....(@p..H^.P........@.....'...X..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1970

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8540
                                                                                                                                                                                                                                      Entropy (8bit):7.958780860247192
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vz4MMp92fy0hoqUgSBudsZBmsepkIcnnhfIYEWgk8d/f:vUMeky0hoq9OisOkpnCxp
                                                                                                                                                                                                                                      MD5:9239E4D21E9F73EC0B2F7DF5DC91DEAB
                                                                                                                                                                                                                                      SHA1:B510C1C3525B22AF0BABCFC3A06F8320C679F27D
                                                                                                                                                                                                                                      SHA-256:AC47308A1C3E53795A57B34F533E7DC8CCE2A1CE7325F895396E196B0FAF408B
                                                                                                                                                                                                                                      SHA-512:ED77A1E5105C0B7F36279FA0BACF5638F1A3BAA7F80369B2FEBC5D7AB22F0CEAFC32F7E582BF6C1FEBB9F86E7540E6C32A591DB06D394D77365FF7D9D948AA48
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<.. .IDATx..}y.eeu.o..;......i@.....q...^..]1O.....kE.f.cT0.8....q$(8D#Q4." . .-*...t3..]..9......9......R...u.{...o..pHUq... RU.e...}..G...V+..N.l...[W.%...a.....C..".#D..w......:........Z.N........'nx..w....A......&Pf..2:J..k..<.nh..>.4.iU&'+.7F..U.V.z...1....Z.._$'D".=...Ra.sQU'..{..._]z...xltL......`V(....*".N-2K@\..^..u...x....xt..uK<<.m...!.h...\...4.5.....0.-...va...c..n.........gf.,.P..U'/(.Pxu..PekU.Z.V4.......l...h.xu.F32L....b.E.Vmr..xx.l..5.dE.V$.S$.9..}.W.....w..P.z....gI...NX.^T...._....0.YKY.U..2.jM.J.f4...xl4..h=.w'_..v.....{D.TR.(........5}.D..j.N($.^.2.y.Uq.Q........"..$..A...T..H.2kE.......{..;.. .......^.N..`.]....K..m....<..|.....JJ.;......47S.N#........_F.....*.C33.g........E...|*..D...#...[...u.ZM.e..U.Y_..........A.~r...."...9....Q:).@.$B.BU..V*..G.../._........'?s.;.,..H.u.f.|T.%.c$//....U.cS..../..=...+[.SQ..Z..Ek.P.l)..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1971

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):15914
                                                                                                                                                                                                                                      Entropy (8bit):7.974609548063477
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:jshy4WlwXdQ7Nqy38K68ZaK6KO0nVdMC1XqlWd+h1y:jshbsqQd86Zabf0XMCFkxs
                                                                                                                                                                                                                                      MD5:0118D4989F7DBF6E7F94AD620736707B
                                                                                                                                                                                                                                      SHA1:76B9496E27EE583687AE5B34ED5760362418C4E8
                                                                                                                                                                                                                                      SHA-256:26CEB0B9D82333C4758E0D9E9A94516F36828D9402264DEB58F134BE8F37FAFB
                                                                                                                                                                                                                                      SHA-512:4DDF603A6292AD079C0044A1168FBC8D57D4ECC03753E20503E3A3631102FCD067EB956B729A0778435EB62EC09240D26D8DEB367B8E0857E0BF9D4A56D2BDD3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/spider-man-unlimited-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF">..WEBPVP8L.>../c...M0l.6..{zw...8..".?..{...g.6.O.:.8H..O@...mK..m.^!...~B....P...........m.!....3.....n.Ir..h..i.:a.....;.Li8n$I..x..jm8..1..^....."b/..Hg....._..Q..{QG{..P.;.}...AhO{:.*.b.[..._.!h*E...7..A....(.(..XL.er.....(.!.B..$ ...J.E.. .;...i..s..3.....@..`=I....)...w.$.....LJ.!...X...0.k..........BDL.....{...Rr...-......~...$...t..}GD..Z....m...g..E-..|.l.......*+3#..+O.m.$I.:.!".[]..........L....$.l.".....y...L!D!J.U}.g....k..m.m_.q.(.2..6T.6.c.bfff....9.bfff.....r.I.v..,....M.$I...QU3s...,..f.%.w<s.<..Q...kfN.p0PU._. ).D....yDf..h.^d.'s.....XU...n.*../.S{.4}J!......{....._......._.........X..w.m5.........1..rS.T..a......~.S....m2...D._....s.B.%0...?&.D/j..m.[...~`..0...1....*.I>.{..9.Dx'2..~.;..O..}...............4@....h.P..M..s.=....Oh$.~....2@...B.(.........2z.C....3.......z/4j.....x.u..S.`...y.e..h.....n.`.....1.b3.I.1A.._.....sb....(2..[I...}..^V.E..H........<7....`...4..\i.70.......4.#....<F..%z...#...$...].|.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1972

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):23674
                                                                                                                                                                                                                                      Entropy (8bit):7.97710176666318
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:YNZfbwz2TnTAsMiTXRvu+iKoUPWI8u7VZJer1E/g8JwNcvhgiQqVzT6:qpbBnOqXROiMO/wSvhgiq
                                                                                                                                                                                                                                      MD5:96761B75B516653CB482694B134642A4
                                                                                                                                                                                                                                      SHA1:3C482EB575BA4CE35AB76F2567EA14BCEF5E60A1
                                                                                                                                                                                                                                      SHA-256:7C3AD1119093B87AA1C2BA65BB335B6E14C2C6C21DE884A653611E3E348BF51E
                                                                                                                                                                                                                                      SHA-512:9630CCDA48784776D4538F0F1D0F115A257CD6825B6153CE3E6DE2529E50CB04BE5061A9BDCE901089E61397800A07ACC6A8542A3F223BC345A1A5768EDC4E44
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://cdn-guide.download.it/cdn-cgi/image/width=576,quality=85/2022/11/come-funziona-outlook.jpg"
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........6...................................................................A..z...8H.8HP(.0..m.:...Y...1."..f7CF'..B5....6...3....\....E..i.E.c{\.h.M........SL..4...v2Q11......u.._=9&..j..]b/+U...*o..c;Q... ....`..P.Q ....B.h0p6.(.hPI.}..F.v].a.2.E1Me.i......R.bN....t..}S.\.6....,c..R...'.-..R.K..,...2.h...n.M.....q.g...(.5..#..A.%.I3#..Q4. ....A.p ...........f..Ir..e%..d.@..8.i......>.;NR...9u.....[{.L].SX"....f........Y..k..<.V....I...@....Jz8s9...9..Y..j...7.a..jMD.. 0..F...h...../Z.sAh..@.%LR......1..P.RQ6.Zf.'..>.:f..4.D..Th_...E.L.....K..m..o...1Y~.:.n.s..<...s..h...H.iKI."..`.....d.M.<M....f...L.&..w)..5.x..B.)L...#0.*......!.K.:..[...&.R.+*....h.......U!#_?.ky.V..y..z.d.{.+/`..]3.:9......f.m2.2.m.......x...6`...TI..`..X..O..k.u.z.........F.......k....!..+.S...7..WG.c\.c..W..s_..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1973

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):495
                                                                                                                                                                                                                                      Entropy (8bit):4.343943203103631
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:+XNgPnkIBU8eJh0NIgPnkIB8KS0N8YTaDTxJ:+2Pkt8esTPkaS0CYTaDTxJ
                                                                                                                                                                                                                                      MD5:8E5374E1FC93A1F36D0C57E734570BB5
                                                                                                                                                                                                                                      SHA1:9B72A5CA6B48F8DF94681C3D9C6DC202BEBC6CBD
                                                                                                                                                                                                                                      SHA-256:BFB36E2D915EDACE081CF6E691AE973757221AEAB7F983F762688A58391B9796
                                                                                                                                                                                                                                      SHA-512:17DE672E7E2A5A56C33F649DF63240AFD4CFE123FF6605AD63DB7999218CCEEC1FD9C55D7E9FED5950262F49C49A7338D016BC6DADC32D60304A8A0B55458B5D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/favicon/site.webmanifest
                                                                                                                                                                                                                                      Preview:{. "name": "",. "short_name": "",. "icons": [. {. "src": "https://cdn.download.it/dit/favicon/android-chrome-192x192.png",. "sizes": "192x192",. "type": "image/png". },. {. "src": "https://cdn.download.it/dit/favicon/android-chrome-384x384.png",. "sizes": "384x384",. "type": "image/png". }. ],. "theme_color": "#ffffff",. "background_color": "#ffffff",. "display": "standalone".}

                                                                                                                                                                                                                                      Chrome Cache Entry: 1974

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (10703), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10703
                                                                                                                                                                                                                                      Entropy (8bit):5.035435720042419
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:b8Ipx3Ef7qdMYUE/gbRy97+9orKzSv/QKfP09BPGt6lqj:QlT2UE/gbRaq9orKMQKU/i
                                                                                                                                                                                                                                      MD5:8294A2CB9F5220443C1CFEC20F1036DF
                                                                                                                                                                                                                                      SHA1:620A179821AB575AD07AF4E426B31801BD81DEA3
                                                                                                                                                                                                                                      SHA-256:C91E06FA9DDD31B7CCF2097169B9334C0626886A2488DC57FF03662A8FEE7F34
                                                                                                                                                                                                                                      SHA-512:47E076B0D78639778F7ECF49A901D128EFEB84152C9BB4FDB5E76460DA136101ED25F73663AD46C4D08CB5B3DF6A2BFADA69B8515146AE4A0C4A3C7E56BE9EB7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/css/main.css?v=1695907987063s
                                                                                                                                                                                                                                      Preview:@font-face{font-family:stolzl;src:url(/dit/fonts/35117E_0_0.eot) format("embedded-opentype"),url(/dit/fonts/35117E_0_0.woff) format("woff"),url(/dit/fonts/35117E_0_0.ttf) format("truetype"),url(/dit/fonts/35117E_0_0.svg#stolzl) format("svg");font-weight:400;font-style:normal;font-display:swap}body{font-family:Dosis,sans-serif;color:#111}body a{color:#111}body a:hover{color:#111;text-decoration:none}header{background-color:#1a7dff}header p{margin-top:10px}.inline-link{text-decoration:underline}.inline-link:hover{border-bottom:0}#head-title p a{font-family:stolzl,monospace;color:#fff;font-size:1.2em}body{background-size:500px 500px;background-color:#fff}@media(min-width:992px){body{background-color:#f8f8f8}#head-title p a{font-size:2em}.im-radont.afterb{margin-top:24px}.im-radont.afterb.present,.bcnt{margin-top:12px!important}}#head-search{padding-top:18px}#head-search input{background-clip:unset;border-radius:5px;border-color:#fff}.im-radont{border-radius:10px;background-color:#fff;bord

                                                                                                                                                                                                                                      Chrome Cache Entry: 1975

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2616)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):20369
                                                                                                                                                                                                                                      Entropy (8bit):5.532408091309827
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:6YtUQjt5DGglPWt2ACG1RUI2J2uoUirFjxAMuBHkxXJSyexXs4XBTa+rpnlc657L:6YtU6tNGglet1CGH2JDoUiB1AvHkxXJ0
                                                                                                                                                                                                                                      MD5:24E5837EE9F1D9C1EFE4170C8EEBEE18
                                                                                                                                                                                                                                      SHA1:7BC8BE03640A56943A292E3905CC4736904A8411
                                                                                                                                                                                                                                      SHA-256:A198F092051A356C1E62C1296F628DA5732045ABAFBD974EB7FFF157E14FF042
                                                                                                                                                                                                                                      SHA-512:752F12E578B10B9E129A23B96602D53DD215565A6F1EEC451F2FF9AA76E1B9C0461EDCBDFA20F5752F6887705BC4647ECDD470654BBE6A392A8E46B740BA1D13
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://tpc.googlesyndication.com/pagead/js/r20231025/r20110914/client/qs_click_protection_fy2021.js
                                                                                                                                                                                                                                      Preview:(function(){'use strict';/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .var n=this||self;function aa(a,b,c){return a.call.apply(a.bind,arguments)}function ba(a,b,c){if(!a)throw Error();if(2<arguments.length){var d=Array.prototype.slice.call(arguments,2);return function(){var e=Array.prototype.slice.call(arguments);Array.prototype.unshift.apply(e,d);return a.apply(b,e)}}return function(){return a.apply(b,arguments)}}function t(a,b,c){t=Function.prototype.bind&&-1!=Function.prototype.bind.toString().indexOf("native code")?aa:ba;return t.apply(null,arguments)} .function ca(a,b){function c(){}c.prototype=b.prototype;a.O=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.P=function(d,e,f){for(var g=Array(arguments.length-2),k=2;k<arguments.length;k++)g[k-2]=arguments[k];return b.prototype[e].apply(d,g)}};var da,ea;a:{for(var fa=["CLOSURE_FLAGS"],ha=n,ia=0;ia<fa.length;ia++)if(ha=ha[fa[ia]],null==ha){ea=null;break a}ea=ha}var ja=ea&&ea[6104013

                                                                                                                                                                                                                                      Chrome Cache Entry: 1976

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit grayscale, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):3491
                                                                                                                                                                                                                                      Entropy (8bit):7.88457339029632
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:DT7649XUw39pNfaEuFchxyaTRnQKB3HF+:DTd9Z39pNyEkaTRnP4
                                                                                                                                                                                                                                      MD5:6C713BD1298D583B425411CEFA278CDE
                                                                                                                                                                                                                                      SHA1:07C3ADC1B6F883A5E264BA1A7CF98C7239ACF61D
                                                                                                                                                                                                                                      SHA-256:FD44A5F9E4426AB2D6B193EB7732D727562A69843B771A75B5B22CDA8926A2A6
                                                                                                                                                                                                                                      SHA-512:B66A83F1C797EF8D81823D185D09130A70BDC3F02D2EB08AB25AD7F6A8E71D5C2CD9E00ABE3E3BB3E5263CD30DD92ED4E570B4E0F0E8DB1890DED01FB0A13751
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....U......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx......u]............*!."D.[.f..:...E+....t2c.Y.-.:5/ej..a..f.43..:..( "q......}....~...C.....!s....2..$."3c.Y.7#..s...8B.0.l..Q......$.M2`T..B+C..&6E.AI.h.03...0S.;..2.....Y`.....!........1.B',.e0..u..K N....-f2..wox..{.s.d...S.0..S..j. ..,...cq.#.#f.Sw.a..4.|v.s... ......X'.....`.[...e.'Xv#....7..@.`V{..B...l....0.L...w.IQ..`|h...B*...hlsr4L..1i..`&H.....3..D]qR..SAjU.b0'..T..4l8)...R....`....h"N..0......`.4..U..3A...'S@j.6'..T..9.T.9M&......&.j.8)..,Z.ds..8.f*..W...yh...V.kd.....M. .....q...o5.....xe.r*.....v....e#Y<..$ C.A...o.P....0..H. .O..C.....0...]c...2.L.p.z..4.._>..-....!....okC.G..{>...y...,032(.....9.g03.....#.....6.AB..2..@e8h.2$4.9.2f...,,..t.1D.m.....S.V.h.........S_....45X..tJ...E!@...4.4.nW.L.(..?...=..._...zM..w...k&.v..e..8..j..r.U{....mK.=_........U...1b...j7.....y...v..7W.J.....\.\.6...h...hE.K:....x..&.{.....|.}7..X

                                                                                                                                                                                                                                      Chrome Cache Entry: 1977

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11970
                                                                                                                                                                                                                                      Entropy (8bit):7.939636040476324
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:JWWDxXCcxC4w59fm9QvH2M9Y3vHBlbc371tRGOhZ4t373TwdzFcT5x3h:Imx5C4o9GQvdS3vhlbc37kO3Q73CKVhh
                                                                                                                                                                                                                                      MD5:B9124143DB8EA71C9C3A7C9BEA8A4B92
                                                                                                                                                                                                                                      SHA1:66BB6492C597BA013EB2D7EE3AE6ABE13155EE89
                                                                                                                                                                                                                                      SHA-256:D232E8730A92549B16D14B3D20B5AFE74F5B4787BE247259B2FCB2741455D121
                                                                                                                                                                                                                                      SHA-512:B010EAD79F8831EDE800127E3827AC4A1FF919D5C2423836AE889D7C67F7584A13AC082C94A031AB46D6972E508BDFD737BD0BA5FED9EBE91B660D0ABF4B3030
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...MIDATx......}......=.Zk.5w..n..v.8>.3q.b.r8.. ...@.n.AB\....7H..n..!"$.Wd..c'..n.GWwuu.{W.a....~..U.....t.."..l...1.2NR.'...S.......O..3.....o.....*O3....q.S02..3...e.....%.c.d.Sy.....8y......x..t,>N.....q2...`.#."d....1O.|. H.I..2$.$..,....B..A`0.'K...c.H|.%..X3.,... A..P"0.H@$..&....Sy.Y.Nca'..<`......!.1F...s..8.y. N#..q...a.0....qB..d.`.....&@H`.O.m.1......".@.....c. l...aq.<"..$....fM. .G.....!.4C..H.b.<$.l.Vy.A.-..#.....d.i......D..F..'.)..1.Y......X3.`..O0k.!..A`.-...$.5.$..fM...&@<....D.[BFX..).....!lK...k....!%`$..@<d.O.d9..".f...a$.[k..ap...ln...........;..E.T`#.)...s".....O.<.X.X....r.t.5.T...t:.mL..6fK+...r...+.`.F....A(..SH..X....Z..&..`RbMB.".....@....e>..}\.w.e:.2.....6.~..n.nx...6...X...6..-.-[D.....}.V1.%(E!!0..P...Z.A.2..Q2.....a.F..3.(.p.q.....%......Qk..G..(.E.J.r..7W.Z.M&}Qky|.!......w_979.....+..,..lK.#..#..)...9?.`.ph..nc../.B..v4....$.V(...k&

                                                                                                                                                                                                                                      Chrome Cache Entry: 1978

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):43
                                                                                                                                                                                                                                      Entropy (8bit):3.0950611313667666
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUMllRPQEsJ9pse:Gl3QEsJLse
                                                                                                                                                                                                                                      MD5:AD4B0F606E0F8465BC4C4C170B37E1A3
                                                                                                                                                                                                                                      SHA1:50B30FD5F87C85FE5CBA2635CB83316CA71250D7
                                                                                                                                                                                                                                      SHA-256:CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
                                                                                                                                                                                                                                      SHA-512:EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........L..;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1979

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                                                                      Entropy (8bit):5.21079861191154
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:TMVBd/i9mc4slzYrtj99z4L4mqZWzCF9xJLmgUhXqI:TMHd6+BjX48h9nWZ
                                                                                                                                                                                                                                      MD5:D9512F0F525415F06C2957770ACFB9FD
                                                                                                                                                                                                                                      SHA1:219155047825F9A836ACE8402B750116F5EAADB8
                                                                                                                                                                                                                                      SHA-256:307238FD564CCF483E9503989F781D89C45525F80DEC2BB3E80A9AD70FB37BA2
                                                                                                                                                                                                                                      SHA-512:B1BF13930CB63FC5B8C67BD09F213C0CFDE364C6C2CC961361EC466E41368B8E8E134159689AD5B77C2BE234AAD132A1150712C95CABC64123B7530E2C11D3FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/images/maglass-blue.svg
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="490" height="490">.<path fill="none" stroke="#1A7DFF" stroke-width="36" stroke-linecap="round" d="m280,278a153,153 0 1,0-2,2l170,170m-91-117 110,110-26,26-110-110"/>.</svg>

                                                                                                                                                                                                                                      Chrome Cache Entry: 1980

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):5771
                                                                                                                                                                                                                                      Entropy (8bit):7.567559413357578
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:emfPJjqUcK1ozVNg3jhp9+dxfJ2zVBwa3DHhRboc61aWL1k0RguoNAT3yR:9FqUqzVNgTdecB1rhuclWLwuoNATe
                                                                                                                                                                                                                                      MD5:BB94D1B5CDACAD862D1CE68EB1E71D3F
                                                                                                                                                                                                                                      SHA1:A27FA1FBBC31F416A8CF9E4349C73D496C6EACEB
                                                                                                                                                                                                                                      SHA-256:4A409DE6220135EFE2A8A3BF7CADB079A2357C1D19A7CF66BFF0CB2049EBEAF8
                                                                                                                                                                                                                                      SHA-512:A09627BC370D037F52CAB22B9306372A6E812D0C59A5B7E28F97A5EED51D43BDDB84E82D0CBB30DBC41C7A8067F3716A22CF86934B39843A2F70C0A1FF09D8E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........5..........................................................................................................................................................................................................................|..w8`$.......................1l.......9;h.vDV.cR|...e+...\...w......................{<vd.h'g...Ueq......>hxY.-I..R..<9.e...........{|J..H....................v.....s^b..{V.2..;./2SH....h...*...kv...2........:.........................I.y..S.z...-.;..c...uj"..>J1.Yb]..-..............................u..y.P.t.w........u..F.......-....n.Gh.........................Y.g.|....k.........................S.WC.. ........................H..l....,..Q.+...8.>\N..m...c>..k.......NK.t.c.~.*z.....................I{f_f.}...s3...U..c-.L.>...Y..J;?{r.bV'6....@............................................

                                                                                                                                                                                                                                      Chrome Cache Entry: 1981

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):16826
                                                                                                                                                                                                                                      Entropy (8bit):7.984132022695095
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:a/RPFNGfsSq1bTXRL2RNJVxBK1RWfobviE1t:aRnGfsX1b7wfJTBK1Re6v1
                                                                                                                                                                                                                                      MD5:D33842739746F117D63F59B6481BEC06
                                                                                                                                                                                                                                      SHA1:B5DBB113C73EFC42F31B57031BDDD40EF6501414
                                                                                                                                                                                                                                      SHA-256:1D21ABDB316C82114FE66036761BDEF05D48EDAE6FBB627BA0462BE6D1860170
                                                                                                                                                                                                                                      SHA-512:4251CF0C7D557C96E936DA4E0AB7A841F5DB81ACC7F286B6CFB2D48DC75D6080965BC476EB030533116743049D5AA673EE44AD4134FD49AFFDA757A8D80AE5D4
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/free-fire-advance-server-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.A..WEBPVP8L.A../c...M0l.6.l.....7.!... P./Q..).x....hL\....g..}.9.....Z.G.Y@2.../.$.x.6.$'...d..aQg..8 H..*.x.........n8n$I......u...*.?..vTTw.....Q..>...^..../.E.l6ValX.> ..g.K..bu...0`".ei.s(.gB.....].(c$P..%...F.....D..x.....(..I...c..@...G...$..N..mE.v...BK.$..g..(..5Z%.d.....a.(.Ea.$.d.~x..h.....@...*..-Z.A..6...""&..H......"..`.?..5. .bb..*&;j...6(..mK.$.Z.CD..}z.dX...}=.Gff.t23......'.eI.$i......K.....:..A]....om.m..R.....n#w..6...03.h....&..|o.fH........rW..g...m.Z|..w.].m...=..F1+3#32..dmo#I.m}.....<<"E..z..,.6......U...Z..?#...$._.$..m.{...........{'.w.v...q....ZJ...$..".m.9..e.2%...i1....|Nw.=.3....333.3n.J.TrDx...4|K.dI.d[D,.....3.6....Os...wSa..$9.l...GdV....3..'uF...U..n..u...`T..~.i..~.~.}.~&8../......R...............P8......GZ.............dO.....#..L.`ZvM...;1..B.5..A..w_<....sx.:o....Y.d.Xz.%...0..q".....#....0+.t4gB..DS.@...7.*pB=.......}M~>xz.....8Uw..ni5...m.4P<..)Pt-P,R;...!..W.................)...S(.P..S

                                                                                                                                                                                                                                      Chrome Cache Entry: 1982

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8555
                                                                                                                                                                                                                                      Entropy (8bit):7.973602716266285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:mNigsFwtO0l2w9vq86KLNn4TIZ0EHoEp+zAtTz1PH06pqjZHHNr:mNiHwtFl26vL6KLB3AEWGTw1HB
                                                                                                                                                                                                                                      MD5:A09944B01BA0FE54D68D177253A1F81D
                                                                                                                                                                                                                                      SHA1:FB94109AFBF110906777CBD8A83D8338519402E6
                                                                                                                                                                                                                                      SHA-256:55C03E4EFABE7B11E3AF8B92CE572C836CD222249A33FAF975CBC04EF8540DE9
                                                                                                                                                                                                                                      SHA-512:33E91C32DF4B9B5B5C3FB93DDFBA3082CCF3E3916B57CC140BCC6E7C79202F18947CF6EC95EFB306DE51E2D78F82938628E0A735D5B5D43FF84F2B5B827F83C3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<.. .IDATx..].TTW.~."nQ..*.....WU.h@1FM......F.F..$.....L...L...t.....*D.6.>'..L2..3.n;.1....}.P..s..{8E.xu.W......q{...6........7n\o...].......|U}.b...Z..\.g..5.[O....r.v.).&..3..%...E.......K..?~..]o...).#Z=?.v......L.?...W><.M...3^9;...Tl.]b.(......5x...._j.Sb.,....FW8.^9;........?..][[....k..2.v.t.......+W....../..v...[`A...mT.}...].]Wf.....Q.-.....f.M[f..u./.m.}L.mTA...-...7~.....W...|bk...?........m.^....y...?8._/.|.R........*...FC.]_f.6."e6mE.ns.v.....m..?j\c.9z.{..3...pZ........p......._.W...|.r..^......]....y.9....K..L.[.....#.d.l...+j.Q..U6.....6..r;.........&M.k.hVV.K..7..../...`S......K..+..{.&.s......" z6-F-..+j.._.%..'Y....KI.2Xm.......|.....%.....2;^.C...d..........x.<.M.....F.q.U..$.H.%..D...R.BD.....%.eg<mZP..bW`..Q...[Zh.J.........[@a...........:.[.1..R......9z1...bQ.....:Rn.;..&zK.6...2z.Bf..&b,/.3.l."0f.W..H

                                                                                                                                                                                                                                      Chrome Cache Entry: 1983

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2167)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3922
                                                                                                                                                                                                                                      Entropy (8bit):5.329858764951608
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:2n+kOwwUnqU9baYFwUnwbbO8qhcIFLW7Rw/LAuhBhPziLoE4BS0ZLVWNaQv6Qc+P:2n+pubVCuukcuhviY+J
                                                                                                                                                                                                                                      MD5:05CA91AE9788EF03354671B196C01BA9
                                                                                                                                                                                                                                      SHA1:DEFC249BE602267808451CCFFC13B661E9E291A2
                                                                                                                                                                                                                                      SHA-256:D212386876860BAD63673D86FAD7436CD68336C50CBF367F326BC4A061A62A58
                                                                                                                                                                                                                                      SHA-512:650A4E976D474395740FA274B2E3EBDA6FA6C13D4C568C0E7D076B1DA32D82BC656228960FB5891BA60059FBFEC3405CFE43FBC6A80B06D16FBF46458BFFAF19
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cmp.quantcast.com/choice/NckurUNbznaCm/download.it/choice.js?tag_version=V2
                                                                                                                                                                                                                                      Preview:'use strict';(function(){var cmpFile='noModule'in HTMLScriptElement.prototype?'cmp2.js':'cmp2-polyfilled.js';(function(){var cmpScriptElement=document.createElement('script');var firstScript=document.getElementsByTagName('script')[0];cmpScriptElement.async=true;cmpScriptElement.type='text/javascript';var cmpVersion;var tagUrl=document.currentScript.src;cmpVersion='https://cmp.quantcast.com/tcfv2/CMP_FILE?referer=download.it'.replace('CMP_FILE',cmpFile);cmpScriptElement.src=cmpVersion;window._qevents=window._qevents||[];(function(){var elem=document.createElement('script');elem.src=(document.location.protocol=="https:"?"https://secure":"http://edge")+".quantserve.com/quant.js";elem.async=true;elem.type="text/javascript";var scpt=document.getElementsByTagName('script')[0];scpt.parentNode.insertBefore(elem,scpt);})();var qcaccount='p-'+'NckurUNbznaCm';window._qevents.push({qacct:qcaccount,source:"choice"});firstScript.parentNode.insertBefore(cmpScriptElement,firstScript);})();(function(){

                                                                                                                                                                                                                                      Chrome Cache Entry: 1984

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10652
                                                                                                                                                                                                                                      Entropy (8bit):7.949629812659313
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:1NKv4WTtj4wLuwfpVIibVoockRPNXQXw08Ae4FOEbjfs:1gnFZuopBpoHS0w0XrFOEHfs
                                                                                                                                                                                                                                      MD5:840A93CD81DB14DEC68B15A24C71F56E
                                                                                                                                                                                                                                      SHA1:6501A9FF7A6980369FCDAAAD9AFD45010042A98C
                                                                                                                                                                                                                                      SHA-256:D09F468F90F37B345CB9787CC9AB27E1D08BCA91DBEB5FE54211ABFDC07B82B8
                                                                                                                                                                                                                                      SHA-512:C2BD13AB5FFA3CA99B063C4FE08D8DD32F6A727516D4B4EA06E7B628C8EBB00016A317283FDE20E95FD2CA1704A7EA5098A3ACF4790853C9D9C57398B84ED75E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/onlyfans-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.)..WEBPVP8L.)../c...M0h.H.....?.;.....I._ZD..[.....k..g^[yI4W.z..`..6..nm'6..{.2..9...P....V. .m...n..v.....Jx%.....zz.x[.#I.U%q..Y.s...r..#.ik<3z.o..m.....w.?...'%.Y.....k05..].......u=d...W;^F.h..~..O../..VzR..W.%...O.n.0........S...Jw{.l..3..5..-...0..H...<.#..6V.t......cJX^.c.C...U..jr....+.@?..O,..".i.].%.]..C.8.z....&O......[".B..@...D.E...A.6...g}w.."b..;R.4.-...9..ii.:tI...-..v).k...$I.$I...Y........j....m....[.W.ZB#I.$.W.........m..m.VL..17..O8...+f..{.....-I.%I.m...ETU...i^.T.$I.$I.E$j..}.....d..PL..m..I._...gDFf......m..[..}...)+.....d.".m.>.".`.y...sB.y8'%...I..9..bff>g......9...-I.$i.s.%"~.....D">.3P.D.3.....(.....&..Dt..1........(.g.e .#.l.c..;..~.$ ..9.....f.3^...F./...H..#.(F.../..[....3..I.................r.l.-#.`v.X`@.n.....v.....f.9...a.3.,.s.bE,..v.fzl|3..ZgUS...S..[..H........R.....).L..aOI..........?.........pt..IQ...V..........-...%"[.C......U....B. .d.a...C.R$.BR(!=....$5)0.....E."..9..0.x5....%.,......8.H.JNfU..F/&.z..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1985

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:"https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvqsDgN0fhajumTOiWEypkVw7j6JcAKMtaeW6nsWnQUvlK5Cl5AAgozgRDuYdMPOqBk2C06pOGrACNOcTnEDzTseIVRAU935LZQRP-J&sig=Cg0ArKJSzMRlIPDh_eB8EAE&id=lidar2&mcvt=1011&p=753,23,853,993&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&v=20231025&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=47427054&rs=4&la=0&cr=0&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzQiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTM0Il0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzQiXV0sMF0%3D&vs=4&r=v&rst=1698410189088&rpt=1180&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0"
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 1986

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11972
                                                                                                                                                                                                                                      Entropy (8bit):7.970225987784627
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:oDGkyhyHgJuUabOvAPM1gUNmNd4liBGvi4RxDq9mPEhMopC96qGoZvrns79BI2ZX:GmCJbOvmMiUNM4lOei4TDq9mapC9QSrS
                                                                                                                                                                                                                                      MD5:EFC85D1A13633A6F5FDC64CF28ECD914
                                                                                                                                                                                                                                      SHA1:892A87B4A186416A1D3AEFA4772E3F6423ED8926
                                                                                                                                                                                                                                      SHA-256:453CC06F7B8E6D2B8BFBA83BD757574CCAB4AA4FEE12D7EF366A833E7C42862F
                                                                                                                                                                                                                                      SHA-512:108DC1B9FF05B5C9678F82F5EA05E3118F968A7A9D009DDDE00CC6DAC4673A2930858C975ED31D0F1425619BF5E09B48DE55279744B194850120078BF847B599
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...OIDATx..}y...y.{...{zzf.!........lRG.da.^g.]8X..H.,.?.5..b..$....._...-CvlY.E..Y..H...sP..\..gu..-^}...!)[$.[$.=3..U...w..............1...).&.#.... :4M.3.W...0........}...!..$N..3.%........^4.[..F|.........}..<.!..Rd..w..5..._it.......Y./...^....9#5..7.... .}.q....!ARa....$..'..5:.4&.5....!...I.$GG...!I.(.q).+i...F.2...z.B...0l4. ...z....|^Q.I..=..+...i. .d2.N.. p]...R*..$.wa..j...~..........\..o.>M.|...=...&.-.),.,. ..Y..,....e..)I.?..?>......f.YUU..i.........A..../...cL.$EQ@R..U...OW.UY....G.c.m(.A1.f..$....,//[.U..].,..2.C.;.,....>.......,.R.D"!.$Ia.....EQ.x.|.C....D.Z..)..... .r:....=zt...\.f&........w....E..1". .......<.s...}.`&.E!.. @.4Mk4.G...u..}.. ...>H.u...........!.>..ia......:.-.S..j%....m....s.......a..5.CUU):`...a.. 0......t:.h4.B.U....4.......~.\..}0|.R.^........j...[.AX.V......[........LF.uY.{.\.(...!.uM.,.V....W.U...!.$a.eY.k..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1987

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):175
                                                                                                                                                                                                                                      Entropy (8bit):4.6636823011859265
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:wLGff7sEC4TbTECQ2ALodM/hABJK6AzCJMgfO/1KSoO3DI6NAC2ALoMHMe:wLGX7PMCQn0VJvAzCJMQO/1JMCn0MHf
                                                                                                                                                                                                                                      MD5:276876D719B788B550844730B3851E8E
                                                                                                                                                                                                                                      SHA1:E48EB0FA09D905D1858784DE3D54E6303E309C6B
                                                                                                                                                                                                                                      SHA-256:18351534209A91B2F82B9D729CD40EC03DF685421E7F918ABF4DA735DC5237C7
                                                                                                                                                                                                                                      SHA-512:2D654671C4A81A8A0DA3D01C33D5E669F61D9B19F90A72DE78CDFBBA761A7860DA45E62C8B2CEA2700907766CB1722669BD3E9550065D4C25DF5F20A3A96EB72
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/js/dit-supplement.js?v=1695907987063
                                                                                                                                                                                                                                      Preview:$(function(){$('#dit-iavff').click(()=>{gtag('event','adcl');});});$(window).bind('hashchange',function(){if(window.location.hash==='#google_vignette')gtag('event','advi');});

                                                                                                                                                                                                                                      Chrome Cache Entry: 1988

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1989

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 180x265, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15905
                                                                                                                                                                                                                                      Entropy (8bit):7.971874127947901
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qdnLRt5ozYrvHYphF0FuAWChi2ZgoNl0Qusm9usrDfYYr2pSeeoxnAxnc5B1rGpx:w5oUrvmhRAWVo3j7uNk1SeeXx4BhjCum
                                                                                                                                                                                                                                      MD5:D2D64E345409F5405CADB0A600AEC857
                                                                                                                                                                                                                                      SHA1:F142579D64E1D3DC766093E0C2C4477127EE9105
                                                                                                                                                                                                                                      SHA-256:13C963A4C10C76EE0BB223C61980DD2034801804CC0FF1E64375F906BF51CC4B
                                                                                                                                                                                                                                      SHA-512:0B307ABCA906A32D01476905136C6F8E15B081063398E69133427B912B91A52B88773B551E60B7826C085DB788F4E3EDDD285163127359A576D975D8DDFC7F6B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."..........5....................................................................9^...'......:..m..q.%....F..a......Tt%9wY.n.Gt..qF.S(.xW....>..m...ZYnm..q....s.?.G.2..R...q..i..V8.".....S.%0..r...:....... .|x.g.;.~.w8..N.....k.8.X.]P......!...?.(...r\_.I.}F<.#.....p.A...P.....8.m.....o.a.~..P3..B:^.5...G..A.j.,..D..Z.....].....$..Z....ZR...Z.X......(....1.2..e...=..BI..K.6..?`.D..2......).'....@L.....Y9H.....S.wZ..S.1..z...._..k7......A...GI+..o.K9{[.1w[Yq.N.I]@.3.......4...H[.....J.]f4I.M.....K>8..kw.}........S{....I[.~B..*.W>8LG8@&D..L...q.....W.S..~.-....N.[.c..I.B,..6.[3i...0..J....`...~xpr..h..3\1...C...ZX..W..........V.$..v.|.....C7...(^...3.x.Q.......... b_F...}..v]..gt.iZ.v...u....=...X.%%2.Q{<C..+.5.F.T...$,@.bEa......kA.u.....3.s...@)..78.>.\.,...../*..=.W....xL......V.f...>5...

                                                                                                                                                                                                                                      Chrome Cache Entry: 1990

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3260
                                                                                                                                                                                                                                      Entropy (8bit):7.911126988787854
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:fpd59qwX9qEZxfQ7digZn8OllFltlLhkp11:OoUSQQ88ODtxhK
                                                                                                                                                                                                                                      MD5:8808DED624C5D792E8A5DD774A572F26
                                                                                                                                                                                                                                      SHA1:009470E89AFFD1DF9C448A15DC7EEB1E8B8A7D7F
                                                                                                                                                                                                                                      SHA-256:231E23573A3D9B39A064B6AF3151060936DA39EAE1BE3D9DAFAAE6AD6B057C10
                                                                                                                                                                                                                                      SHA-512:BF416DAADEAD42457ADCA09A413DB74E9110885D18AA1037B55AD2B0CE79DA7F77C93712D9C0FCF403DF94B8C8052DB7862EFB65731CEA19821DC2F86E2A33E6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/celtx-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c....IS.|.....&.7l..I......H...5Z.m.m.m..Y.g.U..... #.zj.8>O#b...;....@.V22.."2 ..9...y1.....Z..F..&.....2Ha1.@H8.b"T.V.Z.Fv0.!kg..2T...[......2...l..........ar.?w]b..6i...2..0..O/}.....|.O..1L...K_.cP......k3FsFu.3..k..3..|.Ah...b..Z.(p.'=....w.=...f..k....t.h.k.>.T...";.e.....Xj{;./]7]...6-.X.'S[..T..f.........Dp.U(..i....b...6.\..q\.M+4HyYX.i.-&3.=......-Y2.P.;).6-....y.Z0.F.......gq6..#...L.).64/.H..h..].-b...H.....`.V.K.-.:.%0......g.(f.%...B.b.S.u...)w..k. .F....j.Kq.....6...R.Fl.<Kl.NQj6.Lh...iYG.\.eT.........y...tC.t..-.."L'..;?.q...\#.\'...m%o.5.j. .k).<.|.{... .X.,@s.4..."...X..&adK....:.0F.c.!l.(..('..c-..._<....g%U..h...X$... li6...N..9.....#....t.....W_V0..[e.......c..!g4..9.....GY...jf....._kU.b...dX..&.|.[y..I..w..:........o...mB.D~..L!.S<......}UX.^...K.o....l..+.+=.Id..,-3...zTX.z...~.g....<2.{.QL.vY..l:..C.!.....M...&....z......q.....<...,.,G..+..._^...G.+....{f8......O.dw....Fu!k.e.....?8X.

                                                                                                                                                                                                                                      Chrome Cache Entry: 1991

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15480
                                                                                                                                                                                                                                      Entropy (8bit):7.976756097982756
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:s56JmvQCs9KzTlycSD+Fh/New4IBp+tAPMsIGz1pJ4aS:swCuslrSD+FjefIEtUzLrS
                                                                                                                                                                                                                                      MD5:8A2AB450082F8EF003A4FE8E577560BF
                                                                                                                                                                                                                                      SHA1:AF7EDA979BA205916D9118E92DC6EEFFF87B6E77
                                                                                                                                                                                                                                      SHA-256:579A3F3D27D2D62A3265CF0858A2547F6E046FAD5511F1ED271A9BC72BEB5BF8
                                                                                                                                                                                                                                      SHA-512:E4E15762D18B9B1BEBA1528E7CB77B5AFBBEC7B4E100A6C9225CB14A3BDDFBC2AC79310421C201D99BE74E64A59D4DB6DF38AAF93CFC7A856633334A54524E90
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..<.IDATx...t.Y..Z-3..,.,.$H.........D.....!.....-.,.......;........y/.N..3..........E).S....|..,.O.?..E.....l|S..../,...vbr..>z.T:P..z..5.k...L/.._.......?O..J.#..CL.lv~@.'@=..)..W..]R.z...........=..... ) ..;..`+0....a...A..........@..z#...v....l..7...x...-.)I....a........nB;..."|...w.Y...H.5......`%.eA*...&..h`...)v.....E").....)a..F.g...Fn......`b...(.r4.2K...&.o..N<0.O.x..wR.]..e... ..D...)..$`...bc....&....h....D.;....@G...t..z`..........X...0...LF......sB.>#:.5......t...E..............QhKE...}.>.D[t.d'............6.42.m....!.....@k.F..X90....L....\77..N`..F..0Z`5....k!.'...A.3%I.....D>.....eC..Wi!......'.}.%......?....K.h.=.*..@+..U...h%0..e.H.....t.0S.vj.0....c.4._.:tK.....};..~E.....Q.b".(..@...h.#%..._......4.6.1.jt<9W.7....f.......|Rl.&.&.v.$.!).).PA@.x.fc... Pc...0.....zJ..J.|.R.R...s....^.~..)....0.a.B..8p.g.....A..yF^..y...#..%G[D.".Q...a..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1992

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8138
                                                                                                                                                                                                                                      Entropy (8bit):7.89360247960396
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:uDa6uSWjqPzwuIhZzCjUs8aPlxiBNrEmu/PDI7A0t6:uDa6uSOqzgZ0zdQzrbCPOtt6
                                                                                                                                                                                                                                      MD5:A4B0B4A9B2CB241AFBE851E250418D92
                                                                                                                                                                                                                                      SHA1:1CFEE44D7AF7D51B99A0259AA6FB8FF25208C627
                                                                                                                                                                                                                                      SHA-256:D40BEDFCF5F8FFD74866792472EF280BD0BE28085B8C33445519FF85D5B4A71D
                                                                                                                                                                                                                                      SHA-512:3D4E2EEBAB6EE9A961C88A305CE42F8F09C024C4458B493DBC7FA68072CCBF23C2093D5E368DAE7EC65C77A4B50A213D5F704949E1A03B56171B014B72BC7144
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/bloodshed-dev-c-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0h$IJ.......4D....?.. .....5._.=...6...s@Q..4..F.K...?...p.I.".x...... ......l.6]..(..oKJvr......$I.w.....6..B..O@....."":8#_(....<.Q...~._.W.9..h..0..wy..F.RV..j5?.*.F..0>.....g..d4..e1..1.+...:yg..P..7.o( ..'X'....:..Z.(..g%...|".ZJ..............Q.._".p.\/\8X={^......k..A.~...^...0.3....Fr...}......YG".hj.r"*?\.9.cm.2I.s=...Y.S..3b...\.<m@&K.Zh.d1..4WV........^...U.m+...X.....[.a...2..[.%I.$I.-$1....Z..{....p.._.m..mk..R)...=<.m......m{.;.}e.{.1.1=<.....j.y.vc.vm[.}......-".....p..M.j.......Z+..{.5|I...m[f....g.0y.f.\...3....1....%.;..........d*...J%........?K.(IQ..... ...J..B..Yk. ..*.-k..\\..W..J.@#...?...H....].n..Y.4I..F..8n\z>.|.%?...xyM....:.?|.....lG.:E.'.O..;..q..r...w.'.....0........m{jF_Z.(......`.]..@...x9......F..|.@..........zsoge..A.....N.g...R..b.#U.....KF;......6=...t.c.x:......].r..".......0%..../.......(i...]....".n.......%..7.`.....1.t....Z......Nj...>.../7..Sc.u....?...|..wXZz..=K.,B....b.C..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1993

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12990
                                                                                                                                                                                                                                      Entropy (8bit):7.940236549996246
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:qEDSCHNFXgW9Gzr3Px/krTf9ssvAjbP7ZWJCb47nXqV6ODdcAsDYN:qCiW9O6tnSToXVOJWsN
                                                                                                                                                                                                                                      MD5:E28C2B7AFE42264EA7D07DB2260BAD40
                                                                                                                                                                                                                                      SHA1:D99CD3A66B709E23DDFB173397237351A377FC80
                                                                                                                                                                                                                                      SHA-256:39FC10F56B4F6B97F9E64788063577384176E48B8E384939D7D71664CCA3B2B1
                                                                                                                                                                                                                                      SHA-512:D9B1D82B8020FD4E3FFB12D9C4638E4A8289E847C9959B4E6D229943CB8D035A71BD761502575CD0E5728F1426DF739164476BBF147A07E09DA71E358E63924B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..2IIDATx.....y~.....{.Z{.sN.S7wUSt..FmC....@D.q.. .b.r.e..H. ..d.).@"e..r.dD..@..l..v...n..v_...v.{..<..;...S..T..+....t25.f......7.+...G...|.~.~.w.l.r...............@..!..B.@......@M....W..%..Y..B...(...V...;y...'....8?l,...g..J#&A.@xj...c.`.vm.\>..|..^.....o.........fqg...tj,gqiJ. .t....T.AD.....O..Y@BU..h.....6.R..!.l..jP5..]_..s....|......sg/.s{k{j.......t.!*..!.t.iy.W....../....y.....g........P..<s...r)+.L2..<.....TH. .......5A....vw..gVXw]......Q/q)..5...N..}..o..o..i>.X.......^../....3......3..L' ......|'...o.......M.y.....<..{?...|...w....^.|.{...{...*U,.Ol.@.B@v...E .47BB.Q.... O..9.^..2..._9~...7{7A....m+....2.|.....o<x.......'...O~..#;. ............v.,W>|u~......._...l......;..v..So....H..y......f,9...v...k!a.Z...c.T"B.. ! 7*.J....4!..../8.\.8..#.r#R.j..q.8|.../...[o...|.W.......W...g....<[.,..C....$.iz...W<.....o.....>..~..~.V..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1994

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5304
                                                                                                                                                                                                                                      Entropy (8bit):7.956809071279243
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:PearLh0OPzE08PWwizJi0QV1ms2uH8Gso24tQmOw+7pcn:dhLPzR8PWhzJtQV1ms27orymO1+n
                                                                                                                                                                                                                                      MD5:0CC36DDF61841BE570A56189431EC046
                                                                                                                                                                                                                                      SHA1:751188A65DFBBCD2C1A57152AEEF1A80DF07719C
                                                                                                                                                                                                                                      SHA-256:927A6013209E145788661E9906EBFB27A16C7E8B135C263EE2F4D4C97E8ADDFA
                                                                                                                                                                                                                                      SHA-512:3E25AEEE9C53ACB498F80B5A3DF0E2681AF6483A62EC4236B122BA62E0F2A2F54A163C6AA9B57219250858966C23CAA8DA46B7060F51BDF28409D983C4DFF13F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/libreoffice-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M.m.6......!....` .l.as'.QI..JW~X]S@.......HI.P./.r.....d.(..~|.}...6.dE.......j..#Ir..{...O........O...q..W..f2.0...........&..)..S..9....Mn9.a.d..2....R....<.E..6m.$..D............>......../...+..".../.$'"..a.gz..L'.O...3....W..Y{53.pcQB.!.3..G>.Z.....S.O...x2.U....2.=n...P..WmM.V...R.........Pjm..X..2.1.#uk$J.....{...".t..lW.m.mM...{.....].+...>..m.mg.............q...TT*.\...h....s.^3& .|...D.._.....................QT.A..D].....X.DC......X...,85.....5;........@&>.Q....?.. ..tm.8..N....L.@C..@...#=..=8B...!.d.f...C..4]....% .H#15<..7..>*...u.....T...z.....Q...^......4~. M._.v...n....._T.|5...h...Kc...9.g..-.P|.1....o.Z....K....g....+]......./Ks..V`...3u...=...{jP.8.8....9....5'\;|.....t.RO.\ni%...(.8B)...$......&....'......./4+X.."XA......Z.....Iux1...d<S?.%..Y....$$.@."l1....<........^y.[..+R...`sR)..H..v{.^.....=....#g...T..X..L|...0.I.".........../K4..-........`As.B,.*.....w/GO.....>X.9..!..2.#.......#..

                                                                                                                                                                                                                                      Chrome Cache Entry: 1995

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7950
                                                                                                                                                                                                                                      Entropy (8bit):7.968819567848361
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:E+zaUthVsp421TSOX59tHHl1U6K3AKkmeWzO7Rf7tX:9aUtcp425vX5Ll1+3AKpeWzO7rX
                                                                                                                                                                                                                                      MD5:2983B73B2547823295013A0FDD8A583C
                                                                                                                                                                                                                                      SHA1:DE6AE6A334A4F7DC2A22C053132BBBA82C4806ED
                                                                                                                                                                                                                                      SHA-256:FF469564D4575193883821A44252E0BAD261057A6B799B33785E3BFAFAE89AB9
                                                                                                                                                                                                                                      SHA-512:5C3DC7A982AC517BD07A4168F3665F17A1662FB8D451DB967B339C5B5032BA83BC1C4CAFE844085AEB44BC92D053C773C132A828C611BEB49E9E8DFEDFCDF422
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/whatsapp-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0l.6.d..C..........I..-ol..|_.."..$!...43...=.U.....l[ZT..\m.-.D..H)....k<..g&..#Ir.|=..zc.....h.m.m..%..f.?..$S.I.<.....S%.pR..`j.....,.Q.V.{.r..LJa"...3H.t...{r..."U...O..Ss.....,.-..O...8K...:..8..J.Q....R....../..a...w.....u.N*.R9.Ml......!.....@..DDo.P......{.D...on..U....F.i8.U.,h?>b..o..;U.....H].T..L._Z^".(.G.....|..X'...........Pot..8.P.E'....&'..z..CE......i.+Z.........6m./........$.6.N...^"....z..y.#)..7./2..U.E..l[.......GEH.....!l#A.<....C71.X..w%I..Edf.......sL....Y..Ui".....'.%.....Lz.}.N.Gg..Z....t`........[b....D.m...i5.G.{........5}.'..Jy...`.B....4.....C2k..@.fj.y.P._.f...*..=..=..d`..&..@.k..T0h..`.m(l....x.XL.&..mo".......T5>3aff...2[....f..d.....0s....r.hI..."...V<.w..p_gL@.n..e.C..h.q.,c@..A.!.....@X.!c.G,s.......#.Me.|....`.[CJ.....G..n...h....1h.a.r....m.K..@"0.q.h...nw.....{s.....f7R....8n.k....*...........d.ly..(m8..0.].m./.1....x.y..)_.=........C>l.......6X.&..D.\.*{...F.p$S.X.O

                                                                                                                                                                                                                                      Chrome Cache Entry: 1996

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8906
                                                                                                                                                                                                                                      Entropy (8bit):7.9330016977900115
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ehkXft45biZb/utZqNfo99c6mcUCMoNI4WDPk2f3llwDF6:sktl/utZAo9C6ZMx4WD82fMI
                                                                                                                                                                                                                                      MD5:996A37D2E4008DB9935F5F2AF1637529
                                                                                                                                                                                                                                      SHA1:BD2D108B3A6BAFDE29A9C51D2A2C938D5BE7C7B9
                                                                                                                                                                                                                                      SHA-256:0E37602A2C558D2F6FCBC792AE96A132FD78BA780516FD417D03364519F5E5F5
                                                                                                                                                                                                                                      SHA-512:0F019F6E2BCAAD3DBD91FF41AC65F7DEA45A974CED42ADC6473CEB0935451D426F768705FA3C7DE90CEA67BACB84D4029A91C52E884FCA28387A201249C15C68
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/fifa-21-companion-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF."..WEBPVP8L."../c...M0...MA#&...3n.....uC...Y...s....k.%.&Hu.T.a.ZJ....P.p....m.G..#o.....a.$E...ml.....'.$.V~~r.s..|....M$I.....1......?.........R.8p..6 .E*......LX...@*S&..`.. .^dj.`.6l....$A.T.d...8.c6l.. 5Ph.P.*.P.%H..$w*5...A..D...<p....~?xp3\.0a.....m....7.0..m.$..z.BDL.Jk.F...........Y...W.e....$wJ.....U....W.dt..Qo.9y..$W.F3'.9i......E..Hn$I......U.....H.#I2.{...l+b.<..vl...Z.q...V.m.m.m.m...........8.......[.$K.$.B.5..G...?.?...7w..-I.%I.m!.Gf.\......Z...1.tn.:....9.u....Cl'....T...I...fmu...{.[.OH.m...\:w...~...2.....O8B.2....0..H.#IR5...wO{.wr...3."....8<.Xt.Y29,..+d}.%:y..g...C.....?........@.V.a....T1.a..%.......g.!.q........y...u.>..Pr..5z..I....:[U......g;x./T..nzX.v.. ..zz-..S.Zy1......4.........$..(....*...x..R.eS.o\#...]..{@.x..."|.....4.....]..w........S.o.*h.ZO.AJ..Q.R.r..R..jX.L..t..t..v...K..........-(....T.I.s.i..RL..L..+..%..j.8...ZF.`.......5)..1.w{.ve.D@9z.6_....C+..$"..^.........$.{..............a

                                                                                                                                                                                                                                      Chrome Cache Entry: 1997

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):261137
                                                                                                                                                                                                                                      Entropy (8bit):5.325953855956569
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:k5ACUAe7qb8Rt+H5APNCH+iC2/jST0CxWRW+PCHxg80b:k5APAe7O81PN93qADQWGCHMb
                                                                                                                                                                                                                                      MD5:5497B53F795516AD51BD84D8E79C1D61
                                                                                                                                                                                                                                      SHA1:B3D3435D6CBAD87B50E23C5DA9C5FA673604F735
                                                                                                                                                                                                                                      SHA-256:65EF2E4096E3187EC54DFE47B5F8682566AB6D2783AA3A2C3C522396C430139D
                                                                                                                                                                                                                                      SHA-512:4AD669ACEE327EBAA874073DF698B1840A301272DE62C1303B4C4A35B9FEF2EEF3E68F3D77606DA6F44D63E3E3EEBADA3E46E5110B24102A2C1A009E4F0FE0F8
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://spn-v1.revampcdn.com/prebid/downloadit/prebid-client.js
                                                                                                                                                                                                                                      Preview:if(window.pbjs&&window.pbjs.libLoaded)try{window.pbjs.getConfig("debug")&&console.warn("Attempted to load a copy of Prebid.js that clashes with the existing 'pbjs' instance. Load aborted.")}catch(e){}else (function(){!function(){var e,n={35706:function(e,n,t){t.d(n,{Pd:function(){return d},Th:function(){return s},_U:function(){return f}});var r=t(55730),i=t(64358),o=t(20265),a=t(34614),u=(0,t(78640).R)(),c="outstream";function s(e){var n=this,t=e.url,o=e.config,a=e.id,u=e.callback,s=e.loaded,d=e.adUnitCode,f=e.renderNow;this.url=t,this.config=o,this.handlers={},this.id=a,this.renderNow=f,this.loaded=s,this.cmd=[],this.push=function(e){"function"==typeof e?n.loaded?e.call():n.cmd.push(e):(0,i.logError)("Commands given to Renderer.push must be wrapped in a function")},this.callback=u||function(){n.loaded=!0,n.process()},this.render=function(){var e=this,n=arguments,o=function(){e._render?e._render.apply(e,n):(0,i.logWarn)("No render function was provided, please use .setRender on the ren

                                                                                                                                                                                                                                      Chrome Cache Entry: 1998

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5194
                                                                                                                                                                                                                                      Entropy (8bit):7.949751713807122
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:AyehwYObyEvo9iuHqO8YY94KaD9yCRDm6ezBv1CW4+w1NprLiac/:rqwY6OISpPRShI0w31S
                                                                                                                                                                                                                                      MD5:E62C49E067CDC04AEEFEC7B2830D0747
                                                                                                                                                                                                                                      SHA1:0BF1684F7DE4562D283D031B468107D2FA8089CB
                                                                                                                                                                                                                                      SHA-256:84509386A248BCFC5CD1DC99F53583A5D02FCF18B69167DBC37699BB3290B185
                                                                                                                                                                                                                                      SHA-512:E7636868DFFF4BECB59D16EC42050D26E5109614ED9EA8F26663BABBA8FC243556095A9FBD3D25EA46C11F81878FF5941065B0C96DD1BB759678F22BD0BDC74E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/libreoffice-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFB...WEBPVP8L5.../c.......m..?.......Y.Sj...i..I..ob.m.m.\Fk.....mcm....x>{^..+..Qqe.L..l^S..zQw.a..l..d..$....h....]+s.\...9...).*..-..l...~x..+#.&2..D..=..h.JUk..m1.q..J.......!B'`.@...d.I.l._n...033....j..s..k.. ...f..j..i`.03..J.mg#..~....c.m..qm..i:*.I.J.....4.g...tfU.,...m.w........3p.H......).$.X...<.'....#Q..p...y.q.J"#...{.T...jB.4.O..F$#3ri<9L.........M....q.=.L.@..Z...x.."....I.Q.....t..<..J1.....XT...:.JJ....U.A.Ab....!....*.c..r9$2uy..p.($...19.HvD.......S=K I..%..i...$....`.*.$+3==A_F.Iw...K<.Q*...H...8f#...QU..N6.o... ..R.4....@.d.E.#..yxa^./..j..FD..'..^...j.. ..H{."J...t.......:WA`B.......X.......+....a;.1..aO..!..dG<...D2.=..P.6..5(.H......_.).x...`....v.].+..:.s!.u.v'....2..t...8..p.<.-X(.a..vC@..bp1...XP. .z..X.....{.X[0R&G"D$...cc.....t.l..{.<.0..m$A.G..Q/..>.e..x..r.......9n...e'..I.9...]b...(Nc..Mn.... .Gm.....KN..P.\.Y1...#`m.`v\.h.>D~Ps.P...a.Q..<..G....^.......H^9..."J#W./.....e|..gT.O.y.d...St G@.....r~.8.54

                                                                                                                                                                                                                                      Chrome Cache Entry: 1999

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10591
                                                                                                                                                                                                                                      Entropy (8bit):7.943444372891723
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:uTSXl5O/KJSfJZh8m/PzZ6DGTFaZ7D0k1KV0QtUaI5af3LBDh:Oul4SJSBZh8yPzADGTgOkQecUaISbph
                                                                                                                                                                                                                                      MD5:DCBABA6CA6C0DB26A4FBFDC1CC146089
                                                                                                                                                                                                                                      SHA1:6BDD9AF53D8D43E27A9D912E613244CF0015D8A8
                                                                                                                                                                                                                                      SHA-256:65511BF961E277319DD8C349B81CB7B71ABA00C0DBBA90EE7C00168C578E2E90
                                                                                                                                                                                                                                      SHA-512:225A3014D7714EDBE3693A6E96D4C5DC1C81A4CE5F84974C7D07856A5038A09448A39D528C5CC025CA9C5EEF0C108ED508F2279AF85E0F59F7018F775B7DC026
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..(.IDATx..}.t..n...z.f-F.%.62v..$.0..@2c..c.3...C....O2.33$.I.y$.$..a.$....d......,[RK..z...Z.........~st.I]]u..~...PY...dYFQ.Z.f.Y.^.....jeY..8.$q..$.EQ.%x.a.$I. .t:.......E.X,.l6.AQ..0.....^fa.sf.Y..H.d6.M&.<.$.?.{fUX.E9....r.....5....]Na..e_..e..T*e..GFF..(.Dm..9...*........B!..Z[[/.._&.R-K..|>......#GDQL&..rY..!.R.V....Ub.V.Vq.onn&Ir...K..5..&...p.S.K......z"....T*.....T*...i..q\.......R...r8....mmmf.Y.*."._.]'....>I.Z..|.....MLL...J..,..`..\ &I.(.2..........d2911.p8..P%.._u{..%.2..:.N..B..0L.T..b.lvff.j.n.....8M..!g.........o_.R1...d.l6{<.l.k.XdI.;....3F.2... . .r9I.....j:..D".l.`0......V....<*h..7.......B.0>>.p8..*..dR........A..?....[RRmQ.. ...D4.ek+.J......5k.|.K_...IR...(V.j..O../~qpp.R....E"....j2......i...w....1.j.J......r...?x.`0.lkk3.LN...0.......E.Z...J.....r.$Ijkk.....?....od2...v.N_....!.a. .l2....c.N.<).2EQ.l..O...Jt..g.Y.(".bw.+..^.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2000

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7918
                                                                                                                                                                                                                                      Entropy (8bit):7.964279470528331
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:tbuLMRPAZ5A+VD/Y9rfmsKGAKfZLlKOTxfjAcLPvZo+KbgiGNXwsn:tyyPstR/EisKOtIO1AuJo+KbgiGNXwsn
                                                                                                                                                                                                                                      MD5:077975608C025FB9D14098F60D0A9D7B
                                                                                                                                                                                                                                      SHA1:E5A5BAD2702A1E787EF2B49B1A8F53BE253833FF
                                                                                                                                                                                                                                      SHA-256:3FE082DD9E4B9BAEF9816C26BF35C863376C39EE2A2719F3ABA2B2FC281C41F2
                                                                                                                                                                                                                                      SHA-512:89FD879B44FDAE43591CB80A759B902ADC8DC0B0221AAD97374911C2B695FAB79C8A088E88B3163A3C33714F0A8EF4809B6C396920029A2F4CC6C9A5B80DE544
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...yIDATx..}..$Wu..?.........j.f.R..#......Zl-. ..}.....@6.xa0f.Y.#!.E....33.c..l.....a.$Z.I].VwU........GddVUwUuU..*...........}....RX.....`M!k.B.....)dM!k.B.....)dM!..v..7.7.p.s....<..`..ur..o`{..(.b..w.J..T.zb.-?..^..e?wF...W..}.9...};.Aw{..u.(....u.....O=/,d...^...&I......}..=P........q......l.Tz....c..hl4...z...1..._e`.(.JJ.!..v.uo...mgj,;v^..q..9g...A.....Fc....+..{...R..q}../8....3v..5.RY..1..h.f.?..).T.g8.Gu.b.v.*.T.9.gP!......h...1..R....>.~...>..'.H.WR.`.#.h.k......_|.U.j...A.k&I.RJu....I*..B...>.3....72....cl...E"ID..F.$.;..;.w\".........M...;.swy..K...k.#..t]...$.B...g..?..9....M..n{...A9......r...j....}gi...w..OVT)...o)w;..fk....D...$...B.K%....g>....U...v.......[.G...OL..T.......V....m.~....fgf~..lm.v;o.}....o..Gn..?.p....ZS..n....(._S(..X..M..........gN...;.!.k;...........}./>....9........b..v...z.V.Zw2.......1....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2001

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):43
                                                                                                                                                                                                                                      Entropy (8bit):3.0950611313667666
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUMllRPQEsJ9pse:Gl3QEsJLse
                                                                                                                                                                                                                                      MD5:AD4B0F606E0F8465BC4C4C170B37E1A3
                                                                                                                                                                                                                                      SHA1:50B30FD5F87C85FE5CBA2635CB83316CA71250D7
                                                                                                                                                                                                                                      SHA-256:CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
                                                                                                                                                                                                                                      SHA-512:EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://ad-delivery.net/px.gif?ch=2
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........L..;

                                                                                                                                                                                                                                      Chrome Cache Entry: 2002

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2942
                                                                                                                                                                                                                                      Entropy (8bit):7.891939560930906
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:9u29uo4lwfWkDNRsX40FWa2ddO5Ob0UaPPg0c/SljtJwsPyAI0r0oj:979u/asBFWa88OgVPg0yuy/8rj
                                                                                                                                                                                                                                      MD5:5DB57F5943B3CB23CB2D498FC5CF8C48
                                                                                                                                                                                                                                      SHA1:44D09795D7B8735C1D269BFE1903216E0F9BCCBA
                                                                                                                                                                                                                                      SHA-256:F0EAE3357A08576747B5D4F181D0454A20548D76E6696FE0F9F659CE8F50CD0A
                                                                                                                                                                                                                                      SHA-512:455D94F9E176D7AA392610CD0A51FDF008FD4C17C41DD76EDA19549679D4B01303DC68F4846A9DF36C80243ACA00AE5376306C564CC12F8890F06731F61800A5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..{pT......B...*E$.<.q..$.D....q...T.* ".y.i..F.....W..Z.R.....`i.v........i-...3.8..s.......,..o..................<D.L. ..,...".......E`.X..1..."..,..."F..X...E`.X......:.`..i..f......<2......+..M..]Y#..?...$:.Q?Z-<.....de..D.Gs.Z.'[.0.._3f...l.Z.<.a...).w...4..eG`.k.p...A..$.;.....k.S..`.N.......WzHY...P3@.;.....&.....I.H..M=.Z.M1./..5.V2.V...v..W..RM.@P.7>..-...E..$<......~.12,...d......8..#...*p*..pq..J..3......){...(..^..x\..9.D.b..8.pz..tFw.5...d..qQhQ.....M....U/.x...W.....V-...>..(A..~pj6....^...g....J.bSa..=.z..kk`.>...^....'._.Q...^.....%...}w,o(`...X..h\........d7d}..\...O.2....|.)..p.....6.Y..........Vo..Vu....++.b...QYJ...)+~.....x..`.=...{..e..*v.>...y$...........__.cK..1..LXJv.j..+.....F....6.-]}....|Y..x.y.O...>4.2...UU.'...U?.....#z.R.#...)u..GF.E%..f...6N.... ..6.\..$.g:)o.....l...%*6A+....;W....N..+c....j....y.%7?.Gb...%..[..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2003

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):25015
                                                                                                                                                                                                                                      Entropy (8bit):7.972758047262445
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:2p3U/1pbbpQi7BkCWhEn/SDo1F2eXIl4XgevnihNsJJDZpKQ+PRM85CKP50:2p3U/XZ//6E2L5e/isq3RMYO
                                                                                                                                                                                                                                      MD5:76F9EAF7007C255F4AC3ED606FFEDB08
                                                                                                                                                                                                                                      SHA1:5C66B55B348962252F7E75B6C30346C97474C00A
                                                                                                                                                                                                                                      SHA-256:C966D51B18CE0514029AFDFFC340E676C1F677E6E0215DC25555D46A0646D6E0
                                                                                                                                                                                                                                      SHA-512:319087860FA52A6CB8B01FC560B8D23258624272D95729815A06FF1F2EEBFC572235A0F354CA4811A6DEF88D4C1D484F830955BE128C745A4A8B62BD800ACE18
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..aBIDATx.].g.n.y......ON..{nN.. .."(.A.J.%Kn..<....8tMwMW...5nK%.m.*..IQ........ps.'..|9...Z....5k._..z.Yox....RM..`..@@@.........HX..$H"..P^+.sG.'....X.I0J... P..1.....U.U..d.a.M7.|..q.R...V...0.9..S..c.i...T...0.8..6C......;ECF,.=......T.ff.N......;o.q#.l.C...8c....R?..A...q.".0.H~.p..L.O..-.Q<.O2.....I.4..)..@...z.>."..SJ...$.......B....... .... FX.DF.V.+...{..n..Q.P.U.!B%9L.0.8.H.XQ..Q..,j.,..=i.G.....@..$...Q.TO8....E..Q..F..+.Ck(# !.(.?...~.F..x......O<...J...2....`<.<..3......c..%P..&qE.u.3.&\Vu$I.BEQ..8..."J..a.FQL......!.. .1..a.!&..B.@.PY.%IF....BJF.2.9U.-.vZ.a....$`p...*9AA&.A...a!gL.i.&..j...v..a... .h...'..h.....UdC....Dp..Y#...%.5..t....'.x..9g..w.F..8...}w........+o....HR. . .<..4e....!K(........L.4c7B...p..B($..7.].U.S..!.H...@..,K.z.G..J...R...... .3....u5.".L..B.0..i..;.p...8U.....x.+.s.2.rj...Q.8V.e.@..4...K33.|N.LO..6...Y.L&......j,....YZ.`2..o..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2004

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 576x324, components 3
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8646
                                                                                                                                                                                                                                      Entropy (8bit):7.82591434636054
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:PFOVSHgIvuBDzNtI2gWq+0LaEHwqjiOwIiHiviXRlRE5N/A7v7uR4:d4SHgauBVtI2ureEHnGOI7v7ua
                                                                                                                                                                                                                                      MD5:923FBAE61245079717232AB1C5709D18
                                                                                                                                                                                                                                      SHA1:9BBF4F8079135797A1E96B9F0FA03AC7086CD19D
                                                                                                                                                                                                                                      SHA-256:6DAA98A3ADC2C54B547E864CB8B4CF52FC1834893C75F33C2EF28499F8009873
                                                                                                                                                                                                                                      SHA-512:36AC082697559BEC22266E33A6F542AF6FA6BC057CC5A6C388BC80670E4FFEC4F068C8B86EA4386AEABA60DA6953C7E1B0173F69D43B5E48E9A87DB03711B2F0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......D.@.."..........7...................................................................../..................................................................................................#".........................e.Y.>!.L.Yz/$.k6N..[.td.yv.2u6wq_....]X...^....z..F.~. ....................s.C.|.s.Z.o|....@.]j..:...\..>..:^.........................%Td......o...[...-X......iF.24.../h..cP.;o9.}..w.!.[.~.Z.t^W.>e..-s....Gp.................,o...Z.....~5.=...wY^...y..?K.8Z..........K.T..8.....j..>F.x..hz...s.....)...b5.0................0..v....^..6.........78d<G.MG.k....r...>...|....@..t[.{...t..e.>v..K..../t...~kJ.Y.....W.y/n.].................'M8Y./..}..+M.zo.;A.ou.........1~.....}J.S...M[q........V.|..<....t.r....L8Wv...(lz.!.E................!..........^../..].t.w.....]...\..z..x....^.>.....X.#C.z.5.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2005

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14194
                                                                                                                                                                                                                                      Entropy (8bit):7.955957347314798
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:qeyU/Uab39nONCbyPmp1+mAQZDVDJaqyxudYjfNCnORF:0U8ctO8OPD18Y1HRF
                                                                                                                                                                                                                                      MD5:DC70586FCD2FEC0DE5DD2049AA04FFC9
                                                                                                                                                                                                                                      SHA1:1415CFACF1F739C17F49B3DA3ED37D9E1010BB6D
                                                                                                                                                                                                                                      SHA-256:5CE39EFD06F8E9952BF41EEECC458DA49608FF44D4352B365B2666141DF0548D
                                                                                                                                                                                                                                      SHA-512:AB69FD31D4365DAD1BD1AF015BF3BCD30F97B0AF31B7131587FD3D0DB6EB28D89C4BE8DCFB07CAEE7FE0571550CCA9E06A182106A326C7425F8619E9F06B9DC1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..6.IDATx.....m.y......Z.....9,V.H..DJ.e.l......p.8..x...8.L.YF..2K..`$.$6`..d%.b...Y...Yd..N..{...>w.:...N,..|]......%i,..`,..mI....A..%....{.../,..~...T0?..W.&..0...I..C.....6......=..'0....s.|.. ..I.0..CY ^...Tdq. 0.".....d....o'0N$[`...62...!AX.....{....k.........!SqZ$..................:^..'2.K..."....(.....1.!...a..$0......X. .*=].1..U]X.Au..n,A..QL..A..3...Mz.........P{..Ng....R. 9.C...Z=....s>.A...!.!..g....=..+...[4T.l..T...n..u...l...L...."/....F.k..Zr..1/.e..?.._.\n.J.>Iul..L..#R....AP......~........9....R8.HP.>a@....5.[....s....x8...#..t......o..m..K.00.Z..N..[M. I..I>&.y-%........wo.a.^hh.lf........S........E.?1.....v.....>...[."B..R.x%.`~..Z.{.@.~....>...7..g..NSU..........je..9,.Uw$%J../r"$.....`^3.\.2.^.7.,.|xT...\........i.j."2...G....<.._.?.h...1.m.2@.i...d!d.m.a!@2.`...!#...k..`.?...o.....?.)E%......8}>=RqS..e...B]o.A....b..d0.A.k.D8.....\..o..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2006

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjYzMTQxMDQ2Mzc5ODg3MDYxMDQ%3D&google_push=AXcoOmRmDIt-xKaC9DT_FiZf95K3AtK6S2qUskYRD2BeDpgWpFoOOykpPQim_zbC4nn_xm5tUnb8NjxIHCDKXo8QQZFxbrCSWqs
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2007

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6540
                                                                                                                                                                                                                                      Entropy (8bit):7.844144293165099
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:pWTqM2A5AKYW80lKq/PTSsIlf2/6JDcRes:EqM2yAKNYqDxIleZRes
                                                                                                                                                                                                                                      MD5:E3639AD6D5FAC40AC672E762FDF57E46
                                                                                                                                                                                                                                      SHA1:FB703A11DBE67C042035170C5DE53047B7E32FC6
                                                                                                                                                                                                                                      SHA-256:6F724BF28D5F1EA2D703AF75EAD91FE244CC7CE97FF57ABE82CD53759797D52F
                                                                                                                                                                                                                                      SHA-512:6933FB09EA72EDE022B907B212663D327DB2DD1FE502622CE408B9BCD965553F7C0567A28739E84B1ABF14AA4D828781F5A7A3CFC2DB84390F8E0BC6B5BB4D62
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/pdf24-pdf-creator-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8Lw.../c...M8h#..j......0D....*.n...W.n.k...Z`.f.K..W.-.fCwKO."P..9....V..`.m .?m.W.N2..H.d%.._DI..j...@....$.{.1......?.Hq..J... ..H..\|....._.b.W.......(..i@0....A.S.E(.!&P.1.D..o.vL....y.....L8k.m.Y.....8.............jL%.l.v.6.\...$A....#J....6d.....y.om.m..S.c.fi........GfFm3.5z.1...R.B...0.0.8[.C.A:..G.'"..#.!.J.....si..s...~k.+CD..9......Mlc..Av.C}.+.."...,c..i.N.%....89...%"..rv..4nm...Q!'.D".8b..1."r"p.5.m,'.rD.#...;>.J4N..q.0.g.Z...p.S%...S|.].?..;.a.u.P P.`.......#.<.q.4..Uu..!....t.0..... ..q.p"..Q....8..`.@....B.....'.q.....s..-".3O...t.o.i..O^.....e2.....#...sC.#"......W...p.....c.....D.&RA..p|....{.+.....7.y....u.!...*.R"f,9.....ni.3..!.......qF.".'..L..........OC.%..%zxu..g.#.9.'G..+ycN.l.3[.X.C..a..3.!#R!W...bS..#.'%"B...F..g.........<.q..B.........;V`}..Z......_'...:..Of.ks.z9.q.-..B8..g.87..y....a`....u.+g...y...q............@X..f..../.~...."......{..$.. $..&.i...rm~....o...z.,..u..*{.f...&.......p?.....q.$..q...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2008

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2009

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 2010

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12202
                                                                                                                                                                                                                                      Entropy (8bit):7.967378771791017
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Bb5PS8glQttapUpty9jgdDF3BgqdPB/MsxhXHBsI5NcuFsKhIHsnHA4F:BbRSatgEXgqd5/MoXhsGrPhIHsnrF
                                                                                                                                                                                                                                      MD5:6F163DDD7ECB25427A5C0D86B481416E
                                                                                                                                                                                                                                      SHA1:8BCF4E7FBB70E76DCBC6D78B35F72F9ED5D88808
                                                                                                                                                                                                                                      SHA-256:90C6530A5B985C7C0D4BFA7AF903ABF73C223A13B79D5387602E6A07FAB2F872
                                                                                                                                                                                                                                      SHA-512:24070B372E5B49096ECC692B9E10FC164D1694D4E0F5E760514A167F7F3001761FB267DB67E5BFD29A5D5CA33BBAE9A65440B1DB0515131F18B976EAB618767F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/soundflower-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF./..WEBPVP8L./../c...M0l.6..~8H..........f.v.I..M..P.t^q.n.[..U~......m..<3.P....MQ~......A$I....%2.x......I......I.=....... n#IR.......D.....yc....@..*.6.*&..L'Y.7|..!...UH.']c........,?S....}$.QP...2.* fP..#^......M/.D..M.4.YF9.(.J...l.4....z.[...Dy...w..K]..<..2..'....D..|..N..!.0 h.......#z;..S.bQ.t."_.....$'...2...7.#...M\...s..........)....V...jx-j..X.F..u....y.$Y.mI...}Z..T....X.FQ......u.;.F@!.$G..Q{_...|.Z\.oI.,I.l.I.........p Ij.,...)..c...m..HZ...>.'...I.L...jE..Z........,}.... ..~$.Vm...rm..lf...v...%.F..=.-K.$I{....X.z>:...6+fD|.."G.....<Y.F.m.)..#.....nf..=.{@.....LO1%sp..%.g.'...I.mKD...=.j3....#cj.).h.......pw3U.$I.#.m...G..1..n...)mX:.....Fs...............T..sT......."....C....x....P@..#.8.......:.'. .X.)..Y......6M.$4.PkFQ*...2#,..p.+.C....=*..9.f,......b*....U.o#...../.[.........r...W......4.Gdv..(...C....".Ei..m{.....2..bDEe.K..G.=..7........f2.r.....S..C.O......t...\......._..&.6...l...6.].p\.-.5..]..1X.M.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2011

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):24772
                                                                                                                                                                                                                                      Entropy (8bit):7.957537558581465
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:M25vnzn0jSbC881/J7NuRS5/XQjo1ol9GYNY:pLUSShJIE5fMoa+YW
                                                                                                                                                                                                                                      MD5:171B2DAB3540A4EDD0AC51F6DC928C19
                                                                                                                                                                                                                                      SHA1:A974C8868A468005F81BF352A2370A00CADB9890
                                                                                                                                                                                                                                      SHA-256:9212A105E5E9996D2582CCA733DF802BB60A29CB0B99831E49EE7A2C662554BF
                                                                                                                                                                                                                                      SHA-512:0B5FB40DF0828E21BD5A571369EE54857630BB61A18B9FA0C0D0EBF7B44CFB31CD2DF516F5B1E8B96CA1674070EBD31046D52E120EFF99E472E588B7A2E9824E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..`OIDATx.M.g.&Wu'...*?...L.tONJ.,$$..Y$....`X..6.i.....i.........%@.....s~r.|..C.~..X_.......l..6..|Ww.p......Xl...C...{.xh.w..{wO\.d....78.wv......o~,..F{.c..7.j...C../.Y..."...T.W.q)....:S~...[.'x...L...z:..x.}.@g....~...O.[Y..T.........].....t.;...1......l....g....v.xJk..?.....S..8362.g.y..../=8..].o.f.?...u)47}.......=...W....;.K!.~....L....{........._.c..N.P$..!b.........Lq....B`L...H.U.3f.mo.y:.p...S...w..h%.C....?...2.....-....B.....J.....E..F...-. ..H..C.Xl.NN..+>w....g...0....@.......Kc+....[K...{.5L.......".....{2...A.r]Y.....@#.......Q.0..{..:.p..).AAR..#...z...B+3K..6.j.2(...B...!.t...!R.+.4.....)D..........E.."".uK......F./_.89.........c-...@..@..U.I....O...x..0 .q.a]....k....V.B.G....'9.Y.....I)..gZe...W..C....y..d.E.V.-.{ .....K.-._I.tB.d:....{T..._..z.L,..\[^......26....4Y.N/}d"...<}a....."@I...N.A..hB....$.R..N..A.J&..j4..~.0B.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2012

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=MDhmMTZkMWQtODUxMC00OTdlLWE5YTUtZTkwNmQ5MDA3YjNh&google_push&gdpr=0&gdpr_consent=&ttd_tdid=08f16d1d-8510-497e-a9a5-e906d9007b3a
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2013

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8491
                                                                                                                                                                                                                                      Entropy (8bit):7.964646671615172
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:fNqZA5RTNNi9D0pls6/auul4sa8DBG0mzwfrpywc0GmnNXPOMZZZoyHjYz5wE:8Zyo8+6/auea8DK6r2SPOMZr8P
                                                                                                                                                                                                                                      MD5:3A0ED8AE64B97DCA1D5680892C43399D
                                                                                                                                                                                                                                      SHA1:FCD15BC825CC6AA422228469E2EABDACA5C63807
                                                                                                                                                                                                                                      SHA-256:0B98B450A74E2604F0D935A8085799DD99C3B8FBD58FDBED5FBBD47DA05970CC
                                                                                                                                                                                                                                      SHA-512:0F72A478D5F0F0A7F36AE814A7BA02A1BA641FB409C41E7C900370A140A275F8AB511903A461F05D9A2F1059F70DDFB10887B949091974DD8272491659004D2A
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<.. .IDATx..}k.m.U...9..s.}...k'N.c....H .y.......@.!....P[.&m..AT.bBBJ.....JE...-$4u..1.BS..'&.....u.......9.....D..ut.>...Zc.9.7...)./<....L...^0...z.X..>.u.DI$...,/..Wr.$Q.<..xi.&...]...._...zt.>-.....<......#%......7..e7.N.l*...p..z.....<5..|..`I0..h.u..n#.u.&...F..H.....gu..4^...9$Zp...6.*..R.}V......f..:.c....uC.F@"..v.*o6..A.G.9._.....X.0..A.V..Fx.$.T*N<.rs.A..X..KMN 5....."|&.s....... R.#9.QrX`.X..M8.m.7..u .......^...TRH.....3...O..B....T...Z..W...VsN.".....cQ<.*..{.G.V..04b...d,I$..-`..x.}v...$v....P..D....P.:'.3/..qsT...%..B..i...7..o...-ho......j.p....O...^r..+k/.|C)../.d.6.9s.GR...d.......~.o....^.1..K..d|._p.I....Q.Z...C.F.).........z...6G9.1...y...../k.x..!..A..T..+....:...g.Qj...u.........[..~"e..B`J0..@?n>c....t.D% \:?.%O..........x..Jx*.A.....b..7.g5..JP....H.. /.Oj.\......p...'.....p...K-5......5..O~..8.%.... I|u~T....R?...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2014

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):34
                                                                                                                                                                                                                                      Entropy (8bit):3.5251270918749356
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:n9m6QiFL4:nVm
                                                                                                                                                                                                                                      MD5:B205296F7C49C67BAF5B78E8163061A7
                                                                                                                                                                                                                                      SHA1:828DED5C881601F44CE02CCB9E8B98D214B5E9AA
                                                                                                                                                                                                                                      SHA-256:281A6CECFF9B473286243BDC58329C1D8141B979E8985EA968D7D975F3A50E05
                                                                                                                                                                                                                                      SHA-512:ABBB243E84448F153F337C61919C36F68F2503F14F7301A903ED76B5A321C60C09C5E5D1174E77EBE3199A1F7A900A0668555B729F008547DD26A00937FF7B5B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:partner parameter must not be null

                                                                                                                                                                                                                                      Chrome Cache Entry: 2015

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8400
                                                                                                                                                                                                                                      Entropy (8bit):7.971268007482031
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:M7APfwEkdrBm26nc0ohPKunTBNe1plLqyAPEEVhaJW72:M0PfwEkdr0tc0aVTenlLwPEMhaJWa
                                                                                                                                                                                                                                      MD5:D762BFAFCB6FAC9F6D30E6B9C1F7F526
                                                                                                                                                                                                                                      SHA1:8FC7818239BA174E69F4ED3DB0092EDF1071D673
                                                                                                                                                                                                                                      SHA-256:7C9063FD302F54B4D6B3F9923C3496EC0D5F499E54046908F56A8DA0E16B202E
                                                                                                                                                                                                                                      SHA-512:E211DE110AF6500F732ACCB68A2EADA697587483B5AC9374E41F0DBD6ABEF4E1CFAC7A78251D91190835A5C8FC1D3F1B55A9485BC8F9C638F8CA42DB1012BCE1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/mac-app-store-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF. ..WEBPVP8L. ../c...M0h$I.w.1....!....0.|...N".......P'..5...%.P.DT IhJ.#..t..R~y;..#.6..?.{........H.U.....b...4.....H..[.@bf4..o.../...........VVB.c.vJ...Z........v.N.J.....R+e..W..."T..p.l....W...*'...\..A....(.._..(^E.....G....... ../...\.3...V.\ .....;.X..S.(6..x......X..f.%#..P.........m...a..)D...X.r(.S.b..0.zxX].T....J...."i#.q.Tp...%..r....!..{L*?$Wo...i~.d.(2.g.I..".Hm.#.....v..B..;..#uq.w..m.v.....Fc).....Y8!f?...IR$e.........1....[.8..<U.m{<<.efffff.........../....=1w.....~.H...U..1*...c.XViK.:X.mi..Z..>.i..Y.x.p..Y.P.....U...'.`...`...../j.9.m...8Q.J'..y.m.7.l...{.m....V:N.g....m[.$.Z.c......?."3.......2....\UT..1...r:.T.N..S.....P...Z*.......AB.c..B...P.EL.|...:R..b...."..WR*.M.r*..."`........|.)..D+..!.*q.P.....1<.*;..%..db.0.)s.'.;...y...]....w...b,........j..=.......X.(s.7b)-..Ph.a......Q .P. .....h!.D.#..jkI..<<.'..0...|n....i..-./.{..I{+..}..h..h8....e..."%8.A.R..@8TbI...'...i..p.(.......W0..@Q..3i.M.5.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2016

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14536
                                                                                                                                                                                                                                      Entropy (8bit):7.961368941642811
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:r/cdD0tFA2NPmGU6HTZc0pUoA6/xH0mfVGAvBsUenyLBoYvXl2qPdTVEVM7uAM96:6krNXfZcz361fVGYmngBz2yE6uAMKYs
                                                                                                                                                                                                                                      MD5:7137DDCA9A5F188E13B7BD02BD46EE8C
                                                                                                                                                                                                                                      SHA1:08AD5EE489CC8E71D940727336E7BB4DF55327C4
                                                                                                                                                                                                                                      SHA-256:8E599184BD4CA12362CBFF62EAA491681246A2C55221D3AFDFA1E3FFD4E33496
                                                                                                                                                                                                                                      SHA-512:1B7B5E664AE7295629A0F5824F698101808C1E7769B08F6937D73B84720C09B28D66D5C88CB600E727FC0117A9595AA970BD9FC9586742BE462B75DF1C27D119
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..8SIDATx..i.d.u&v....k.KWU..F/@..h... @b!.c."..9.-3../.3....#......{..C....&.. H.........U]k..[.9.?....j,.8..@G.:+.s.=.w..=TVP.TU..DPE.QP.............AT..E...KU...D......_...................N.A.?.......]..../fVU...@.....m.".... D...............T../^p. ..h.Bw......l.......l.'.}......UE.&.@IT...T..Q.*..B....kN.;u..}..+++.Z.eH.....g. ...5.@.^..K.%b...O.R.Q.?...xycu..^|..w;!.@*nxh...oO.O.....M@!.*...%....Z../|.O.r.....8i#..#`.sP....A.}..m.....:6.....iBs...."..A.|..WC..:.P..9.ed._...8..0.4D.@......2.}....~...$.Q.Y......P`..wo.^.6.Y.l+...h.....@w?^.`....p.._......ql............+."....U%K..N.......OT.e..U..9g...A.t.(.%.O.....=../...a.M.-"....)..{9.........$..;I..-7...?..=.{....b..N.?}v..Yp....9q...8..K........".NC/.!.....m.=...k....n*`..EEU)0../,-......%;.8..?........* .....u*..+...\.......~....[.w....N;..%?......"s~.....{....a.....'.Z-..BT...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2017

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18113
                                                                                                                                                                                                                                      Entropy (8bit):7.979785313235813
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:nh90r5MOeT8rqEuRjDo/a2povdNew4U45SjICjn+UMSJFJYVgr:nhc5M4gB1jew4T5SFn+UMuYVw
                                                                                                                                                                                                                                      MD5:BFB60178D1D7158C0FCA6E3A8782B328
                                                                                                                                                                                                                                      SHA1:81A9D0E53118F31A037C2DF50E240A951B2A98A0
                                                                                                                                                                                                                                      SHA-256:57CDA563545D12DB775DA17CFA8E6FD37981EB536828228D2E40EECC59DE3902
                                                                                                                                                                                                                                      SHA-512:485365F2A6B54EF8AF7E864878B34CFA37D53BBE5FF0537D33210A09A1A87AEB71F487AF2130662BF4FC07BFA323B67C896EC52FFC1D3DEAB47C614882E089D0
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..FLIDATx..w..Wu........3}F3..IV.l..........r.bJ.H./7..ro..B...I..L3....-.n..:.....^..sf4.M..wG..v..w...^.y.........!".i"Dd.....%Cl........z.".DxM.MD...#.J.Z..4P.v.X..^......q..?..<?..n<."!..!..../2:.....}.....).>........;:...-<$..vk........qfB@l.jZ.57.........!!!H.....@k..Zx..D.......O...#.:zc.-.-....)..!;...u./..F.y.!..W|g...O..8.r@.$....f#....Zk.hDy...p..XD..DH..5"'.j...*....q...~..JW...RZ.*.F3.#0.t.'...&D....S.Xw.F..Sj.......f..s...;..E.R(%". .b..)?@...3. ......8g....!.m.#..0.ie"..t.-.....E......4.5......!T.vfdjl....sa=..E.....C....Ea.T...5h.46.Es...................P...DFH.....,.<......F...dFP.',&.'.....$ .......1Y.^..[I`......c..Z..@.....M...f#7............<9r..W.S?.r..)..2,a0!...1Bd\0..?...@@@h.".....E..L....f...."6x..G"jZ....2#fn........`p/.o..-....F...B...0...#...3..~..f.q+u6....D...q..k..m.WI.l...|.;W/..M.....%~.....e.m.9}.K\.G.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2018

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2019

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7538
                                                                                                                                                                                                                                      Entropy (8bit):7.963360274137738
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:CuptboufpUz6yNFr7DFd3MhAUo9zU7JUA54QAqMG:CuvtDyjr7DFKbo9zen4RG
                                                                                                                                                                                                                                      MD5:BAEF423D22DD1F82E591FB4FE11B58F4
                                                                                                                                                                                                                                      SHA1:4AF324414C1D7CA3519B1A439E9E6E98924EFD42
                                                                                                                                                                                                                                      SHA-256:6D814C893BA59B573E722E5891F853C570273252CEB910ABEACD8784B3A000B5
                                                                                                                                                                                                                                      SHA-512:0114BA56A85FF5C8445045FCD20E846F5CF4CA16CA2EF37EA50DE54A81E099901A541AB0D255B586672E24A55BE9DEA66148406268C838CE9D03CCAD7E737D05
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/huawei-hisuite-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFj...WEBPVP8L].../c...M0l.6.$.....n{3D....L.D2...j.LP.|...../..w..3..^....6.4............mm.5.x.W...U....6.W.S.Ue><.D&.........N....U+....9.D..Z(.a.D...?..4M?.4E...N..x...X.O.B.y..(P..4.....b..3..:.F.h:7.^_%.;..R9<.|....4{X...t.pJb.e..A.~..M...i.N.<O...].O...E....2.L. ..y.M..6.....n.d..s@.......(....7......4M.&L..%.0E?.4...L..9r#'.......t..y..M'}.......N...'.....C7$.FwuUe.......o.r.L.d1..t`mcX.:n...uc..hy...X.Q..5!.S..nm..I..<........9.m...e{..:..[.m.-........2.{=P.v..m...d..m.m.m..m...m..D.d"9.}....I..A.....P|.d.y.....:Gg..2.U.d...@.8.~..f.Ym....4iCLH..VMZ..LI..=.........).%.. .")..........m...T......MZ.9."..p;..n^\.9.6.$.D...W.A....e...\4b$.).jMz........{.]..s.B........"9.c./K.m-.B..;g..W$..\1{DQ$.HO1....z.~..S.:...G.j4....(...\]|D..6.......y..x..n....!L...o....~-yO.G...T10......o.X..\..&L...*.}.;...o&....`XD..W~v......M....lp.C.../.D.).1..............h.A....5dM........h....a..o.spTf.`.S[.P...eC.9z...2.G&1`q.......3...K..h.N...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2020

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6959
                                                                                                                                                                                                                                      Entropy (8bit):7.966758799391185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:R6FT6i3p+0+QHKJ69cSzGMGTV9Uyppg1MxM:oFOTQHKJXyaTVKype1M2
                                                                                                                                                                                                                                      MD5:30100EA3F4315E291F2F639655E85AC1
                                                                                                                                                                                                                                      SHA1:1794FF0D7B796AFED055FB1B5A8B1936CF3E906F
                                                                                                                                                                                                                                      SHA-256:6A44BF6BA64D5414D56A7CE9BB97864C97030872A7C0A56B2AE47F73D15F79F6
                                                                                                                                                                                                                                      SHA-512:FF5CE19BFB1DFA267C770761DB2BEC4136A079A725D9EC8BCCA039555FC25BF38E7C9619DD7067517B4ED3F4C5E1916F4E776E12A638D81E4553259AF06127E1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..yt.E...%...d'...a....3.,..?...?.1.3..0..{..,.!>d[.oY.Or..!.!a` ..p........$...V.e..X..c_u.Z..es$.}.S]U]U....K...Fc.X4..D.c~!r...}4u.^.~...I.F.}.o......;.Rm.M.!....X,..DYD.....Ny...:*.n....'...|.D.G+.7"...>.{D.E....)o.....@.v.....3Wn..hGJ.}2.....bS..5...B(.\..w``6....e..b.....$..[...AII..T|4...'.x....._.6......}x.HI..p..\.p}....?..UL*...H....D.6.@(.W.....r....,R....HP........=.......o^..."..# .z.....t.....D.q7..T..W:..mJ.((.?q.._..{.K.'I.4...Tq.%.9.....2.vRf..$?.w......N..........(a7%....vSX.}.X..uQ...H.....GB..h.P...[ii!.]T.Q?..yJ.M.yg...f....%..MF3.vQ<.Y......%....}.v.6?M..z....P.9.{.u...]#.o......P... OC..Hi.%.g.T.r)p..I.g..).G..D.)".-...p...3...*Y...d..,Ty/.#7>.......|...g.h...3..........|F..../.6>..&.FM..a.8.L.... ....U.$....$.EX......G.K...Z.(..z.?.3.......<...aq..%...@.A1=.....z...........W....za..`.l]U&....w.HX.].(

                                                                                                                                                                                                                                      Chrome Cache Entry: 2021

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.001101; 2014Roboto-Regular
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):162876
                                                                                                                                                                                                                                      Entropy (8bit):6.532050095534921
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3072:jgWSNgHPoqWL1MMeFchiZ414XtvlbjybHp/rGazzxla34cS2FXzyuDAbM5hDWH3b:jrsHYt56Nklyuk8WMoBiul
                                                                                                                                                                                                                                      MD5:AC3F799D5BBAF5196FAB15AB8DE8431C
                                                                                                                                                                                                                                      SHA1:CB0CB91A31F43293BD7042DDAB945CE161C29D3D
                                                                                                                                                                                                                                      SHA-256:F0E5A21BF5C95E4C1BCE2BE98A3656EBCC6D42A21F41C4E3EBF69DD815702E54
                                                                                                                                                                                                                                      SHA-512:A8B7F0F8759FCE064B8576429A59A0B18BFC7A6AA3B140AF43EC665FFAAD2A1CB27A2BD745435113894EC5D607A3EA706F92C19CA5A233D87F464362DD6063CB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.rtbrain.app/fonts/Roboto-Regular.ttf
                                                                                                                                                                                                                                      Preview:........... GDEF.W.Y.......DGPOSJr....0..R$GSUB.....dT....OS/2...........`cmap@.Iv...|....cvt $A..../....Lfpgmg.\...-D....gasp............glyf.....9....6hdmx78..........head.F.....,...6hhea.......d...$hmtx..........loca..g...0(....maxp........... name5ScY...(....post.m.d....... prept...../..............*Y._.<...................N......0.s.................l.....I...J.0.............................T.................................3.......3.....f..................P.!....!....GOOG.@.........f.... ........:... . .....d...........................w.~.n...i...e.e.g.......&.r.....N.....5.%.....L...~.s.~...~.].~.^.~.5.~...~...~.M.~.p.~.d.......)...H.d.........K./.j.8.......5.w.?.......l...s.z.....-...j.5.....N.............v.......m.......P...1.0.........=...9.......V.....H.(.....X.@.....y.9.Z.m.}...0.\..._.=.]...<.}.`.h.......................j.....[.}....._..... ._.....i.....!...+...).......X...@.........q.......`.i...[...i...........Z.X.f.I.[.......f.n...J.Z...x.....F.a...B...>...{.......C

                                                                                                                                                                                                                                      Chrome Cache Entry: 2022

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9468
                                                                                                                                                                                                                                      Entropy (8bit):7.9723699165659205
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:ntQ2wg8zrHopHLs966SxlMn3J9H4aVcn9XievsUMTlFIxN6:ntQK8zsFW6CY4k9XievsH06
                                                                                                                                                                                                                                      MD5:C84442C73240E9795FF3CDA465986DCB
                                                                                                                                                                                                                                      SHA1:39036A8CD322A4519C905B5CCDE1BDC5DB7D2114
                                                                                                                                                                                                                                      SHA-256:92A4278B6297E1095B3B439A96DA66B387F08BD83C824BEAA450191F8303D580
                                                                                                                                                                                                                                      SHA-512:DD925206A7A7EB4B5BF739686D5F114D5E916E19EFD2487A0617702643764F4C61B994CCCB4F148FC5F153BF53F42A511DFB27B05E4284B98273A2DA7F38B61C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/pdf-xchange-viewer-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.$..WEBPVP8L.$../c...M0l.6..\............u7..."..'.....0........[..mI.U.sQ.mK"....~.*...i..3._-.F..H...]Tt.B....$)R.=J.-...[."3..I.Uepw.[/$d.+!<.........I.j;&nq.;.....p..3.%......8&..f9\........f...r.!....?a.@.".+Q.!...}C.O"n...2..............MH...Z.E..I..}...1&((.P..kO.5.l...3..H|..B..9.|Q..p4..Mh...{..J"..n.......wv......c.,OyV.....m.8.a.;....t.....:.....|h.9G-.d.....Er........p6....L.e.......].c...tw........D.UxT*U.....:.......Js1aN.e9*.pre...9.T.C....e8qFG.<.T.....d......6..._.=..$[..0333.)>.sw.Z.}..)G..3..m.xifG..U..Sr$.$..g.%...w..9.....<..9.,'..Zkq&....Q....J.j.._4.E..H...5.yH..0...."..c.....?..x..iR....m.......c..<AS.#I.$E..<..gO...}.>..L....H.$.Qs...s...v.0 W......u.dl.[..... A.I.A\2..........:..d..&0a..L..`.L00...@.$..zm|..?..?.!.............6f/.].c....$.|>?xH..&0..LVe.....v.....XG.&..?t.Q.).!..D..Yw..:1k...0.....l.+A........@d$..7..!..+.8..;..v.-.Q.I.E!.....7.H.rlz..a..IV.#...9.@..$.iS.....!YU]d.....y.U...Z...@;.^i.#<..T.t...=...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2023

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):13501
                                                                                                                                                                                                                                      Entropy (8bit):7.957294415486871
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:JYznDHP5DsrxvSzOjMizUI1fwGVBwEFfmUO:JynDBQxvSzOjrwBE3O
                                                                                                                                                                                                                                      MD5:4A8EDA18B0E601D48B1EB73820539EE9
                                                                                                                                                                                                                                      SHA1:9A14981A193535B413D6E319F89669F28CE98B9B
                                                                                                                                                                                                                                      SHA-256:8BCDF7055349E59060559F6F2E58F8F7B392DDAAA08A155C7F62D8D573C2AD91
                                                                                                                                                                                                                                      SHA-512:7042B9853D7F9BD1B2076CCCD9710767E7BDC77CCD2F7EC76B5D38349D5DACCDF17772E895A870E74CE158BFD1FC906C66088932EB4B05FB135BB7583C6793A1
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..4HIDATx..w.\./~N...{ROP..I .I.$..0Ar~N.x..k..g{......:.....`......9...(K(g.h.L..7T8....#.....=...i..v..o..=..T#......"..E.b..i.....~......l....6x..^....3.O.x...9.. .C..hsKsWg....y.YK...J%.Ah.o........P,>.....{........Cd....tp<Fxrhb.W.@.....??X.G...h.........K/.,.J...1..xax)D*|...._?....s....T............%..g6.....}.x5<...../y.[....g.X.JR...4.H).......G.G{..8.iM.....*......<aU.q.|U..%.j._.sx.T!.....q...&~...}.;.....+.,..R...~|.O*.eYJ..`..xQ}.q...!..t4&;U....$..Y...I..3L....A,...g......0.....)D..~...U.%.4..@...H.O..H! T...X......[G.jO.T. B..$.*...T]..._JiYf.u....w.sOM........~\q..*S.....'.z4.#c..c.!@.X...C6Nt........cv.....'...IJe...V~......K..g..b..._.........}......Z.....<...W..*.8..R....A...V.q..I..q0.'.....L..h...g.T..<p...>.@".PJ....+g.nb..S7.@5.;....1.9.j.J.Q.&S.@...c7...X...6..F.pL5Bm$RJ.b.....<...X,=...Ck...I!..#Eui..)..B.Z...yu...l.Jn.....m...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2024

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14158
                                                                                                                                                                                                                                      Entropy (8bit):7.979774594727858
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:U0+3Nk1FXJREEhwW6WoDPtn6IKXqlGsxSnBdUw/FbrW3N4Iab02BFtslULjScCUx:Uvk1JjEMw559AF3W949BXLXzx
                                                                                                                                                                                                                                      MD5:3DDAE84E2055F52F4C2C58FD17CFBBAB
                                                                                                                                                                                                                                      SHA1:DDDAD221D87B5CB2FEA8DAAC11F9D0C0AD5D7113
                                                                                                                                                                                                                                      SHA-256:3DF3002D77A9F95C70019443238B4F7BC489F0E538F83AF0B8899CF85EDE58B9
                                                                                                                                                                                                                                      SHA-512:5BA43FA07522BD235EBC6DB3BE9F89BD996F6917E6851655DA02174638E8561965B0219C42512013DBA56EC17581EDE651519480EEA875AA8887C5D4AD89CE17
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..6.IDATx..}.XTW...mz..w..........*(....D.)R..^.X.K..M.I4..M3.hz6..^.6.{.0.....S6....y.3.e..9....=.B....A.d)E./.$..."O.$q.#.wP.}...M0.[.bX:.A~..YC.. .....C..A...!.......&I.0N`..8.=!..$..n."....O...All..5... ........,...i.7......&A.4.....>......\!..M.. ....4B,j.BC..''....u.W....'.......`...A........ .. ..A`?.Gc.,yk..e{.\-.......q^...3..,....t....._&.....!.0... g.!.[a'..KP... .M'......pR........%99......55.Y/]..ed....{....`... .....L.8R..M..r...S..}......;/.LT..v..Lg...m.5?...\.[....\.........|.m....Y...g._...|z..y.gG.~.c'>n).l.q...C....F.. .......X.o...w].lQ9o..onVI..J....*.l.p....c..r...<.K..Q..wKb=/..L......{.4..-..=P..:X..>\..><_.z...........j..(..9P....P...9..V$.[..{u...{B....(.4... ..0?\*.H...e.xq/..m.N.Kg..r....{.....d....X.%&....%.^yzi\..3...-P.?\....;w.=o./R.Z?..~V...........1..4..c3q7.#..._....n;w..v.P.....&O.D{z..N4.w...-.Q.$q......bU........]

                                                                                                                                                                                                                                      Chrome Cache Entry: 2025

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2026

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):18544
                                                                                                                                                                                                                                      Entropy (8bit):7.986080553868551
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:sfW5y/DYlOObOEqSVO7TWcH8xYQj/ETPK77R1qj+1XDunUK5X3mqpwy+7:s+osOObOEqoOucH4YQ7d/u0Xil5X3mDN
                                                                                                                                                                                                                                      MD5:EDE1AB05D2BD80CC73DCB2F898829856
                                                                                                                                                                                                                                      SHA1:FC71C9D998493D0369349C6B3F59BE8198ACCABF
                                                                                                                                                                                                                                      SHA-256:429B5BD943CBAB978A48AD1BE75048D6AB76D3CA3C503414005C1446194B6587
                                                                                                                                                                                                                                      SHA-512:64EE23572657B5A108077DEB272271DBED8B125D88044560235E9F79A5EFA7AE15E748CEC557629E6B748E16397BF4AD3007AF5836731563CFBBCDA3CBFD5B27
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/live-football-tv-euro-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFhH..WEBPVP8L[H../c...M8l.F..........".?.*..t{:.afiY-1Jr^TX...sC.kT&.3-rw...9g5,.G.$5..<y.nMt...#.V..[...aq'.8....].q#I...w....c\(..........G+B|w......@..v....j~..!..#..;.5;....u_/.....I.<..cz.V.g....@.$i.+...<.x...8.....S.V.2.......".......a...>D...0P%B.1Y..(UZ..-........B&.d..!-.m(:..(..E.$#Z.A..0..B.$)S.P.....}.!....g...`ao.\0...*....Ma.m[u#.:...%.!..aH..jffff..P........!..!.a[.KO./...m."I.m......{@b.dff..?/a^.l.g..=....y0.de......fk..I..}./....#..d.fW63s.E.e..yf9...333Cswaf%EzyD8.$...L.T.1...2di..MED..:...xfm.m.}.m.\{/....38>..K.....oI.,I.l..U.#.6....>w=.-#.T.}I..H.m[.j.YU......v.v.P'.._..P..n...m.F.S.l.!..j.....I4l|......au.Wi.x.6....."..V.^..w4waX..D.XYQ.N.......(...?..=..&'=.n..1....:q#4WF..:.i.S..H....Q..G..w.QpT.e......#.c....g.. ...u....S..a.....*........\..\.<..d.x.Z.~X..s.~W%#...k*....^..!5E..%KoL&..]Y..."...~.H.T.i.i.S.(...Y.=".D0..O...w...)..l3.@Z"..J.l..f....)IJz0".:L.C.9C.Vs....F(....G.y.?.Wh\.v..R..`..P5.yL..4.(..T..H4H.My..S.r6mE

                                                                                                                                                                                                                                      Chrome Cache Entry: 2027

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):6604
                                                                                                                                                                                                                                      Entropy (8bit):7.96265810185762
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:LYrmPtKwalH9xYFWavlnc4KBVpalsArY0bpl:LYyltFWa+ZBAdpl
                                                                                                                                                                                                                                      MD5:AC9BAAC8D142E6317F4DF7E4D370E516
                                                                                                                                                                                                                                      SHA1:D8A4A6DE639C34F901AF622732B36649118A64D4
                                                                                                                                                                                                                                      SHA-256:3F61D279EA263109D41C9C0D1901D78A90BD5155534013FB9FB61E4BC0C5CCDD
                                                                                                                                                                                                                                      SHA-512:824C57546535CF26B0E0846F17A61040DDB774C7821086F6A3ECA8DDFA98225272B19BD6D92504EEDEB6642ABA1EE88EDDB1346E52EABB5FCD7CA6AA86CB7F06
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...WIDATx.....U..s.;*$d.}.}.c'.I2..{...zIL"..AA......y"z....z8...#.<. ..J^@A@..H.c2]{U..^..U.v.tW............~.w....8,.p...E.:Ry"~WxB..Rx.........v.>A+?......Q...2|.(...[...~....(.U..Zf|?.R>. ..""....D..l...L.M.]..u....>.O../.........\....Mn.......O...R.I...(a.Iq!73.Fo:..Y.lYCO..a....Bn.u.?c..^\...Ff...g...e.;.........c..Q.}..&.u....X...`.........zd.=...v.......:).. n.{..T..ilJ..U..W...,.....)^.C*......I...%...<C.y.......;.-<.@....w0!......1..D<.ZH...8%..M.*...k....Z&C.c5D...`._.X..q..*e.x./...B./..<.W*..4...s..N.~=.......1_..:.....h.6. %%...5.5D..j..^.7...~]I...~.R..@..do.K..b.\*..X,...\.B.....v<...2..%.~%..Lz.i.X[....Q...Y..mV..8....,..j.o....L<...#j..:.[....._..*..|..O$p.r.(S+.J...b....}.%...D.9_Wb....1.~..`.v..$..Bj.....)...S..Y..K..d.a.t...|.. .b.W...b>_.$._=.....k...A6...._7..f.....:..).Ge.i..*...g....>X.Ht`.~.3A.v....I....g..#.K..jr.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2028

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzUzODU4NTEyNzM2NTYxNTM4MzkxOQ%3D%3D&google_push=AXcoOmTaO4Hr9i6vL2oGxfgrEWQUnqwHu-zHOA1oNcy4qsnV_H1MfYSsmmhPZDS67xliYamcfkf-pgyLbyoWJZIniBN65_zBYGqV
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2029

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):7243
                                                                                                                                                                                                                                      Entropy (8bit):7.964170719111587
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:GhP21pp54jpN+kZGHSobZ5uAzExuiPQ+YUzI0UUOKyLd/tPi1uGPqQIIJqxRa:G656tEb+AvbRUT6KyRVP6tJeRa
                                                                                                                                                                                                                                      MD5:E62514E2BB49FE85BA41E1D22107EFE9
                                                                                                                                                                                                                                      SHA1:FA264AF8FD302A429AB2847ADE59656924D5AFD7
                                                                                                                                                                                                                                      SHA-256:B619E5FFEE29220767755F9D795B61DAB2450E2D24970FF2F2C647478618D636
                                                                                                                                                                                                                                      SHA-512:37BAE163BEF0A692858A1AAD2C6449321DB5092F67B8F039CF2D386DAEEC877127AD0121777C772BFBB8CFC06E6E660F86D86B07B2FC2CB58DD08839D95EA78D
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....IDATx..}i.%.u...z[..=$..7....th*..."..%..............1`.P..H~dC~8.!$.-#..0.$...V(A.lS+.Q.(..6.3==.o.{....^......9......n.{....[03.@DD..R.I...B..'.....-._...>........1`v..,...Bi8.....l....p..Sq.....8.......IXs.d..P?..Z.t....y^.&...e.Y'...e..i.*.....1.i./Y68,S(.|.ev.p.+o.....k.V.}..Pu^f.Y..6.n{...)Z..4.*.(#.L...Ij.B"...v..,..H. ...6^....N.T.s.jn.../..U..,.....3......x..A....c..W.....s.R............QXuE.rd...N..j......7V9.f.Uw.\%..:%...5.:i... .U!.M.../.;...u.....(E=.....Jt&kN.*..k.pe.P.........Z.z...5.-.k2...]...d.Fw...c.@x..O...~?=..Q..&+3^.G=W)..pr%do.g.t..X/.C98..bY^..m-......@.@...."..(.B....z.l.-=i...q<Z$.Kt..D$T...F...._...?.K...._....[.....=...la.,......`S...Q..@...$s}.:w..D.....ubY..8. A.:Q.3;:....=.....=.]......2.e.Lz.M.A..MD................$..0..*..h.Q..T3.of..\....&iA..........t...W.g.j..$.Tt.0.{....g.+..""4..l.....^..m....6A..B....U

                                                                                                                                                                                                                                      Chrome Cache Entry: 2030

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7640
                                                                                                                                                                                                                                      Entropy (8bit):7.975052366177421
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:wW2uZdcrhEnL9EJ3ZpC9KWCelMgfjKecehev9AL:7MZQUWjZDcCe1AL
                                                                                                                                                                                                                                      MD5:C2959C74C769730E17DBCE376785D38A
                                                                                                                                                                                                                                      SHA1:41C3265D222420E58AA0D90D8DE65182F761EF0B
                                                                                                                                                                                                                                      SHA-256:3B885F0AA90F6F739867598419BBE2FB91A1EFB119E386B791176966FDC6DC83
                                                                                                                                                                                                                                      SHA-512:51A8B374D31DF4BD9A3A884A00920A129C60C80F86EA442E9ADCCAC96FD13E54FE73EBFF27EAB229790ED051C3482B1C767E91D51B46F402E9A64C156A3BD62C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/brawl-stars-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c........O.^...; ".?..}....CDc.$..R2...h..........`.]#Pl[N...y+....Iy.W.B.]..m[U.q..B.[D....o.....I..Ink.q(Q..U.....S.v..'..7;:|^..c..X.%.?I...b.@!1...C../..Y.Y.?..2?...1dq>.../T....6X.!........^m..G.=..M.a......}..) ....m..G...>...!............G.!..f..=..f.g......_2..f......l.y ...).h:[....d.e..6.,..%...4........H...y`.@.-..6i......}$...'..l.*I........Y\...=.Lgx..3333333333433WMO1WR.^..#"3......s*..7a..RhI[V..T.i...N.q..p)......6..m.R..;.....2CI.)K...?$I.....GDf..h..m.>......l.....|,.m.G[......~.m;m...RJm]...fd.gj...8f..3.m..at.R..... ..@Y.[. .bP[..2a.<...2!,r_.......Q...p.z..tT...`1..`...+......@H..&.WzJ)-.....`..C.....9...6.|Y......f..\.lG.W..4SJXU_}.`0(....4.q].n....y.fd...pu.......%..Bs09...L.I..W.D.....1(..K...3......@.-...KwL....+..*...e.QF..e\P*LY...C.....-..'RR...6j....KO.....u.n..0Wl..}.......S b....S.........S.bv....f.Q.............h..&....:c.....~{s>V..%4.R............|....].h....v..s1.ps1.I...U...%J.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2031

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12712
                                                                                                                                                                                                                                      Entropy (8bit):7.970733936868514
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:HRKyhClyPrDhsFy9ZbNVkLeiOSkNvhy+HU18JQUeGU6:zhhPqFGZRZYk9f08qGU6
                                                                                                                                                                                                                                      MD5:9D3EBE3AB0610655B8983248F58B81FD
                                                                                                                                                                                                                                      SHA1:27384181B4A04867D5B6ED8480A76A13B442E0F9
                                                                                                                                                                                                                                      SHA-256:17A0A6F9A116793E503BEE2008489F3FBCFDB41F501FDDBDF3037F443BF60348
                                                                                                                                                                                                                                      SHA-512:3DE689A8248F89317AA1A4F658FE25878F50BF4CF330B3BD98CABA98FE429450441234BF312C43F7E56A18F45569A6A104B1CACA51564FF586BEC64BA0FECD44
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/los-sims-2-video-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.1..WEBPVP8L.1../c...M8h#......?...".?....(I..t._n.{Y....Q.-.R......Z..h".}.$$.9.rlR[8,...Tk(./....W.9.x.h.$.2.....a"...(B..F..H..m'>..p2M.?.K....".1....".......b..gd.........<z...;.Q.#!DV.Y...3GT..9c.f..._>..H.k..c>..p..B..k{...Pbd.!..2..Th....D..Y#.z@....Ck#............HA:.d.y.!.A.......m.I..... "&...m.h.......u....1.;.{.l.v.F...=.2..]..T]..Ko.4.w....H..[.$K.$.B........'.}K.dI.d[H.}....}.j2B9....H..........M.$..........q233K.....>..1333.....p2....;..$.$..X../s../.k..oI.,I.l.I<./...U}.W.jX...$yM../"YY..1vl-.m.m....m...UYU....|K.dI.d[.,jf..y........_._.g..W.wS..d.*I.m.>..EE.L]u3.N...........e:L.`f4....s......]B...4...sgKy/4...q..J...:..(|`#N...G..1F>.r.LS.......u#9.....d`...?...(.7ER"0...."...f.+.i....?.G.Q...&.C....F9mAj..!..Pi]m.....W..*.S~.'L.@x.I.j.@Z*i3.m.Zj.iBl+c..<...9.16.......=H$y..G.$&c2%..`.h....VH..=.C......LA....k..q.s.c.x...#0.'<......G()II..P...BM\?i.W..{..V.L`.tQ.L.I....D....(.c.. .c.....Z..{... .qL..`.H.#..f!..Z.C...Za.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2032

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):632
                                                                                                                                                                                                                                      Entropy (8bit):7.7045372281101185
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12:wzzP4it6LWMaqfERs/tYFs8TmK3D0Qf0bmc3v4V2gqvX+YQjPFfpE:MgxWMaa9Y1XPM6c3vAXqvYjPPE
                                                                                                                                                                                                                                      MD5:E379452497D611020A3277EA24AB7D3E
                                                                                                                                                                                                                                      SHA1:C1B3C508058DF16E1AD828259D4193A8DE6CD412
                                                                                                                                                                                                                                      SHA-256:6BDADB3F49DE399B97FA6AE855B15C9495E3EC4CEBA72E6D939B212111A7B140
                                                                                                                                                                                                                                      SHA-512:0C3135145C0A7E280673B4F0ACF7C963028BA1AC018D3BD83861DCEB4179419CA884ACA11686602B109F4F114B7AD8F969AD1B82392337DCE06BF52A90B363B3
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/dit/favicon/favicon-32x32.png
                                                                                                                                                                                                                                      Preview:RIFFp...WEBPVP8Ld.../......m$I.y/.>.=H8n$I."{..G..9.$E./i......p.I.".1h.... =.O..+0..?.......@..x.7.....t.Q!EJ.../.O.>.)R$h..).Z5.~S"H....B..|.h.../-......I.wr..$."4. J.........9...+.?...o..Q4l..........4.1C1..b^....!a....6.v....f..I.Xuc.vv..{...;..VD...m.l....+...Q....(..X..U......J?L..z..8nK...,..q..+..`......G..R.<g.>&g ..~.a7qJ.......KM...cr...{.#....G8..m.....T......./....fG.iu8j.|6<.'.9..L_..E.O..$.C...jbZc!.-.`...b..\y...D.).d..Q,.D[..i.......j]......n....X.SE-Zc...... ..O...a...ET.....@..K.j}...:.wo...Z.\.....].......e..m..N.....^....A..-.=.^Qh..6-.t.....P@Mg......(l9

                                                                                                                                                                                                                                      Chrome Cache Entry: 2033

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7558
                                                                                                                                                                                                                                      Entropy (8bit):7.9696737701342935
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:zGpMfoTZvpuR9d49i1sT3zctPHRVYwcPe2oh6sdfFidhJgU:zQMaZv0RTTO3o/4TPhO6sZFqPB
                                                                                                                                                                                                                                      MD5:87B342FCEA14F5439E6261D979A0975D
                                                                                                                                                                                                                                      SHA1:0AD40B2A31BFBBAC4103CED874938CDE75FECFE0
                                                                                                                                                                                                                                      SHA-256:A4D3498822F7B7460DA8627323CDCBDF119CD923DD68545C2734D9A8C94892B7
                                                                                                                                                                                                                                      SHA-512:54B584B26B8C4DE3B003E890190B5B310BD8D6BFAD105D9E05A8BCF6049C290BCB0E978F36ADAF7838A31ABA2931FB96B59D7187DE34DEEC43D2C15129FC2AFF
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/windows-live-mail-desktop-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF~...WEBPVP8Lr.../c...M0l.6...^....{7.......4....-.*p.+f...T`K*I...M1.N.WC.2z.L2..\..l[....* ..r...........6......m...m.jr.)=.bQ1...R...v......)....w....a..R`.4.....w*<O..F..BCq.EL.].Jo....F...k.j..Y.....xz..p~V...u.......(...4C..dQ3. ..PK.A...0uem.....s..........4....\[...g..f....e.7KY..s.p<s<s<GF.L..8..m#..i.^..1..u...G.v.!...h..M.o..N..<E.<.<.T.@%[90[L.0.=ffX....4...b..0.hs..FL...d_.....hS.l....V.':....:KU.c.V.j.......s.m...=.`........w.>g..m........*Z*..k...3..B..K...{e......{.;t.ozB.\.)...].{..7...ZLz`'....`...ud7......0lff..^...-..[ff...$...j.#i.+.....JW.Yyw...j3.\.0.Ua.dJs+g...U.O`..a.]......aZ..R._k..I.m...3...>.r033H.<.~.....M..I"./.....UA...`n..~l.Vm[..R[..&m:..1.....&.j.bp .f.%.,.L.33...{..zo...m.d.,..+.....sG..X..`..)S.C......^.....m$E...j....Ao........>...{/....2!@.x&.?z.&.x.uPQ*.....p....Mx..)...3Wr....P..:v*.....;..{....*Y.;.....*.mE.....?.......?...;.....*DE.Z'.6....z.C.w.....e$.`..7.&HCYCO...RRM.`8..,..6n.....K......

                                                                                                                                                                                                                                      Chrome Cache Entry: 2034

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):14157
                                                                                                                                                                                                                                      Entropy (8bit):7.952983386806198
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:X988bpUAWsgX7PjbHk0T9htxkV2vM/gGfYy9Ohb:NnbpXE/DbtRBGz9Gb
                                                                                                                                                                                                                                      MD5:83717688112F6206831247CB51B6F556
                                                                                                                                                                                                                                      SHA1:7C4AC1E3A04E4BE21B27C5977B32608565FBAEE7
                                                                                                                                                                                                                                      SHA-256:AD676355F83BB3CFBFCA89940D7CCEC842E38A5EE671915F6E3A062F73A22E30
                                                                                                                                                                                                                                      SHA-512:2F5F231F9ED490A7F00DDA8D5B461720233FB0AD6803715FBE12AA0E900F12228D8BE0A618EABD055167AB1B10451619DEC2B11EA54E57B6BCF57CCFB52A058B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..6.IDATx......]....{].....=JHh.$l..06..Y$N\.r*.....d..l....Ev."^...U..$&..p..&f.H..n..Vw..~.}_...z.9-...P,...%.....P..B.1.BA... 0..`YR:-....k.b...m.o.....3...a^.....C..M..V.sK.a..31....ga0..7Y.2....-.f.xF.FP..-..`..F...!.$.!0N$[`...62.... ,d..G......-.d.!.0!d*N...c!!#0...#..?..!..Y.q".T.l,.Pa...|.1.[.9..0..9.@`...$@%.k3.k...T.k...da...nY.?9.......>=~.Lsm..G1.t..mq+...8dZi..........B(0.....&..<#.-.m.lK".=..j..I..g.<..v..X.FO.L.j....L....o#.e..........Q..%......tbD.......+....*.....qk.*.3J.`+.....o... @`^0.....{.D....KYA.FnS.G,/..G..W.]......hQ.C+9..J.../.<'...)..o....m_.7..TC.'3I.$F...V......T..-............{.|.O,K1.%.DH..0..R..../.....777..W^.....w..[U.!5....5../U....R,...D......^......e(..E.e..G.8<...j*...~..F.F)"3j.q4P...{..c........6..TP@3N!K.B......?B.A...3C.3G....r.<.....$........G.{*nj.=vmh.....lQ..Z`.oK.....`H.c._l.....z8...#..I}....M.}bI.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2035

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5474
                                                                                                                                                                                                                                      Entropy (8bit):7.948427976781425
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:bLwO+u3EyiOBu1V6gjUcP9BSfEDX8x6bz+I9+GnxY389HXQShXKuHdttUOLZ4jwj:bEu3XK1Vj/9BS8r8xQJY83m0AOLZehte
                                                                                                                                                                                                                                      MD5:37991B87E83A99512DAC4FB7C191B8D6
                                                                                                                                                                                                                                      SHA1:02EC0A3895AC7922FF84A6B473C441700562DF8C
                                                                                                                                                                                                                                      SHA-256:C2467F57736053066FDCAEB8BBE683BAADB0B1BE91CA47D74CA44BE6A43B8C03
                                                                                                                                                                                                                                      SHA-512:ABC66EBA4F4362677155C4BD7A6D847D8727F4CBBA1A074E61ED272D2D98B67136209FA028C6751E544BDFA4C1AE35E2D19D49F8558EC7DBD3C2CFF810786C32
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/microsoft-powerpoint-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFZ...WEBPVP8LM.../c...M8l.6.`.w..............mn&9.mcvj...'W....r.@._5.b......I;.-g.G.....n.8.m..%....X7...<.7.$9R....a.<...@Z..7.$9R.G......7.......A..$$^.G[lo./,d. .x...L..0..?........T...C".D.`Z.,...5..-..E.}.\.%is.A.d..&.....h....W.ey,.......P..}../>.CA.6L..vw.D...l...9.&b@....~j.vm..y4..Z....[...N.a.q...v. .\:.......u...@.f{.............l."IvNDfUu.4]........y...yi........a.....2#.h......GG1a8fN_J.9t.fj...Z)...w.Ri..*.P+..f./......Z..33.]*3.iL..m.m.J9........%.O.-Y23...^k.#IRd[.Y=.....`..73..S........i..Z[....-.`9/,.y.d.e.9..F..iY0].fh...M+..&.....&r.-.U...c,..B.A.L..eY..a.)B.2.:...Z&.b9N..5.r.Y.2k...c9.y.&.:$.0.9.h5..C.m....i..ed..I........F.-.H.a9fe.&...h...Br.,...Qs..E.Tr.W_.C.js......y......l.1...u]...e9,3.<l..d..ey....'.i.ey.N.I^.i.v..Ec3....:M7d}i..\....l..B......}.?.....tIv.fD.]v..9'...e..&"...s.........}.u.~.......a.&.....:lC..B... QM...&..C6......y...q....8A9'3&|..z......:.....3..G..............Pj.&....\.3..D4....q..s..T..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2036

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9318
                                                                                                                                                                                                                                      Entropy (8bit):7.953115488561078
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Aui1RytaWJ9SOeC5RiNWfOSJ8kM0iHTFSOfdzmTo523UZTRrfIGV9tS0Lpw:AlrWJAr+iEREFSOfdzmTDCRLLScw
                                                                                                                                                                                                                                      MD5:016396D10C623DB6E1A90C6A891A0209
                                                                                                                                                                                                                                      SHA1:59F5FB90EE62DC9004AE4D0D02D606F5F054E9A0
                                                                                                                                                                                                                                      SHA-256:43D72790EFE4CEDD11BC6E855E0CB162E25C2C70264F41E4931086820A30F2F9
                                                                                                                                                                                                                                      SHA-512:F31CE78A544E49E61FE3E04DD0086B17CAD32C5B34205C3236C6C77F29F6DF53ADC52024EB237A63B42B0F85E33A546B8C9D90328962485CF0811F3FE055E5BE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/wordpad-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF^$..WEBPVP8LR$../c...M8h#..u.z...D!....y..I..im..3.$J..go...3}...$Qe@s...+...K]..$.U...T..k.......G.$E..J4..#.._..t...H.U+.....$....a....-$.....(..M.<.>.n....G...T.TR.f"B......~e....DJ..-.9.v.....{..GD.....p.r..z.... B.......tU...E.....F.7...|.B,.>.@GG...DP...*..>....L..EX..}....@D.OF>..../..$.(R...Q^HEH..m.0I.......Q...........i..7.A.....Y.e.kG.d../ "..y|rR..."p."...!".b.+.I.mY.$IZ.~.V.k....m..w..--...$I.l[.$!..DD.j...W..ET......mE.l.jm...3./f^9.+.>.y.\0s,^.IME..>.sl.mK....{...1.....U.P.1......$I.j.m.y....k3DwB9.;:q.>Z.H.m'..{...2;.LS..I2.....c.K..AW.&..WU....K....q1..zI.NDJ.p|-z.......H.""..f.Y.......%...&<0..`f.....#....,<F.}..=.h. n.9..Ze....k.`!..!..s......@(t@....-X\.`}..E~4.....PP......oa`>.A..m....EH.....,....nP(Ra..5bb.....t...kN.R.L.p..v,....dX.......?...4.>....#f....f.m?.~..,...3...i4.#......e......?...w_..v..`..v~eX.Q0.6........w.@~2.....~...^E*.......0....._........y..e?..h..C......).w-9.....m.a..mu..........w...........

                                                                                                                                                                                                                                      Chrome Cache Entry: 2037

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):4704
                                                                                                                                                                                                                                      Entropy (8bit):7.955535489271561
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:L9nSe2P352dJzWtr2HKAzXWRKwFXFGFYGOONeQtRxiR:hn5wkdJmsKAzXWRK+iYerjW
                                                                                                                                                                                                                                      MD5:7109920D774EF01764F0110AC86C2D37
                                                                                                                                                                                                                                      SHA1:17A8280C7038156270C0B92BFAB27457D4C9BD71
                                                                                                                                                                                                                                      SHA-256:CEFDBB4DED491E70697420DA13A47FEF47139250B0537739F27606CBB4F1BDBC
                                                                                                                                                                                                                                      SHA-512:007A548E57D1F2EB205B43A3BEEFC2444B17A5AEAF73E534ED2789DE4F15FCF0D985C1AA3991331D1A0FA4B871086F88F37476C992B3E378BA39034446E79C5E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/microsoft-office-mobile-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFX...WEBPVP8LL.../c...M(h#I.....,!..........F".d/4GH ....'...7.a..,i.Om..2...G...q$.J..C..}.8.sw2`"I..V$..9...G.P_..$...2...5.DU.'..R.....l.....N....[..%NNrB/L..5Ig.....&j.-..`......&.y.Z(.cy....:0y..........n.OD]L......9.n...f...;...*,...$g.snD.,.[.{...I.Kc.7.{.a.{.I.K....a.. m..(.RyCs.=.MBA7<..mxF!;..E..v..s.+.,...y4..I.&=4.3.B.......d......W>.6.R.....T5.... M.USy..`....1.(..,.C.K3.`%.k,(l..Dk..iQ..6)......eff.W.)K.#k...#km.bf&...AK....v.m{.....4ncB.i.Dt....`...*...=g.H.......O.YB..D.....H..i.m4..`.d.g....t.=\<<G.........>...XcF.<7.uM|..Wx.....6..e..xJ.m.g<...GY..6`T>....TR<....=...g.w.._4G...~.Y...>+.....~c.B.x.0..q....K/.....L..X_x..2.P......?....A.gd..gF.b.0T.C......Yq....h%....B.>lg.....r.4......u&............7..R.Q'.....QO=.).\...^...6..|..W.B.9q....C.9.j.R.......9..g>.>.U...5.1.l....\..p.c..?.zL.IMs.`...^5P..=#.<o.y..`.|.1.>G.x.9.=.k..'.}...........N.(.Y`-..4b..z._.%....`..KWL.o.z}.........?.....!/RS..~.r.y...y..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2038

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12090
                                                                                                                                                                                                                                      Entropy (8bit):7.973382735121626
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:lItloQ65TILqbzdnTmPXrYXRskg2b1QApnRRtVxmPh0akHgolF0j+6VYisFosM6Q:lItl80LshnyfEXRskgaQApnRRtVQm0o6
                                                                                                                                                                                                                                      MD5:4232AAD73867C8BDEA93C2148B33351D
                                                                                                                                                                                                                                      SHA1:E9D3399EA3B2F2228F2A3D4328F78B6A133C4619
                                                                                                                                                                                                                                      SHA-256:9E52C14C2C0245C6280839F49A6F56D26F9E7A238F4B784B429E9CDA0849FC89
                                                                                                                                                                                                                                      SHA-512:B654C4C8A5C2B1BB25DFE8E972A160E45145D2E8A1A2F124BFE2441354017EE84756593EB156935AA34E35A668F027AC5217A819C02F170C68ED57D5AD17DF2C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/unofficial-tvtap-pro-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF2/..WEBPVP8L%/../c...U...mZ....."b................zA.v.._&.....6...0.vH3.a.333.p...A.....~a.[:./T.r.R9.\`!t).B...|7.=.S..N.\..sW.>.f.+4....:..|.6c.b.N..1.]`.)G..{.cg...mf.O..D....65(5..C3J'0C..|...2..5o8.t.......fc:.A.pF..Bh.C...u...RfH.m.(.....].....?...iZ.\....$..".0..]..]3..H....._.C....A..j..Qm.....$.m...m...x7v........} .m#I.......\...F..Ln._o.{...q.s..;x...;zx@..;.;...w8......vql......_..V....\......+DE....K..B....%D,@.K...E0... Ze,A.M/d.,b...6.*.)B..(G........i.....".Wex...w.l..J`.45 T.....!s....mO...(X.{........U.r.Yd.9..2.d..(.m.n.].....:......&.$..m;.Hk...6..m;c.m..=.zT.f...m._.....IR.f)_."H.E9^.....H.{. .T....Of..2C.._........`.....:..C........L../.LS.<........2.z..<.O.T/. ...,...w........I..@s..K...`...#...0.N..N.....~.<!.......\.Z;<c..\.6...a...2Z.e.H..i........f0..=..A.. .....P.OEI..J..^&.i.i]z..a...{a.a..w...Zy.7..)q.26J.=t.....7J19...52.!.X.aL...jE.w.L<.3}...) ..1.C.M..@.....d&..jr...Lg..CPR#K..y)..]7.3V.....6mtM..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2039

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                      Entropy (8bit):3.8915414066556506
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YGKeMfwDpHXAYHf1HJmM+sJiK4:YGKe9t36RLp
                                                                                                                                                                                                                                      MD5:82AFE934CB7D3AC2858D3374014A24FB
                                                                                                                                                                                                                                      SHA1:FA6FBDCE4D72662A4FE391989A35280492FE367A
                                                                                                                                                                                                                                      SHA-256:2A16AC49668DBC041EC09F7B52668E59828413DBC65FE1C8FBD6510E72E52471
                                                                                                                                                                                                                                      SHA-512:7C879D04F27F5A53EA8E89AA45917C56B6816B7F2E044791975A6CAB9D155D9C7E603464FC52984A17C37A600B91859F97935E6160A2C5C7000E7807486970FA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://apis.cmp.quantcast.com/geoip
                                                                                                                                                                                                                                      Preview:{"country":"usa","region":"fl","city":"orlando"}

                                                                                                                                                                                                                                      Chrome Cache Entry: 2040

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):42
                                                                                                                                                                                                                                      Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                      MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                      SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                      SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                      SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                      Chrome Cache Entry: 2041

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):12248
                                                                                                                                                                                                                                      Entropy (8bit):7.9677826673811945
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:dmiEV5gI6VTyMKYHo9PZyg0yhs5Mu/JjCMn2dyW+8w/Itwg+7Iza/3JODEzV1h8I:Uj5gI6VeMKYyBrC5RJjch+p2uZOSPx
                                                                                                                                                                                                                                      MD5:21EBDF04744430947D2E6EB63DEA4FAE
                                                                                                                                                                                                                                      SHA1:F2978F3A2C4FF592DC12EE8C6644F34DF8E6C0D9
                                                                                                                                                                                                                                      SHA-256:C5852EED250669010E97E0BA4219CD4A755B08D999643275812FCC00BDAD81DB
                                                                                                                                                                                                                                      SHA-512:F24426FE18C9581241106A1E6F7E1D102EFE19A1DD9748B40A04A5BE29D5DA23E253727C93CCD22FF89E34210BF4ABDBA5666C05ED0F7193EE8B3546AB44CEDA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/gacha-cute-mod-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF./..WEBPVP8L./../c...M8h.I.T.....xHD....~.-...6MK(...4...Y.....`.~.R.KR@a...].>.&..*i.h..A#I.....z./..]8n.H.5..P...y.s.X..$Y...G...h.....{.....& n1...2............S...aB...~06...Lw6`...ed.wJ.)'j..|..3.F.?O.#}....^..7....`LRmJXRF..$...C.....`...........#.....>.4.~&Km..%K.&..{.S..Y.'..K....J6..../._..7.....0 .`.0..m....."b..g..U.P.iR.Hj.*..0..Vf*H.4..Ae...$x4n..I..I.m..#Q....p..a..W....`...Ir$I.....9...-I.%I.m!.EU....5;...$I.j..a./.e."I.m.E3s..........2.."..HUE.F..$.$..YD.=...8.30..%.Ke....{.$I.mK..X.>V.S.C0.....9...^Jq..[.$9v$.Gd.#.......}8g.!@.W......I.m.$IZk......j6....jc"z.l.m$..$.f....?....6[.....>...#..U..i2.Z%...u..b9.....i...L.#..o.bh...<$..o..~3...T.....x.O....?j}.;.../D$.M.L..}....4d.#.,b .o..~$y....F.Y.B.}{.....'....{lb...g..}.....^..........t!.....l...>6......Ter..G{.H.......d. .m.B.+.............a...8.....S^..n.Q..~.P..\...-...>...g.Wd....L.......S z.h..`X.... .fu.6N!........n.M8.9.......]..j.p.W_..l..q.......\. .\=/6..rx

                                                                                                                                                                                                                                      Chrome Cache Entry: 2042

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):170
                                                                                                                                                                                                                                      Entropy (8bit):5.335916817166796
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:yionv//thPlE+tnM5OCAadCmy42/uDlhlbGlo+4/iRXTECLrlxyxtyaC/tIlsg1B:6v/lhPfZMQC19s/6TdKXTECL6yR/iVB
                                                                                                                                                                                                                                      MD5:E7673C60AF825466F83D46DA72CA1635
                                                                                                                                                                                                                                      SHA1:FC0FCBEE0835709BA2D28798A612BFD687903FB5
                                                                                                                                                                                                                                      SHA-256:0B8A20373C6DD04E091902226D922B3688143A8938AFB9D283D889DE7B55CEB5
                                                                                                                                                                                                                                      SHA-512:F1C33E72643CE366FD578E3B5D393799E8C9EA27B180987826AF43B4FC00B65A4EAAE5E6426A23448956FEE99E3108C6A86F32FB4896C156E24AF0571A11C498
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ6CZstELKvNH-ojiSS_3eD_FezaRbPZFt3J2f8QIMY2SygWm-M8RtX1SrQ6XS4q9S6QeAYUYDCsqBs0j90y2M74v3IPftb&google_hm=eS1wd3VVb0c5RTJwRlhlVjhJQzd0MkN2TUF4bWxlM3JqaX5B
                                                                                                                                                                                                                                      Preview:.PNG........IHDR....................bKGD..............pHYs.................tIME......-Q.7n....tEXtComment.Created with The GIMP.d%n....IDAT..c.iy......+........IEND.B`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2043

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):13966
                                                                                                                                                                                                                                      Entropy (8bit):7.984583499907952
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:bddIg9Q3VqYRPRWrXtuPeIOzj739nTvgZIID2:ZdH23IYRPQrdB739nzc2
                                                                                                                                                                                                                                      MD5:A0AA679D3B85F775EAF4F2B4FC6BB7B4
                                                                                                                                                                                                                                      SHA1:1B70DED8F2195FDD1C0B99E2E2E272D8377082C9
                                                                                                                                                                                                                                      SHA-256:A3D0C6D76B8878A6697871635E98984156E645D844CA2C1A5B80D78120CE3CDD
                                                                                                                                                                                                                                      SHA-512:CB6B2648C10C03B92815105F72FF6A109502D82BEC327F038C3DAAFC5F3FB130A81DA21988B1EA544CB08EFE08F3031B9EF98A03C44285612D9258D584B8B30C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/tvtap-pro-tvtopp-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.6..WEBPVP8Lz6../c...U...m....v..D...]u9C..`.N..iS..n..x.._.h..]333333...2..tI.....$...``q..y$...y..\.]i.H....G.\C.[.......0......q.X......0...ohT&C'...:......\....b...m50...)4.}l.{.....=.8.....=0e.T......<.L...j...m8r....v..|)6gt.m.L.v\..z....;.u......L.L... .6`7R..."."..../..m...;. ^..m.y.....,c..k.m.m.m..{...1...4j.2N..m.(.9.9..X....$.89@".y................q..gi.{...y........O....;DM..x..a]....#.F...E...30..>.....U.%.;v.... .^`G..k.........H...d"G.........X.@l....pTtd.F...\.......Z.n0...........9.'.6r-o................]...I...C..C .g....[..g5+.Y..t.>j.m.i.}....m.........B..B....H._.m+.d.V..3.V..J.3.rT#U.. 8...L..Cp#I..X.<..x.....5Jp..x.A|....G..H.......6......h..^.....v\k...n..].....J|....E..X.[.[.W..^........\.N.z.K.Q.w.V.K...Q....W.....!\.Y)..K...j....0.a.J.#\..w.f......f$.4..j..a<.3.y..0..2.:[.p..../r.7.B..R......`j]u...%...q....@.......2.J5......p....O+...C.X..X...K..........[.q.R....5.u9..........E.iP3.YF.....f..l.u.=.y.7#K..R.....M.8lq...\

                                                                                                                                                                                                                                      Chrome Cache Entry: 2044

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):6254
                                                                                                                                                                                                                                      Entropy (8bit):7.9075848776908835
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:HAW1VSZ3U/Dxvu1RAGhwnqE0PFQTjrE+9y:gEShUFuAMPaHAOy
                                                                                                                                                                                                                                      MD5:F97D4EBD9BED05A7A35E0570C29E561A
                                                                                                                                                                                                                                      SHA1:75B6897BE6B30F27A3D9DB22365BE74B1D67995E
                                                                                                                                                                                                                                      SHA-256:150B9BCF1F84A53AA135AA97733E4862FEDAC9AD6A17840D922AF5D858F572DC
                                                                                                                                                                                                                                      SHA-512:48E3A60F52C76F51FB3E3C9F0BDD9E6A23BD9B27CD8BC74C9E829797529ED26F41C7004A0D8F3C3F43EDE20DC1619B299F6A7AEB5B5CB88721B6C85A4683C2BA
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/pdfcreator-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFf...WEBPVP8LZ.../c...M8l.6.`%......v...O.$UIRwK...dsaw..Y.lX..'.x.~..5sa....<....t...9=....}...E..)%....F.O.[..H..)..^.....<.F.n.6.$..u.Nh...gO.a....&...0.I&..p....(.XV].O..6.X.J........xVO.i..b....d........ #S...2....1.WeJd......O.*...3.E(..P...m....x......l2#...t.ej+.N...].!. ....m....{.O!"&.l.....:"...Gi$Cf..(...V...].$I.X.|...KF...l..b.....1...G/l....x.l[.m.<..8.6..Bl...;.%`T`...eI.$I...{.n..`.3.1...m;$I..%.....(dUf..5.m..E.\.m.m.m.......CO.m..m[mc..8...V..4rv]W....m.<..Xk..$.$..../...e*...<g.L.........}.........g.....e."..s.......P..k.08.....c...o.wo...|.."s........lx[.....:.M.".Z......jH.%.......N.....K...z8..%...uu..Y.y...y...7.6....j..T..x..p.@AQY....{>;./...8...1.....b)...Ns.54.Z.+g......o+..Z.~3.UGw.?->....^.....!.u:3.F=.p....0...a)2;...pF.z.y.6...z......>L.8..5..o......L.t..0......FcC............S.Z..7.....2.F..%..m...{.|........................`9.K....G....= ....]r....S.K.....(`....@.x`...`.....aF..{...Dy.&.0.........R

                                                                                                                                                                                                                                      Chrome Cache Entry: 2045

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10046
                                                                                                                                                                                                                                      Entropy (8bit):7.973073813106869
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:NBWpI8gG1ajSwFFvLBG2XRpkH0c69TAZqOGzkTctfR6gv2bMUDO26eOD0:Nwi8xupvzBGeFcea+kTKyb2oOg
                                                                                                                                                                                                                                      MD5:B5989904508B774778A8D04729957A26
                                                                                                                                                                                                                                      SHA1:A651FAA85879949CCF46980B3F14AB161E2F0B4A
                                                                                                                                                                                                                                      SHA-256:CDCDDE6F06D3E949F3CF3E349804E3995A58462AA79EF1DB9BD00B28D5750496
                                                                                                                                                                                                                                      SHA-512:4BD4A53ED563559EF31DDD1879EE38ED0F9D70B23474D5759F11A7A610F7B4AF2BF116DE3E7BDBBFC1D91C5CDD5521D32B2C8912D969579B377948975EB4A1FB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/brawl-stars-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF6'..WEBPVP8L*'../c.....m.F.l_.....CD.......@C\P$...M....m%.V.O..)..K."..K.^.(.[N.....H...)..vw7w.t/\..*..|.K... .;A.H..TM.A".b..A"..GE.mm.U...D..=]..+...L.. .9""....A. ""B!M+....Gs..i......k.f)...5F..g.H..`s......b..n`.j.%S......,).`...(.=....R.:..)0h.1z..R(..k.........K....{...[=.-....._9w..=..w...w.....,.8.`."....j.....T......m...!....2333333333...y....s.^/....?...U......U8-K..O.{o...J.....p....\.d.Z..f...h.;4.|.UI.E8.,GW[..3..D.m.1I.m.q.W\............m.m..m....L..*].q]...m.m[.R....Z..>.m.m....9w6..+..\.gcj...[.......).(...|.....v...X.+<C...`..P..x..0..(6<.'F'...2...!.R,...aU....6k2.`p.Nm. .(.lk...I.`.?...T2.T...h.).Vhb*.....]."].%t...H7.&S....S.2..>......m...*......!Nc.0PL:...J.....}.K@.#..2...F.tF.2.<2`Zi..(......p.............+.CR8.T8.....!.......s.$0U..b..N.O1..0..-....l..4n..(....CfS.dk............d8...g..5.\..G.O...{...Q.^.].....X.....%....bBc......X.!...@..bk6.,Ix.;..D.5p?8.<(...Y......U....z'...x....7....Y_.n.....>..%.`.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2046

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15281
                                                                                                                                                                                                                                      Entropy (8bit):7.977689247403851
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:OHe5/mEfFm6ySzbe3tMDAk4OAD/h/PZMcsP/8o1F:OSm+QNtMEPV9PZMcsPPT
                                                                                                                                                                                                                                      MD5:EA3EA3DCBCA83A3C46386709B23763EA
                                                                                                                                                                                                                                      SHA1:C0A436E2568A2EBCDE35BB69AAC955049F203596
                                                                                                                                                                                                                                      SHA-256:92AB60B1915E6A0A791C50AD475EE1E5FF474AA7748CD437F8ACA3AFC8675DD6
                                                                                                                                                                                                                                      SHA-512:F4D4188FB502EC70D17F41E0DB39BC4925B8B719C7504CAC508E101167EEC005D0AA059D5CDD314BFE00A2229A520FC3DAB58AC87210D22DA21AFF3B3A86EE85
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..;<IDATx..i.d.u.v.s.[r...........3..b........ (..@..eE.p..._...C..P..B.mQ.i...E...3.1.........k...-...............z.{..|.K.......T...W...R.M.@...*..]?.....E9..L....J..+i.j....z.;.b....A.@D....."V.n....$.&..8.jF..fs..f.V.l.....E....4.......$.Q2.+HM.....7......^.q5.q..0....*...."c.Hnk.%UUUB.N.On.......(.......*........6.....cGO.8rryny:^...I.TM..PU..B.,...~.xQ.U..*........s5.......\.1k916f0...`..f..w..#R./.....+@J.......j.c3@.IUEDUDE.;...P.....s...w{.W.....!.<...O>...Sw.mj.X.......}...R(.*".$$L..._y.G....t.+..O.;..pp.3Kb...U%.J.$LJ&\.2..!&.W...\..^w...3... .oX....b....e....g.fy.....].x.J.,~.C...3.].,B..l....4.Y... .q..m..z....~.o.....N.:v.n.....W..L........(...Y.....?...y.)..M.w~.j.:..H!J.Rfm....p....=...>...~.<|`...am.l..c0.....+.Y2.....W....=....?y...6..|...A.HpF.WP%...`..>..dj3.r......(.i.O....>H.b.B.<.x.&....../...o^.p..............a..5.:.D..*...F..p

                                                                                                                                                                                                                                      Chrome Cache Entry: 2047

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):12171
                                                                                                                                                                                                                                      Entropy (8bit):7.958996468243355
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:JpH1ZEY3DAMgHHXJpdMbcjAXU01nlO3P7xHUXq81o8LsZp67R1UqdupWTMRe43dZ:xZEY3Df6dQcjAXjuf72XVP7R1gpYC3dZ
                                                                                                                                                                                                                                      MD5:7FD7E38C529F33D7FDF25D0898835F0D
                                                                                                                                                                                                                                      SHA1:E23B2B65DC77816F4445C0694623867B094EC25D
                                                                                                                                                                                                                                      SHA-256:1D22D39DF42A532D9934C0967467D0989B7ED135DF127C807F188FFD718F8DF8
                                                                                                                                                                                                                                      SHA-512:98C9A2A9288CD9952A6B01D617464D71CE418A813B089FF5B30D85E5F804DE77BF46A48F7AB5FBB3B9026ECC51D147046308AE478B39BBC1D1627173C11F7A18
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<../.IDATx..y.].u'...{.s.\..$.F.&.....IL....vl0..x..._.n.I...;...~......8....;`.x......1H.IhBc.TRU..;.a...s....d.w......u.:k...Z."...! .( ..~C@.7(....7..`._...O............m.L.k.kOw..:....L...//y.o..z..o.....|:...j.2...7.......Y...uC....n...a.L.8.H..."N]..])...c..n..... S.O...^.xf..Nh..bz!.k....@i./.....$...4...`(....H#|#.. . ....$g .w..E.Q.P,0..$.....'.........k...8.;...T-...Q$.v*.)).?#j@..A`A.A.....D....,.|{......Y.a..HC...C...l;z.....k.+.....y.3.L..E.o.R..<. ."...Z..;n.F0.!"R...C.q..bE...#@..@....m.s.Y..S...".06....oy...h.g......QJic2....Y...V\h..<...R.......[pBD...YD.a......E.....f.9.D..7..tV.>.....E.q....?...&...]..57.4.w.x.d2..~.$.|N.r...z......C&.........(Ff.=$B..3...G..%.x........p.:...:.......ar.k[...d....../%.8G.(.( H..E..B...Q.8... .....He...#.@#......G^.....qq.A+RDD.H..J..Ec.+....0.."Z..vn......^.....A..........0.SQ.,C.........V.}..#....g

                                                                                                                                                                                                                                      Chrome Cache Entry: 2048

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):19254
                                                                                                                                                                                                                                      Entropy (8bit):7.985014482361322
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:MSaYtvvS5nbn+y52Ec7OSkCToG/Mur5l3YQI3OQcS2icep01SY5Oyb6e34Jv:/tvKVhsEc7TDToGEuDyX2qpSSY5Pme3I
                                                                                                                                                                                                                                      MD5:5E88C945959477243286C31E378219EC
                                                                                                                                                                                                                                      SHA1:8504F6661F0411823E0AD555767675E9CBD7C514
                                                                                                                                                                                                                                      SHA-256:1A781CB80BFF38D1209B263AC2FCAEDF2A6ADCE6329F8695BB8D92FFBF044641
                                                                                                                                                                                                                                      SHA-512:0F4658AB0B4895526A6184EE5208878F65DB662F4007F944C48ECCD5F770F8342832B1116538B9D4B510B9D20DAFF863374E35AC64E34E0471858CE9704BA70E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/ultimate-custom-night-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.K..WEBPVP8L"K../c...M0j.H......<s.".?..L{.._.2sP.._.'......g.\jq.W.s...$E.....&G*.I..*................m........F...%r.=W....|1.vf.@.).../pn.....TQ....$.<..}..N.8...;.-A w.8.....A.Pn $...8 ...Q#D.2F..(...o...a..I..!F....!.....'...*....1..G.Pl...>.*.8H#vq.(...![...........m...io.!D....7*.t.].*....PN&......o$}..9I.6....=.>..=.m...m.....cu:........{.s.oI..I.mK..="....=..k=....x.7....@.QUeF....$.l.D.<"..xn.......0F.]c...p3..........c%..M.4...g..}<m.m....>..mtw..q.&.t&.....=_.q....Q$I....2...{f..g....}..`?...X.....hf.p..H..+"Jf..\...<.0.=O..3.YQ.^.`.."..;I.b.5.-T..W.....4..zM..?;~..gW.n.~......[.R..UC.w.^^.].?...}......C......_..g.~d............_..[.o.^.....=.|.{.w..8...._.....KI....z........{.Ss.....o.O.}.O.w...e7...........w..^.......?%...>.+..$.3......_...cZ...E...~....D...7..o.../?........M.=@....E.... 0.1.......x.d@*.....{....}<...(...#.l.o...r............H..........~...>...W.f.....1.xW..S.A.q.y.$v...o+..U.....G......@.0......f+pi...b

                                                                                                                                                                                                                                      Chrome Cache Entry: 2049

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):15356
                                                                                                                                                                                                                                      Entropy (8bit):7.969812617389736
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:uCBmPwzWk6reCWW0BzFekHskuj/uEkkpo8GJHQ7Ssmzxc9Pdiq6:uCjsreCWW0PeahO/q8KHQ/mzxgdk
                                                                                                                                                                                                                                      MD5:C0B7946CFDB260F1B27AA52771E26782
                                                                                                                                                                                                                                      SHA1:9B29C22535449C8D3E2B6227A437E9A8971C0568
                                                                                                                                                                                                                                      SHA-256:2C29B85E5DD88A7D24A1571E9E560035B151748ADDA1AF1C11EF7F2CABE7B084
                                                                                                                                                                                                                                      SHA-512:52BEC570350EB059347677240F860C52BFD43342B0B0085A830BF5CE6859A6634E46A75E3E707435116033782E10A0BFE68BAD37E20E8EC64128B0756D972C72
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/battle-monkeys-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.;..WEBPVP8L.;../c...M0l.6...oy...n...O.Z.$..a..s.J.f,.{f..~....,E.k...d":j."..j..........6.?..A$I...U>..-.....H."+t....x>[..{....(.$9R.....e.'......t...1e>....\.......J.....2...m{_.i...00.q.a........bZ...<..R....S...1.....K...L^.....>)..a..L..j*E..B.A.C.......@..n0.q...?......D[s.tb._....V..<..+..0@......i........]un...m..3T.C.....Up...NT...p"A.@Pb.]u...m2.m.="3K.>..ms..i..Y0.t...lwWUVeF...m#..$F.....o.^.$7..H.y........uEL.om.M.m..!..Y.jt.}...x...g.B.3.d...h.YYXKf.)...n.$I.d.%...Y5.F_.+xu.6l...AcfUF...H.U.m+R...z.c.Z....cRe.....`..:.ZK.).s.m.$i.v....GR3...!ju.u.n=.V.g.|WG...u.7..[.$K.$..d.K_...f>.~K..-I.%I.m!.yd...........}.?C.....3..wuMO[.c./.m....m.....n.kj.,WeU*2.m.m$I...Lfdfe{o.....x?.2"$...m.R$......%Wu..XL)....+..g..X.s...N233.d..`.fJ"CF.....!0@Y.....f.X.`...$.......;a...A.g...1....?..]...K.]....WcG1$0JB.1...b(..ec_j.;:.>..O......+@Q..%/.$/..S...##.a2,3..H..Xs3.L..1k...).......W`@...z?.T....cvIi....Q.Q&....,....../X..ba.P...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2050

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):8138
                                                                                                                                                                                                                                      Entropy (8bit):7.898065532812352
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:laGyR35xGYMi6ysSSK5ft9F8V9DReLAPLvc5:Itp5xOiLs/KD9FOe0D05
                                                                                                                                                                                                                                      MD5:A0E5ED38D525BBDBFFF734BA4DEF819F
                                                                                                                                                                                                                                      SHA1:7A9B15B550F2A4DAC0BE7D3C0967E309A82DEDCB
                                                                                                                                                                                                                                      SHA-256:2C6A0C73FEB743E8CD169CF068E33E2E3B0CB368B39DA45B56F718DD55159080
                                                                                                                                                                                                                                      SHA-512:A205959986C251537C66B4B12BAE06BB759BE3DC265017C0CCD84CAFDC7A0EF782CA3FE32FBCB8D02EB33C4663117CDA4149E49133096E16A32D649F7C1902A7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/speccy-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c...M0h...g.......!.....+..1......J..>.~..W..p...`K..3..l.KT..M.63...Mk..0.......)...$)R..w.(...../*j.........U.....D."..".@...""....!K$SD.Y....J..A.~......'....._.\.2x~......W..L..."........(.A....~..1....*...%._.....l+T..5.....:..mk..j.6.y..$.Jnffff.]......{..v...........c.$'.w "&..m[k$M:.}.d2s...Hfff.ea.fQM.......*ff.d.`p43I...?*,W..sd.m...6h......Jl..a.c.V.oI.,I.l.I.=.....?w..tW....m.!I....,...=m..k...C..msl...h..Z..TD|._.$9.m...{$...c.=g.[1.0.Z...5P...WO.$9.m...yD.\..k..z...Z...1.#3=."..k.`.P........#."..G...5..a...:.......7..@.0..0.E.`...$.........@`.. ...9...9g..!.A.....L.4.U.2p....!....L2c..4.H..S.(..h@ .....1.#....9ezW.....c..f.4....s..N9.;|..c...].0..1..1..P...3NY.f.){.~........h1u,.T........iLL..e~..'0.vl... ....Q....... h$.r.?..I..L..$1.1&1.......H.._.[.#@.....DPIF.......wL...AP)@e.1.........jZ.@.8o..7....(<f....vf..HF.k....+.+..i.3..n........`...` ....E!1.c....)..>g$==...T.....R=...\.......Bd..SI..;3....pL......z......

                                                                                                                                                                                                                                      Chrome Cache Entry: 2051

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9622
                                                                                                                                                                                                                                      Entropy (8bit):7.9607898268863035
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:D1Sq3FQSLtcytPqSRGcFvNVCEs60VwhG74NRH7nZc2agoTLHNRk:hSqie6ylbRNVx074NRO27gLtRk
                                                                                                                                                                                                                                      MD5:8D9E2C7848358493C9D524449890E9F3
                                                                                                                                                                                                                                      SHA1:98433BDB50531FE71CA518E0C3B37258C9781D19
                                                                                                                                                                                                                                      SHA-256:7E679458E0EA3428204AA7ED8F90454E6AB53BA286585841C698F55E6A17163E
                                                                                                                                                                                                                                      SHA-512:5C71A137C9808AC2F584B700700F7F23EC5C600057C9615D98D636097A18F3D0D10D9F2FAF9951F95EBF36141AB9D147644871A4024EDB093A4C78978367BC4C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/minecraft-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.%..WEBPVP8L.%../c...M0l.6..{.;......".?....s.....r.".+9...I.$..$.Xk.\...>p.ZR.`.6A...m....p.I.#......Ygi...$.....w...../..$)R>.ob../1Ol......7.bk....DB...9@g..$..V..9/J?Z.~Y.K(q.i.,.:...<L.S.i..!Y....`.ydN.a....qDN..R...Y\...n.`...b..?.].>...|...3.....P..4.?.{!D...G..Xh..bS..J.XVf.Y..9b>..m[.m.bjc1....j..d.....hY..1ao.b$I.d..._..3M.'I.e.$.I.{...=...........gsL.&.UI.t.}...U....3'3336s\9...UU.)........>=..Us.-I.%I.m....GF......Z..Q.Ou..p3...I.j.mEdi.of..\[ .`w.%#|..H.m[SDT..=<"y1.U.U.j./fH..sW...oA.,I.$..53....?.nB...$..~.o87...Hm.}l..F..2F..h..!F0b....1..0........H.c...qAo...@....@|..f....2....{......1......l...V.-kZ....a...L...D.a...`.x...3....9.f.G.#.2.5Y3..8.F..w..1......`f...=S....p.+..(....?K..>p;......DZ..........7.O.....$R.......%..e.....P....l........^{=.._..#....u......=?......EZ ......qm4........2.1;.w.J.................6.g.....>..k....w.. ..@.`..G. ...@.S.!....?.+....S.....&...+Z.P/...X.{.......Vs...H.8#...`4X. ......1F

                                                                                                                                                                                                                                      Chrome Cache Entry: 2052

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5092
                                                                                                                                                                                                                                      Entropy (8bit):7.9369464289842595
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:stJFVDOkOMomFqSVlIZ4hLMKnbL0KYA9BiJxPncV4I1/aOoWGPmlu1L0T9s:stX9JOMomYSVlIOhdImwPnS4I4VJPmlw
                                                                                                                                                                                                                                      MD5:C70827831A0737CCDB95D893AADD3221
                                                                                                                                                                                                                                      SHA1:CF41A218079500C8C04F98C486F7814C96CA0AA3
                                                                                                                                                                                                                                      SHA-256:B2752493477A033D981B5EAE37AA5A778F59DD1A62C62D450309CD9C3C70D99B
                                                                                                                                                                                                                                      SHA-512:DF10229BF7807E5FB29A6EF77479C7001543F0BFE34FA7F2C6062988E442D40C0689FF127D58867000DFB0638FBDA11912F6DBB13928EA6CAFB73DCB3B2F7C7C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/slender-mac-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF....WEBPVP8L..../c....x...........m.ic.m.m..n..n...^zg......Y....kJ.4*..{.`..>...<.....?...mz......L._.J...6G.+..?mB.)...*....?./.X.\..7.<..D....z.7B........"...d<....DQtb(6.*j".A.*.../..S..c.O.T..%..T.zidm.....m.......R'5.De.Q....7....F...e...i...e.e.2.z..J.5...O......W.O..l.\.D...f.g..k....i........z.O..&..W..V ...8J....oj.fY..kH.:R.RV.....$.r#.r.g..c9.].X...b.Tm...~...8d..]~..v.G3....jY5.ZaJR...n....HF1..3..9..vJ.s..i.h.L..<..V..h:..H.....5.IKF.)..4JO...V6.r.u).BD..X..I.pg%U..:4..-...:.O......}C.r$.m..8.g...,...at...5R=~.Q.5P}5...j.......^..<.........{........W5.3.8.q8.in.ry..:.&.H;E.k$.-+.d"0..JAM.3HV:..SuF..y...t...b].K...~..Y.-e6..).\.....6/...Q_.....+.,.-9_.....su....L-.|t..TM...I.d )W.......QC*S.Mq.Z..Ld..r..x,...]..J.........z*.k.Y...FVtb...)......Jd.V..qkp.....H.i..z ......W<.{..ao.)_.Y~....m.h!3.0..hTM.?.B5..FEU...,..ZUkU..zJk......b.....J<n2j.H!..S!.>B..)..B.}.*..FP...,DH..)1.n.R...oX.`.k.U/.w..Y.*..`.j.(..a.......&.k.:..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2053

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):13760
                                                                                                                                                                                                                                      Entropy (8bit):7.974113886974945
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:IF5sId6YZyAfxKdl7KrUsTV1CofwOHRtJBLO:IF5sIVuL72UsTV9f1tJBC
                                                                                                                                                                                                                                      MD5:DD157DB559D83484BA6BFC643E17F96B
                                                                                                                                                                                                                                      SHA1:D2AC9900A62F82FE9061A5BEDF2CEB0B5F96C593
                                                                                                                                                                                                                                      SHA-256:33A0240B1C14927C578CA942B8D1803AEF98FD8636B64482C1AD57A6AF9A4E42
                                                                                                                                                                                                                                      SHA-512:D24C15818E3792100B661E8B7EC0FB5B41CEF7F2C22E49C0FCF2D3C8564B0E21F9E7EA371C2B559AFC29E5E061FA574A79AACA9B8EFB6B2CBFC73AE83E8E5541
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/ravenfield-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.5..WEBPVP8L.5../c...M@h#I.........-...O@..c_u..*.x.[......,...2..{.s..WS.}U*........,.m$..p./p..':..:.8..H.e.......:s.c.q"I.........K.).......d....H.0.mi...u...Oz...?j...c..E..q.CF.P...@.. .....\x..A(M..I.....F@.Q(y.9.nq..{`rc8.@.h.M.B...0..dddd;...8....m..v@a.....#$..........013....JT...)j.fv..X.0..m#%..z..BDL.S@.hT.%`.U...%.j.....Z...eX.....~.m."I.~.QU3s.H.d..af.%.....c1.y........"r..$Y.$...k..g....f..|K.dI.d[D,f..u.....<.....a....$Ird.-Q..1...c|.p.pj..Nq.Omc.....*...W$I.m.....9'..e......Zc...[.$K.$."b1....7......3..f*.....C..m....H..m^.m....I..........8.}.e.j.$...\k....$.E.%.L...ctK..).$I2w.....Yf..~.......0T.e...).......%A...D...LF...@..#...N.1c..............T....I_.t..W..5*.....2...U....v.H. .#.&.P0.(....T..X..UJ=qB.@............`..`.f..T.....9...t.._.......E.5...Um....'t.....C@K{%.@@...S.......V........c!.6..]F.p*...2[..$X.A,... ...4..Q"M...".g...s..!.[....SG.1f.[.\%..CeF.H. ./}..>..[.V..V.........P:.J..4.z*..L..=o....RS.8....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2054

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 3520, version 1.0
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):3520
                                                                                                                                                                                                                                      Entropy (8bit):7.931011732748
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:Sq8MSLNCQTilvelfD22JYEpt//yUTK83sFBWFPdr:VMNhGpo2DED3jTP3YwFPdr
                                                                                                                                                                                                                                      MD5:1495C465F8B66F64094C9D5FF163D6E4
                                                                                                                                                                                                                                      SHA1:0923046C747B5B732CA91013F12E9B00095DB260
                                                                                                                                                                                                                                      SHA-256:6117060A9640C268607F9F9F26889C1CBA88AEE1989E9CBB5F4BBB2B0B3C7DC6
                                                                                                                                                                                                                                      SHA-512:A624562B546EFC5F6AB39AA6A5202D2EF1D44E2D312ED0DE6314A04792B323D07EF1C0AFD5918D9475125E43B9E7024A376D66DAF34B7B24E9E4D55075E183B7
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/fontello/font/dit-logos.woff2
                                                                                                                                                                                                                                      Preview:wOF2...................f.........................T.`..~.........D......6.$.,. ..Y..#.........#.q ..%..L...wA..JbmQ`.....QN.........`..f{...;...w..u?..w<...j^6............s.}N..ag$"..?:.......h,..G....BN}........%.X.M.<..t.(* ....7...6........o}E..zZc.....*.f&.C.E.."&..).J.yOKF...Q..bP...e{K.....>......@.E..5.:...\o....N.`..C...L~...L.83%....<.....-.Gt...x...s.W.ZH.?...F[.F.{.W.`....+.P0.D6}...4.o9~.... (...{vm!.g..@V......>".Y{......5.20........*.]|i.c.?.= ..........$..G<.';...t....T...w....:`}r[mw..G....?/.1..1..)..h ^.....W..W..W.....1..A6..l....."......<.q.y....{....p..kZJ...[.o.....e....:......q.`.U...vW......%%_xl.K)O._w...9.-.f..\...^.0..{|e...T..tt........."#.#.!...)l....V..!..}U../...`...Ba....7Oe\5...k....Re.......,YJ.M..Uz...}..4.R.e=....p..y^.c.K7N..#.,.&...bls......#....P.. -......{...k#..Z.S8T,=/..o.....&.Z.....e..k(.!..f&.c.h.`....J.d.....=r:&k..{..W.po......A.m.......41.k.(....%....h.oD.3..)( ...B.V....q...i..........?...r

                                                                                                                                                                                                                                      Chrome Cache Entry: 2055

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):2352
                                                                                                                                                                                                                                      Entropy (8bit):7.892590315031195
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:1mtlycpqZEgVCrR2Its7v2vOvt+soU1ckoS8GqjRaB:CEVEVZts7v3vtrojSqNe
                                                                                                                                                                                                                                      MD5:3713DBD1CF1B0773645D9BFDE9505696
                                                                                                                                                                                                                                      SHA1:DF6BED52AB21061D3289543BA0A491B7F37D060C
                                                                                                                                                                                                                                      SHA-256:D5100434F963DFCC2151DB127ACB409ADF8E30178675BDCE592FC5C02A17E277
                                                                                                                                                                                                                                      SHA-512:CD90F9FBBED268574A488A9AB3068325A05FC24AB815CAAEEB9240FC3A57CE28FE54B2C5289ECB2EC9575D66243C81EF6540ABC4225CE435CD7198E86E7DA3B6
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/curriculum-vitae-europeo-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF(...WEBPVP8L..../c...&.../....3-.5.......|.n.......A1sTT.........l.......n..W...(f...56.57.6...0.0..D.....@....V.QS...T.Q{...*.b.ZH.$..Zk..{.m.o.m.mch.m....hk3$..=..m.l.]h..2.....r.m......Cp..$W.nM....?...V.+..m......X+....\..+.4.K.*q...HF......&..H.E..G.....f..Wn[.+.R..W...q..-....q.\.LV....]..dT"....sn..(.....8..o..@.cy.t.j...U....l.J...7.....w.N\.W..$...........Na2...H ....vU..&..F....D H.B... #....^........K.1".r.Y...........X...%...2.\I....7X8......7W.$.h..Q..6........r! ...7GA.NS.!D...@.Z....*6.r9.m2B..Q.;BU..$.....!..I.....,Um...Z...l..3ho"....,..r.e..M%.).&...;.....oe.Y.3c....`.....V...=...ok..D..)d.`.^}.H...1..;..~.^......c..E..s.(....2!....&F..1:..E!P..n.!...%!...,I.J.o#..`..)..pn&..S...n/Tx]..xR.."0O;... ..H..X$.#H..#.T.&.6{S....F.P....6.s..:.v.f.>#Io.G.;....,..n....y.e..xP.Q......$).,..K.#.H.x~.?T.Tsa(....0K.9F:.Hg+F(.Q...Ja.......A4..>.?.....0........-!6G.<...3v.0J!UtGR..wB|7....H.d.I#........Y..;2....u...#..Hb.x.?.h!=

                                                                                                                                                                                                                                      Chrome Cache Entry: 2056

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1226
                                                                                                                                                                                                                                      Entropy (8bit):7.113915996220454
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:hXx5dV3dGaN62U5CyAzLqJvHqryoKxmf5jNPqJzXD430ec:hDdq2UQyAHqJvHqryBo5RPqJzXD4Nc
                                                                                                                                                                                                                                      MD5:E9BFCE47D6B4CA438C06813D4B687BD4
                                                                                                                                                                                                                                      SHA1:114F55CBF7D2F4F000B5922E65DA87767E12D6C3
                                                                                                                                                                                                                                      SHA-256:79CB3E1D6B6DA8A8412A35EC1723EECE210B5363BD804CF3731ED645029BFD40
                                                                                                                                                                                                                                      SHA-512:4A432FBADE9133833287C68AB56BFC0A9341FBF5C5A87AA04D799EDB204F66D324CBAC84E5DB8107E2ECF694CD8CF6C251CFD823F65D125163D39343288798F5
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....D.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE.......nO.nR.................................................k=.mA.l;qqqrrrqqq.}..}.rrq.nJ1z..}.2z.oQ.i.%|..}.%{.h..i.$|.i..h..h..i.$|.h..h..h..i..i..i.%|.h..i.qqrvpi{pbyqevqjqrrrqq.pV;y.>x.lKsqo.i.@w.?w..|..}..}..}..f..g..}..}..}..|.uqk.}..}..}..}..}..m>wqhxqh.mF.}..}..|. |..}.Zu.ype.}..}..}..}..}..}..}..}..}.tqmuqltql.}..}..}..}.rqp.z.+{.rqo.oV.l..l*.l4.l0.l1.l).l3.l+.l2.e..e..l4.mO-z.'{.({.({.'{.'{.'{.&{.){..}..}..}..}..}..}..}..}..}..}..}............tRNS..........................9..............................................1..1..!...66......5.....1@.@.6..:...3..7...........................5..8..A..@'..l....IDAT8.c.........R..R.2.p.I...0.B...O.&......$.xJ.*....!.3 .V..)..D..`@V...R...$/. .......zH.Bu........8.0....U-$y.#.<C.#...A.D.4F.G8........!.p$......!.w............V.6(.....wpt2.........Hqq.7w.OV/p\.x......C,a.....N.....q$gH.i.a.......T...R.........Y\. ....i.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2057

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):10553
                                                                                                                                                                                                                                      Entropy (8bit):7.967203818354565
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:9wr4BRicdCJIs1c4mTlg0JqvH/sC2B0j0VA8JSo83+k4wlnG/kTT:9wre4y5ReH/sCe0j0JP83+JwlnV
                                                                                                                                                                                                                                      MD5:9EFEA363705277EF4DA2CA6B6E5EDA14
                                                                                                                                                                                                                                      SHA1:E6B528B06522E11B35B75E381835F355D81CF626
                                                                                                                                                                                                                                      SHA-256:9ECC2A6BAAEB9548D8E9DA3BA9196ACA45FDC8048CDE7D4B2B1E86BC2EF8D4F8
                                                                                                                                                                                                                                      SHA-512:D451E8DCF10C8A489C894E6551DB1FB06A6C9CB4412F57DC4E377A084D51CDAE81BDFD471425C265F5CFD39C715772923A4E6EBCB42AFBE203FB3F5B418F19EB
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..(.IDATx..}i.$Wqf.73k.K.ju...v$.H....`.......f.1...x<.0......`.............,.. ......]-...Z..r.........=._.I.......fd.._|......6.g.M..&.'...x/..F......'.fM\q#... .|.=I.Z+ ..ud.R.I3a.L..........F.p( ..2zq....T5...e..>.I.....%....HU5..n... c..;f...@ ......c...P.'Hf...V..."(.....p{ &f.l...P.....{.....(D...z%..5...k...*..g.tHU.%b6..l.c6L`b".Z..r....uYx(..E..)6..5....@..L`.m.s.Z.L.'H..7a.....@DT%..a.,....9...7.mKr..(..i.R.dG<?!.A'[....C.6pA....G."$..j&....(.Yk.-.mtH?A..'..SU.EU.1.bc8q.>..2.cE......R.8frL...\[....<..<(........[.x....-rF.O.(.LPU.s.<...~...W(.E!"..f5l...%./-.uK..%....qTc.DZ.o&.*.54Y`b..0....0.J+J1..^...L....Q.Q..H.3s..Q..G....U=4..{_.9P...\....?-....k.t......a....P:.g\;../ALd..H....v8<.I/..Wo.Z.~.&.x"...ql..J.G..c...S.>.s@.......W/....[.t.s.R..2...G\.."&6.....SL.l..[.%S....*a.q.D..u..Ta..R.<....6.5g...w?.k..+.1%.%.x.x,..I@d..Q.dJm..o..../@.n

                                                                                                                                                                                                                                      Chrome Cache Entry: 2058

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:HTML document, ASCII text, with very long lines (634)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):1174
                                                                                                                                                                                                                                      Entropy (8bit):5.74166936214599
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:24:hY6t2eJJBewfHDdUg8EcvjHODQMJXeK+C6uS/MLmeK+C6uSGymWAuDSXeMzCUtVv:9V4goLHODS1CTXT1CTVyPyCM6Nu
                                                                                                                                                                                                                                      MD5:2FE2B1F17888E326B010A8CDA72D48D3
                                                                                                                                                                                                                                      SHA1:59CBBEEDE4C472024C482BAE8529144119BBBD27
                                                                                                                                                                                                                                      SHA-256:9A9B7FB32E01FD70747F32EFDBD0472FD681C85EEBB0C42D10C7A514820A0062
                                                                                                                                                                                                                                      SHA-512:30BE2E73020EB97A67709E47DED40E999D352DA9B94EDD946D1315BDA65AD616AAA3CDFCFA675D061E4ED4AE1BAE3F0D245908D44411B2425C49B4345D2F6607
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
                                                                                                                                                                                                                                      Preview:<!DOCTYPE html>.<html>.<head>. <title></title>. <script type="text/javascript">(function(){var f=null,g=null;function l(a){var b="";n(a,function(a){b+=String.fromCharCode(a)});return b}function n(a,b){function c(b){for(;e<a.length;){var c=a.charAt(e++),d=g[c];if(null!=d)return d;if(!/^[\s\xa0]*$/.test(c))throw Error("Unknown base64 encoding at char: "+c);}return b}p();for(var e=0;;){var d=c(-1),m=c(0),h=c(64),k=c(64);if(64===k&&-1===d)break;b(d<<2|m>>4);64!=h&&(b(m<<4&240|h>>2),64!=k&&b(h<<6&192|k))}}.function p(){if(!f){f={};g={};for(var a=0;65>a;a++)f[a]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(a),g[f[a]]=a,62<=a&&(g["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.".charAt(a)]=a)}};function q(){for(var a=window.location.hash.substring(1).split(","),b=0;b<a.length;b++){var c=l(a[b]),e=window;e.google_image_requests||(e.google_image_requests=[]);var d=e.document.createElement("img");d.src=c;e.google_image_requests.push(d)}}var r=!1;

                                                                                                                                                                                                                                      Chrome Cache Entry: 2059

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10248
                                                                                                                                                                                                                                      Entropy (8bit):7.932626577918532
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:vne+eK4ip0k+1K44if6OS+CVtHDXdP5/78XJM4xxj1kgENGj:vnXW5yJ1VtHLddexztsQ
                                                                                                                                                                                                                                      MD5:97D8191A0CCF255F551089FE7E5FDE63
                                                                                                                                                                                                                                      SHA1:538B96CBF430C63BB77DCA52886262D402A5ADC2
                                                                                                                                                                                                                                      SHA-256:8DC7317C60BFDA78672B114AD44A29A300E692F07A8AF15DFC520DF6423734CE
                                                                                                                                                                                                                                      SHA-512:4DAE95FB76A4E3D4698C67C59C327D6F4CB0D85C3E3C11D9F4628809BDA8F2E56019CB745DCD78B6B96244CC5B378F40A3320AD3B83BD1D29CA922002C959020
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/windows-media-player-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.(..WEBPVP8L.'../c...M(l...]..........+II..U N.4V..I...6.......l.H...?....1k.6R...$8.I......#.v.4.%E...<.{].]....F..)...M...:f..V..HR...t.Gu......0......).R...T...C(z.-......f....w..{.1#..p....W...|.".6....G.C...._.v.?..b.>.pD.Br.....v..... .JH(....j.`.....].^x...g...7......i.N#.v.}...h......ikd...Q.V.B.nG.ko....o..4.. ..s4?....rC(......T.?.........\.aS..Rt..1..&.Y...."m.'._?.m..mIR.G..A.*`..V....../P9...#....Ir$I..s...W...T..$.$........Z.t.._.$..m.Y.Z[..0....;.;....s13...Z...o.+..$Ird.-.3..cL..>....O.N.TO..c..s...7.+.k.$..>...=..s.Y.......:.1v.{.5go1..%IRm.-..B..vj0x......33Cc...Z(3.....m..R..Zkk}h1.B....m[..9....Z-..d.......'.N;....s..f.A..._33D........q..?.|..O.W.`.,..v.2..{..'A......[..#6....1.@/.g.....b....'.#F<..q.g...l...1v).c.`f...F..H..'..y#.kpM.s.r..e.e.1 ..P"...6.0..td5.......U.....mo[...u>........B.Rh....%F>.......E...R.*#..%4A.....M..84...s&.......A....$0...G.37.:.L!..4}bf......gp$D.>$.`.ls.@.c,....`...B.%.Z(.EUR..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2060

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):15282
                                                                                                                                                                                                                                      Entropy (8bit):7.962311713829546
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:uZx320RRTHn6S+W5kTguaWxAbBL+FKMXZ2:un2IRTH6Sv5CgnbBL+8ME
                                                                                                                                                                                                                                      MD5:C0AD4A1F1E2DEA59D18C007F083F5927
                                                                                                                                                                                                                                      SHA1:E4EBBAC8D4EE3649A0567C86FE2B44331024ABFC
                                                                                                                                                                                                                                      SHA-256:D1A5A15BE2C1187D4C7847AB7A4CFD7AB03A91DD3319DD6097A79DB12CEB04B9
                                                                                                                                                                                                                                      SHA-512:CCCA4103B00A7DDDA9471E830F0FDD4B40718C565478335BAF6FDCC6D158A7E481D29BD0EB00D0BE6ED1495B89802DACA001C544D6621972FAAAEE06B274EA5E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..;=IDATx..Is4I.%.T..|.....R...Y.D......L..9#....o..........|.*..8..H ..........._?.''#srr.-/... ...@.@...?.....&.....$..;.....<..1:.\..."..1.#..4....r..O#.....?z.r.J..q|..CUC`.......u~....U.i....\.@%J?}.$....X........._...2.;..D\...._..` 0.3.y......5I......q....j...~.,p"...x.........4..9PkMM..p%...o~...~..<}.u..n<..,....0S7W...O....9...^...o..).G....@..._.:.(u.%.8.B.pH,...8....f#}...).........M.[X.\N_...m.|86....qb2r.$._.v<1..x.f0.o.t5 0.......4H..GO.,....{....6...\.._....y)U.L...........T..C....> ...TO..._.<um..>.......O.:..m..v...].x).X...Q..Z....;....0Sf.k.?|.6..p..y5.j ......~$...c.o...n...6.?..O..a..Q.G338.bH.B5s.Rk...6l..8 .T.s.....S. }:0P..Y.P...I......X.M$l.bj..a0;.p7I.z:_"....8..]..p..RLN..M.=....n..^......7..^...^.$.T.y...i........#...!E.u......x\..i.~.....>...q....R......1 n.L.r..j9.|%xJ15M#.......Ob. ...9.&w0.:./.....lr.u...@F.A...&9|..&Y...$._.&

                                                                                                                                                                                                                                      Chrome Cache Entry: 2061

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):7762
                                                                                                                                                                                                                                      Entropy (8bit):7.972431815635849
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:abLa9+wURFnBrlbervZpj6D2tG77wR91flnruTh7yL5X:a6MRFnZBernj6D2PRtrK5yL5X
                                                                                                                                                                                                                                      MD5:60AB59A82C34F10841D4044A4DDA71E0
                                                                                                                                                                                                                                      SHA1:6B9B6EECE5153046586444EC50B9E474CC16F63E
                                                                                                                                                                                                                                      SHA-256:15E552DD11EA6FC586B0A40F6F570066A21AFED9A4C8BE0FCD3C908AC5861C7D
                                                                                                                                                                                                                                      SHA-512:F2E94F2746126D6128A9E9C323EB268BC97C9D515166A449F1C621AE8CB17B69532D1C93306A2FD0680D1535E324B67E201F583869823D862AF5B41EC75CD38C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/windows-live-mail-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFJ...WEBPVP8L>.../c.....m#9Rf.k.#.F!.......p...;D..$..$._..8.$.d..7:..f..3.,\..*.w.7....I@....i..F..V..X.1..?..e.g0...Z....`...W@./."....@..q..h..%.J.1l....z..}.;.>..}.~..w..)H..y(..)S.tY..v........;.,6]..B....&.....4)H]@xO.m#.......}.2.!F.....!.g..@..!...1...?..5WY.P........Oq(h.Fr....D..X7Gk.....J.s.....S$.......M..^23.../.{......;fffZl.....xf...q.J.!..#..R..fn....|..<n.!.4*.Li..........Ci..ph\:.gm..I.$.y._DT......y.;.X...X...Y.A...#2...LYE..^.m.n$.}.}O.e....Hff...3c...~.{.U-.j%3C.Hfp...Y...'&...m.$)._.D....z......Z...g..a:"...HA......T.d......J.W...<.......#$8...m.PN2%.......:...8h#..w.Ad..+&.....C.^.... _.)Q."^ ^.'...P..T.....a......Y...A..;X.'...Q..b.@l..G.g......+...tkzB...Q/....;.X$..R...OA..Gwn_C....AR0qu.*3Uq........1.H`$.nq}.Ih......y[..L.Cd..p..iHw.P.:..,*.R....T..9.Dp..t..UnY}9RY._.+...A.M..H......C...-..%....@....fg..H..i.e.....y.T.....A...v$.M8_%.D...n.......I.QP...<.].!....).i7...=..DU.....e.....a.|..vO....a..U..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2062

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):10792
                                                                                                                                                                                                                                      Entropy (8bit):7.980556738699022
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:gpdPrGLw8Jd9Yho1EMjCA4RBe2UdDHvvJ8XRk1ml/osLo3DP1q/e7iKVdNX:edyLhYho1EM5PvW2mla71oe7iKx
                                                                                                                                                                                                                                      MD5:2D2AF175C7CA51E29235E58464BE9F54
                                                                                                                                                                                                                                      SHA1:E2F1B18CAFAF5B290305737F9B54090A8BC916DA
                                                                                                                                                                                                                                      SHA-256:1EC7F17B44B8E17084C83178E131D2C24BE3E9404B5ED6BA6EA3EC92E504D261
                                                                                                                                                                                                                                      SHA-512:FBC867BC412F076DC4A14B88CC5D656C3446D85D4F1D7F78DAD4FA5CCAFE3E6E803EC9814F48E74DBAB020CB0CDBE3454AEAFAA9163045300AE97BD935B45D12
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/android/football-live-tv-streaming-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF *..WEBPVP8L.*../c...M(j.HRv..'.....O....t..`.J.F....`...c.tIN;.U-+........|.^8N$.....k.y.c.M.4.:#.F..Hy ....t..3..I.]7.....ca..shg#.F...h..........._....@..I$....iJ.(....N.D..".f.'.H.....lDD.cd!.....W.7Bh.....K.D.._...B&..E40.aht:......^).=..~...hQ.=...^.K.tT.@n.x......)S.#....JH...M.....BDL@....8............?.g..I..FdfU5........~.....O`.3fff.a......23.f.?.Vk6..J.Rj.).......[.h..03.F.~.l/......P.Q-33c{.2S.a...O(P.v........).X.m.m.m{;..f.I.q.../I.U.mK-Zkc23.?_.q....,[......y.#.vR..i.W...m._.w.pO.wH...M....{/.^.m.=<.mk.V.....6...}/.{......ZWs...#V.h].gV..kE....[5.....a.......F=8......C..m;..B..2....m.m.m.w.v.*.UY....p..mM.$m......2+..f.s...........>kfJv0.vL. ..PP+.0f"p....u.jA....@.S.M..x...].s.w.1Si..z.k...`B=R.$%I.F.t......c1].0U..y(/.O.....S`.#..\..%R.-$.... K.tU*.(.X`...^1...Ox ."........9..^./X....,A~"jCf......a.."[P=,...E._$X..-..'7.t.7.w(L>&...H......j%.@..|b,1.........3.?]..s.K.9.%...%..W.C..1.....PrN...Vb..i.a.E.j/t.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2063

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):20241
                                                                                                                                                                                                                                      Entropy (8bit):7.966120700817038
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:QLz3wZmQayISN6w1JcZDgOXck8d7HzssmYPC3gI/6y7MJ4s1wT7dv:QPArayz1JKgXzs1ECQIBQis1wTxv
                                                                                                                                                                                                                                      MD5:9E8233BEA56DF6B8262CC5283148EA49
                                                                                                                                                                                                                                      SHA1:722D840BF13944C6FD8E3A312AD55D8337994DD5
                                                                                                                                                                                                                                      SHA-256:99789239F2DC2C31C915DA55AEBE9D0C6AED48AF3C1E5E201B981F8BEFC97379
                                                                                                                                                                                                                                      SHA-512:C99EEC741168FC5AD6D1C28AF5E27A1CD9A0CD35505AD8757B1DAA7B813E1EECDDB3870823BA86C5EAFFB8D74FEDBF123A38D646D52F2D6660D53163193C5180
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..N.IDATx.m.w...u...s..L.._y.U.].`.@........H.NA.....n..h'v6vW.M..;dH......i8#..CR.P"H. H......ht...2...i?s.=....B.._edfT.{/..=..;..R.D......1.....|..T............|..p.=...).....D..Kg...9..iRk..8.J...q.[j..)zE?g.jZ....s...r..."..6...).L.e..XA.Z.b1.....Y......U#.j..."...]...c...LsF..l:Z........CW..Y^.6.........\..z.ehL].x.4..Q.i..i=y.\x8.Z.lgq.. .h.SU.@.U@D..!0...."..smh.@......3G.Y..j....)...>.. G...t{Wf..48X.%..+...f.E.h..L.!..".H.7^.....49.....qs.\K&..'.. .H.....A......20m.j4.......J..../U .....;BC.d..2sH)&k....{k5..<dy..ySGc.(..(.* ....M+,...H.4..\n. ......g..~...../.p....3.m...8.k...0<..w.o.?.~.OF?....N...p..........[YZ.O....~P...@.y...7....?W|.}.....cel.......y#.G.~.W.>.....A......p{...W....'....W.=....EA.R.8^...DBb.TU.Z.e....YVdY{p..=...6..V.....M../.0....(....D.*1FR.....z.+ D$ $...r..i..?..Y8X,.....K......"_>...S1..!....-...Mx..mC0.9fg?.....;[o

                                                                                                                                                                                                                                      Chrome Cache Entry: 2064

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                      Entropy (8bit):3.5
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:YGKeMfQ24:YGKed24
                                                                                                                                                                                                                                      MD5:055DE8F64447F10ED2C4C7F78E27B7CD
                                                                                                                                                                                                                                      SHA1:BBFCC7FBB135D3893E9BD559E44E069F57DFAB31
                                                                                                                                                                                                                                      SHA-256:30C714BF4216E577686D238B98561D093672CB25BF90BAAB50DD956F75CDA4B3
                                                                                                                                                                                                                                      SHA-512:1A726490120152235BBCE20368630EF20FAC7964BA32F846FAC2C1F1A58EE9722356AD94FA6342685E8CEB5015CE2E944EDD739B901D3D9B0A22A5238118142B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://api.btloader.com/country
                                                                                                                                                                                                                                      Preview:{"country":"US"}

                                                                                                                                                                                                                                      Chrome Cache Entry: 2065

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 50 x 50
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):2663
                                                                                                                                                                                                                                      Entropy (8bit):7.47167825414699
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:48:YBx+9uJCPlc4ODkMzsiZNpjhqeVzvrNOmruOt/wW7PrUCIZ:YbWCCPlhskOZ3MeVzjNXrRokoZ
                                                                                                                                                                                                                                      MD5:A54BCC3157F91E6B6D4A7A148A337639
                                                                                                                                                                                                                                      SHA1:BE81208A6D1FC021DE5A4C6B52FB6B001BA40A57
                                                                                                                                                                                                                                      SHA-256:2F251CD639519E4F0C35781F2F9E4DAC5BD6FA7521A694D9B96840FE074102C0
                                                                                                                                                                                                                                      SHA-512:89D9AD430D96837467E18FC5E3D79F8DC2FA34B69841641B6F914611D581211939BA1FF6FE99F85EC039A3508EFFF890901477256F8468FC9F39218E7B32EA87
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:GIF89a2.2..........BBB"""...aaa...222qqq......JJJ............ZZZ...999zzz......&&&...eee.................nnn...^^^....................QQQ......***...iii......EEE.........VVV...666...vvvOOO///... >>>}}}............RRR......)))...jjj......FFF.........WWW...555...uuuMMM.........???~~~...............................................................................................................!..NETSCAPE2.0.....!...2...,....2.2....@.pH,.).LdD....H.G1Z..H.X.*...2..T.jvm.....XL...;L..'5\qcusvt'."}W+ .u.r=.;.'.a.4<.D....u;./.6% .7..!..$2...`;2F.&..t../."..u9jV6.t=.l%...>513.a.k&>..#k6.b.."+..b...8.+V/.a;.V+.t?.E...*$.0...d$.......@.. $....,XX.p".....J.. ..+&.U........,8.....7.$...@..:.L.q!..."6....CL..D(D.`..b.B...1...........,...s...0.Z.I.@......[..baB...4L."+..K...:!...).0.l.Q......K.).5...+l(`.S....HP.A.....>......(2P.a9L..<....C(...z0(.5..>.....i..12d.BG.+..j..b.r...P.P7g...eu...h@..$...@(....l...2........2...@.......0..O.,8...M....D..............0C"B4p......N...6V.`..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2066

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):5246
                                                                                                                                                                                                                                      Entropy (8bit):7.946830214741799
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:96:mzbCrtS+ZXaQltN6SSOJOyzbVey4mTL+YJtp95DxBQk6LvLHrtsQx:+CrvZXaqoOdbVey4RQP9JxBILTHrX
                                                                                                                                                                                                                                      MD5:7847422EB5AADB885328619D66505058
                                                                                                                                                                                                                                      SHA1:D081623A4E9C3CF0A17F78EDBD494A979E1D871B
                                                                                                                                                                                                                                      SHA-256:66490DA226597E334EF2EB80326988C93DD912CF9C44FE47A9AA78AD48A57E78
                                                                                                                                                                                                                                      SHA-512:E347720DDCE60ADD7B1A4A871796EFDDA8AFA44FD69B8B56F49879646833BA1DA6374C85081F36F4297E46C90E039613CF58268E86E923B8FC88F9D0B98F8E50
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/nogba-100x100.png
                                                                                                                                                                                                                                      Preview:RIFFv...WEBPVP8Li.../c...M0h...M.m....9D.?$...@.1..0..W....k..3..^.n.6..u..8l..=.f.$%=..G.1bdJJ.....BA..L.... .H..#....U@.@'.CB..h.B....@..I.I IH...$.G.....M.....BDL@............(.a...I.GV...?].w.YR.%.E...D.....h...9~....-.&......Q(.X..mV~=.T..h..XE.*.c.l....c....$?G^...R..3...o......lA...m....|%..q._...`~...$7kffff.3333333333s..L.ff....:........`.9yO.&Xj....S.....Q.[_........\Ju.c8U{..o.Q.[.0.e.U.3...6RN.R..l?.p....l`J...=.R.....v..G}+=!.=9.*2...U.O.S.}J.A$IB.4..HK|...6...........<...0..Gpa.1......!..$...X......9..9.Yo.y.X6. H)@o...9.-..|.r\@...B.2;G....(.d{LC@.E...Y...../....f.7.yV.....1@..tz'..V.'qJ^.|...&..o......W..2a.$3..&..c...m0.<.P..M.\.C.r..sK.......\..V.'...F.A.H..l.....Y...J...'....Q..z(st.....N..]..Ax...-..S...Hb.$@.![@.}.5.6..U..n..af....n..G...,.l..`.J+&........ce...... ^.<;{m)7...(....+.1.].%.w<).IFB:.-.h..?.b.!..v...Hl.i'...v.d..d.\n...P.|....h..\...N0\...;....'.X!.T..i;."...[>.#...S.....8RJ.@.ZC.^4*..i.!..=.r.p\=..R.Q`

                                                                                                                                                                                                                                      Chrome Cache Entry: 2067

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):43
                                                                                                                                                                                                                                      Entropy (8bit):3.0950611313667666
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:CUMllRPQEsJ9pse:Gl3QEsJLse
                                                                                                                                                                                                                                      MD5:AD4B0F606E0F8465BC4C4C170B37E1A3
                                                                                                                                                                                                                                      SHA1:50B30FD5F87C85FE5CBA2635CB83316CA71250D7
                                                                                                                                                                                                                                      SHA-256:CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
                                                                                                                                                                                                                                      SHA-512:EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://ad-delivery.net/px.gif?ch=1&e=0.1295495133823461
                                                                                                                                                                                                                                      Preview:GIF89a.............!.......,...........L..;

                                                                                                                                                                                                                                      Chrome Cache Entry: 2068

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):9250
                                                                                                                                                                                                                                      Entropy (8bit):7.975113833707626
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:Ip5GotallYia2xwROZbT5fmUDOJSShbnZ9Dl8LTZ6MTOZ:IuotavYF67NmhbZNOLT8h
                                                                                                                                                                                                                                      MD5:4AA9CFEB003AA5FBF9F4CC7895B13907
                                                                                                                                                                                                                                      SHA1:E8B2FAA520D4B41C0191FD0DA1C8F5DC58106665
                                                                                                                                                                                                                                      SHA-256:65A36B90E587809459EA335527BA674E0D0BC77AA37C47FC925F9EEFBCC6C71D
                                                                                                                                                                                                                                      SHA-512:F57098989438E5D23E2982427FBC3EDA16D372D0C44C3648890881AC0D00B10E0B41F407A70A9DB5A059D332D5EA57C91F0BAE6EEDDA7CF11ADF578BD9585291
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/gameloop-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.$..WEBPVP8L.$../c...M0h..2....../.".?...9Z...s.a......:......V.Z.&..U...V..5$q/.."..[p..U..O....$G..I>p..?.O..R..j..if...#.6..~V.7......m.r$I..$.Yr.S.....}..O.....v..MC....N%P.$.$../..t.8[S.dM.S!.....;U.w{I.4B...g:.c....xf....j)...|0:...%@..D.,@}K.rJ..Y.R!^...o.4$...#.....Xc..)....'5..`D....c.%...rmBS5.!..zt.B~....!.....Tf.?..\...P........q-.3..\~..8..m.$.a.;."b...S.tI.bQdt%.:....wL..+.$....,..f0333..W...>.j..N..m....=.0=M.Y.....0..U.K...P8.O.f/.J.....*.4j.T...F*.......Vj).4jC)..4.Ri5.i...a,3.m..Z.r.j....Kk..1.bf^.$.D...m...[n._.....[133....Z.'I.U.m..Km}.1.ff...t.(..Q.1.;..Ol33.F.U..m.1I.....iEgYm.9.{jk....m.eW...........)..T.}^s......3{....ZL_N....T..?.GG..^/....T...t../..>.c...2.p.$'..#G.n]IB$I.$yV."r.......I."I.y..kz...Nc.V..AAHa...\z`.:.X1O.@.;P?....G.k...m/x.:...=.&J......M..q.....-.x../............=....0w..,..n..#$.*t..............N.4n.|.....9u.}..{...[..f1.].y..,v."a.0......."x.........t..^.6^...n3...?.^.<W...;..Q..g.k.g.`.....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2069

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32, 16 colors
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):1078
                                                                                                                                                                                                                                      Entropy (8bit):1.240940859118772
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:3:etFEh9HYflvlNl/AXll1pe/WNN00000000000000000000000000000000000001:QNtY6+lKY6
                                                                                                                                                                                                                                      MD5:4123CE1E1732F202F60292941FF1487D
                                                                                                                                                                                                                                      SHA1:9F12B11BDE582DAE37CE8C160537D919C561C464
                                                                                                                                                                                                                                      SHA-256:D961B08E4321250926DE6F79087594975FE20AD1518DE8F91EB711AF5D1A6EF8
                                                                                                                                                                                                                                      SHA-512:11B24C2E622C408E4774FAE120B719A21A0B2ACFA53230126C35AD6CA57D33D4DE79CBE11D296CFBDE9613CAA03D66B721BD20CF4EE030CF75F5A1FD8A286DA9
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:..............(...&... ..........N...(....... ...............................................................................................................................................................................................................................................................................................(... ...@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                      Chrome Cache Entry: 2070

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (18059)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):18060
                                                                                                                                                                                                                                      Entropy (8bit):5.4322708404982585
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:YUEaIUlpF54dgfSBDs6A9yAsBIvyw1ikZeqLS7jBWQQw3CdePF:nNJZIgfIA9yAsO6JEBGQQZwePF
                                                                                                                                                                                                                                      MD5:4B770EF898E13EC4A12E1144E349C844
                                                                                                                                                                                                                                      SHA1:77F479E888A3E48483BC30FC17DCCC710E443722
                                                                                                                                                                                                                                      SHA-256:6B4E1554C69D91DC4CC9AED8009346008A670C1A6FA9EC61D5CA4FAFA38437D2
                                                                                                                                                                                                                                      SHA-512:5F9DB74BBE22BB93D528B90B59B58BB36C9F59CEBA1B5A88D811D2AD1DA4B3E8EFC28301C77E3FBA50904138E24D33E12D4B14762E61C27C3C7B33CB95C477CE
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://btloader.com/tag?o=5633429348548608&domain=download.it&upapi=true
                                                                                                                                                                                                                                      Preview:!function(){"use strict";var i=function(){return(i=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function v(e,a,c,s){return new(c=c||Promise)(function(n,t){function o(e){try{i(s.next(e))}catch(e){t(e)}}function r(e){try{i(s.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?n(e.value):((t=e.value)instanceof c?t:new c(function(e){e(t)})).then(o,r)}i((s=s.apply(e,a||[])).next())})}function S(n,o){var r,i,a,e,c={label:0,sent:function(){if(1&a[0])throw a[1];return a[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t){return function(e){return function(t){if(r)throw new TypeError("Generator is already executing.");for(;c;)try{if(r=1,i&&(a=2&t[0]?i.return:t[0]?i.throw||((a=i.return)&&a.call(i),0):i.next)&&!(a=a.call(i,t[1])).done)return a;switch(i=0,a&&(t=

                                                                                                                                                                                                                                      Chrome Cache Entry: 2071

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):18746
                                                                                                                                                                                                                                      Entropy (8bit):7.9717585175833525
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:1BrUqtuhS/fCJAOscPmJmVzQqOCydhWGhKc:VkS/fCJAOscnVzDydkGsc
                                                                                                                                                                                                                                      MD5:1A3F120B7992400BEC90915DE9C0B74B
                                                                                                                                                                                                                                      SHA1:0C2C95EC262FF09103A9C9E7CE2A48DD4C290F3D
                                                                                                                                                                                                                                      SHA-256:94C22A80FE14DB775B629E842FC9AC11B3C2E207A1143E64B353BFCBA77932E5
                                                                                                                                                                                                                                      SHA-512:5ED548763B209B1A681A87B687B00AC679298E3BBD0FF6C73B088A86D7A904592FCCCC246EE5DB6AD29D7CA4964F9F111D04E1900F57D89DC2FB260996B84C15
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..H.IDATx..g.dYv.v.y....|UW..j3..........".1..$...`.D.LH.B?.R0(..$..(..B.Zx.X3fw.......U]..2..?..=...fv... .Q.../...s.s.%...a^.@..@.. .H..."!..B..8.Q..... .D .......... ...../.......g..!?.>...@@.@...CD.C......@y...0....r.....!..........m7..`!"!..,k.......B..P!.J.a|..D..:...............fr.Y@.."H...(........!...._.w..A@rw..p.w...e...o..@).n."..9..!..@.cl..... .E(A..H..@C...DT.wm.....}.w.....!...1......._B>h..3......<...9z.."...6~^....Q.."...H.xy.sg..'b...H.S./..'k.y.#.B."=\.....%.x/.. ..?.c..7.x..a4Ezh.?.......o.S.".....|.+o.}^.4..q..F..Z^9...x.g.nR..{.E..%....!...h.......n!..TDR..ei.......9........"..y...!c..CK$.@2B..1...A)..(PJ...JR.....{.....{.dnB....].PP.o.../.).c..@.....wm.u..[......?ixN..,.......*....Q..q'n..z...1|8..R...Ai....D..Y.K.<.W.^.p..R$..6^..D......M.M5..........A..V`..4.0......!3&B.=2..{A....PP...|.In....P.E.' ..2.....[.WW.*.!.(.i...`.+......~..~.1`.@

                                                                                                                                                                                                                                      Chrome Cache Entry: 2072

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:RIFF (little-endian) data, Web/P image
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):11728
                                                                                                                                                                                                                                      Entropy (8bit):7.950031925923861
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:0GHJE3w6zj0chmOPd1V2Kr6rUPiW7rdSm4z4PBzDwHFxCgXaF:ppEA6zj0qmOPd1V2DUKW7rdSJz4ZzDuU
                                                                                                                                                                                                                                      MD5:2826589BFAD9763659590FCD41F8FDC1
                                                                                                                                                                                                                                      SHA1:33CBF615D414638320D920A1B4C4F5B95023C774
                                                                                                                                                                                                                                      SHA-256:620D822C5527BDF77EE91A45D11B77ABE351C1A03A78FBBBBDD8E929792AD5C5
                                                                                                                                                                                                                                      SHA-512:FBDD4BD5B3A591EEE8CC28F5D854DF5FDD51864DDC11393F155B57199752DD2D2818A55B0338111518E40C83423BD299923D7AB671A17A4381F5E3885F883D5B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://cdn.download.it/gen/mac/winrar-100x100.png
                                                                                                                                                                                                                                      Preview:RIFF.-..WEBPVP8L.-../c...M0j.I.2....|R.....;.SD.<\........O6z8..}I%.Fq...c..5R....p.=W....m.I.T.....Z.C...ySZo..$[U&...}..........=.`...*.=f....&.7l....5.%.Aj.U..f..G)..G...O.X..T.%.5J.VC.CC'...d.aN.)..q!.A#./d.....F|.z.^E.Gp.'V..O!....G......5.GP......~m....D?R..I/..H.P..w..52:..E..Eu...7V.c.hu..-.3.j.[0....S..,.8X... d(h.FJ..v.........[......U..hZ.`...\....$.m%k....."....{.C..[.$K.$.B.........~.eO.$.-I.....a...H{.......1...mS$I....DD..9 9..33so...`..j.....Z..k.3.G8......|.4|k...m...d;i.......~....y......c.,.j;.m.Rj.}........?....;.;....\c..[.%.w$.m...kk}....Wg.B....j.I..$Y.$....{....m^...~.t..-I.%I.m...g.....g.........&.#x4.l..1F............g0..0..A..%.\........@.. ...hB...(.;." &.i0b6.4KL@.^.Dli......Y@..v..y..0..q.(....,<....,.M..y.31.?.......scFm..?.o..{..a.m@.A.....&....._..._......~..........F~.#f.?...?...?.a.|..._.l.MC...X..../...}......?.....S.....M{.Y......v . DF....*qe.@....'.?........:.7yO`..........._...)s...H.F..H...-...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2073

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):21383
                                                                                                                                                                                                                                      Entropy (8bit):7.973752921172611
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:xqpHdHMawkIttc6BYTfIvYdDR7elGDdrt6baBRu22xEAtd3gzv2rKsIkCPYGak9o:xqkawkSqRd2baIjtSLaBsYKFgU21BHf
                                                                                                                                                                                                                                      MD5:58497F35333578CDFA4A586DBD3A1264
                                                                                                                                                                                                                                      SHA1:913DC800152C302084D6D44E2394555FBC1C57AE
                                                                                                                                                                                                                                      SHA-256:E1D9D2D09B64573F24BF5F840CF1B4E310E7556BE70C0F24E11691B79888B1FF
                                                                                                                                                                                                                                      SHA-512:5FB589D89DA6ABBB45C251BF8683C7E77AB7E11F3D7832C4BC5D5D1AD082475F485C752B7709493C9A606C1C85E6A863A57BB8858BB1ED132F6AC8294DBE0E7C
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..S.IDATx.\.Y...u&v.._r.....7t7.@...X......(.&$.vH.X......~..Cv(FRh(q$..(j(....X.. .......k..=......@.c.8.../....=..~.O.....LX$...@..I.'I..R..1..H....".0..HL....\H...)..z....~....VU..\".T...`.5......G.(.....*...B.J$.Q.o...X...r..,.3......XG.3.#9..`d...M..6.4.'..w......JRS.*..R..e...FP........_....;,'.(.......d.....O<U.|M......4I.Bd..N4N;CGG.I.V....$Q.#. DR)....).d.U.A....JI.$.0..g..p..~....*[G..1-...c.f.q.w.-.X....J.BJ.J.%i.....4...E.9I....)..2. 4M..B\!...2.y.2.&J..j...x.#.;t...C..S...............]*....Ow..Yz.b..."...S)...O..........!.".........W*.@..$.n.r..$R)..F........1..r.K.).s...a...s......7~...<H.j...[..a..B...@.......<.B*...H!..$.....:Vi~6`J.(.\.P*.AD%.9'.$D.R.a.w.Yo8..2L.qg...D.Q....nlL(.....a....w^<.v7......G.JOo..-....* .AI.MO.........o.0.<...c$.. ....?|.3....C..~nR..H..S. ......PB.=[C25..UNT......s..;}aw....n..#..i..........V......".B....

                                                                                                                                                                                                                                      Chrome Cache Entry: 2074

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1321)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):17314
                                                                                                                                                                                                                                      Entropy (8bit):5.342134706855769
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:cCDFzlR6exHAiyyrYuy9ckdnfczIk7LcuNP/p:DlsexHAlii9NmIeLcE
                                                                                                                                                                                                                                      MD5:2CC87E9764AEBCBBF36FF2061E6A2793
                                                                                                                                                                                                                                      SHA1:B4F2FFDF4C695AA79F0E63651C18A88729C2407B
                                                                                                                                                                                                                                      SHA-256:61C32059A5E94075A7ECFF678B33907966FC9CFA384DAA01AA057F872DA14DBB
                                                                                                                                                                                                                                      SHA-512:4ED31BF4F54EB0666539D6426C851503E15079601A2B7EC7410EBF0F3D1EEC6A09F9D79F5CF40106249A710037A36DE58105A72D8A909E0CFCE872C736CB5E48
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://tpc.googlesyndication.com/sodar/sodar2.js
                                                                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.'use strict';function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var n=ba(this),p="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),r={},u={};function w(a,b){var c=u[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}.function x(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var g=d[0],h;!a&&g in r?h=r:h=n;for(g=0;g<d.length-1;g++){var e=d[g];if(!(e in h))break a;h=h[e]}d=d[d.length-1];c=p&&"es6"===c?h[d]:null;b=b(c);

                                                                                                                                                                                                                                      Chrome Cache Entry: 2075

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (38350)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):39332
                                                                                                                                                                                                                                      Entropy (8bit):5.642716588275022
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:768:jF5YdUKH/UHWiGGLjMPXlpTrY/M7y2gjMs3+Yw7UUp:jF5YFU2i/MPXlpTrGM7y2o3op
                                                                                                                                                                                                                                      MD5:ECAD67FFBB78906FEDAEB7D1D23AA5C6
                                                                                                                                                                                                                                      SHA1:D419941E6858B40955826FF816789D04D7BE3D83
                                                                                                                                                                                                                                      SHA-256:99235240097FFE1C3CCF93F0275840DF66A62F6CE406788402B06DF413755D67
                                                                                                                                                                                                                                      SHA-512:3E548C5F7B1830FEB9B841920FE7EA0481FA5F050048C03564DCDCFD3500DF971D0C00D7CA2A57FDCA21B741B6CD618CC88EA7A026641669CED4572D62B16C1F
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://pagead2.googlesyndication.com/bg/mSNSQAl__hw8z5PwJ1hA32amL2zkBniEArBt9BN1XWc.js
                                                                                                                                                                                                                                      Preview://# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==. (function(){function a(H){return H}var v=this||self,O=function(H,E,r,y,I){if(I=(y=v.trustedTypes,r),!y||!y.createPolicy)return I;try{I=y.createPolicy(E,{createHTML:k,createScript:k,createScriptURL:k})}catch(Y){if(v.console)v.console[H](Y.message)}return I},k=function(H){return a.call(this,H)};(0,eval)(function(H,E){return(E=O("error","bg",null))&&1===H.eval(E.createScript("1"))?function(r){return E.createScript(r)}:function(r){return""+r}}(v)(Array(7824*Math.random()|0).join("\n")+['//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==',.'(function(){var H

                                                                                                                                                                                                                                      Chrome Cache Entry: 2076

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):258
                                                                                                                                                                                                                                      Entropy (8bit):5.21079861191154
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:6:TMVBd/i9mc4slzYrtj99z4L4mqZWzCF9xJLmgUhXqI:TMHd6+BjX48h9nWZ
                                                                                                                                                                                                                                      MD5:D9512F0F525415F06C2957770ACFB9FD
                                                                                                                                                                                                                                      SHA1:219155047825F9A836ACE8402B750116F5EAADB8
                                                                                                                                                                                                                                      SHA-256:307238FD564CCF483E9503989F781D89C45525F80DEC2BB3E80A9AD70FB37BA2
                                                                                                                                                                                                                                      SHA-512:B1BF13930CB63FC5B8C67BD09F213C0CFDE364C6C2CC961361EC466E41368B8E8E134159689AD5B77C2BE234AAD132A1150712C95CABC64123B7530E2C11D3FD
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="490" height="490">.<path fill="none" stroke="#1A7DFF" stroke-width="36" stroke-linecap="round" d="m280,278a153,153 0 1,0-2,2l170,170m-91-117 110,110-26,26-110-110"/>.</svg>

                                                                                                                                                                                                                                      Chrome Cache Entry: 2077

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):16770
                                                                                                                                                                                                                                      Entropy (8bit):7.960429141809285
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:384:akpvHfB8kNrcYSJangIXAon2ZTWnIrZ18:j9fBoTJegS2ZTWnZ
                                                                                                                                                                                                                                      MD5:9FC08E24AE1BBCC7589FD4129EDA3002
                                                                                                                                                                                                                                      SHA1:0CD034B6F37B1EB0316FE0A234A664967E1CDA65
                                                                                                                                                                                                                                      SHA-256:71EE94056B2A3731286369A1145568AA9A3EE13F3CBB595B76A63067E1922956
                                                                                                                                                                                                                                      SHA-512:54C63FEED874D694226D1A4AD73FCFA3D26930103B1787A1E14F618BCA5AAD0CCE02562061D60B6EE0A2F6CAD1C306D3CBCD13D8BE7049E98428C486F1EAB93E
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.............gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..A.IDATx..i.].u&..>..{.\..^.(.... ..Z.5.$k.eG..$..wwV.dy9..R.;...W'qg.,.v.(Q.FK")."...A.(.0.\o..9g.....%..~.....B.z..}.......F....!.. .........o.%...D....n...'...H "...D$."...J...1..$.......o..|....="l~."..........0x.o...g[....Pp.Iop.._D.A.rSn.....<...K.K..... .`~.iJ@.G....s>..gmf3k....Z..q.k.&&&......".....k.......,""BD"@......Y.<{...=[g.$I....9.w.lf.u...$.2.w^!Yg.....9k.s.N.gv.5Xk..L`......-c..;v...MOOONNn..V.}.3.X.M.....D .++...K"l.e...,....{ff.DD"....Z+".h..9.DHHD.H.... ....@....X(....I.....D...i.......R_|.._.._^[[+.......................LD........I!"\.x...CC5. RZ...RA.... D.-E....!.. ..Z)..L.*...R*.F+..".[/.? ..,.@.}.h.6._ZZ..R. ....G...s.=.X.^O...k..\H.....~....{........0w........+.2". )....{f.Ji".Q...K.".. .s...{.f...!.".e.3."...on..J.X,$q......c.9~....>............E...V)..*...j5..k..?~|3..I..........Qydthyi...|...........{/...u[(..[i`..F..

                                                                                                                                                                                                                                      Chrome Cache Entry: 2078

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):9181
                                                                                                                                                                                                                                      Entropy (8bit):7.958730539603897
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:bQRNefZ44zk1oSQOX29Bqi8ZL6WE5W10f1oFwOUvmSAwoPJiLdvSNY6:0YfZx5SrkBqiEKW10f6qZLA9PQdKi6
                                                                                                                                                                                                                                      MD5:98C5CD29C781BF60AFE24BE856B67256
                                                                                                                                                                                                                                      SHA1:19F40D3B2EFB422C3FF387DC92442AB6E4A0CA7F
                                                                                                                                                                                                                                      SHA-256:D7D3236B4F1A0CBB29DC1F56420C30D65CCC5C3A8DB335D8B963BF26E6FEB74E
                                                                                                                                                                                                                                      SHA-512:3371E3786C75E2C1745806E325D27C9CD9CF2F279A7B5465BE87A644E0E6E7221E53E317099C271AA70E3E8B2F65C175D8FDF1B9673E8D601299936BAB3D6AFC
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..#hIDATx..}g.d.u.w./t..7...v..K.... E..)Z.d.\e.L.V.,.R.i..*...*..\.(+.b...$.. ...,6`.l..3........3...F...9Uo{.w.....s.w.=.l.l.l.l.l.l.l.l.l.l.....rWfz......201.._..-....O....W........O..@...\.0..e...*R;../...g.)......k...g....H@. ..H.o.s..f.(.p...=?...tO{ ...* .Z........z.5.....7.@.`...... &Bh.BcA ...K(APDP......J....{.P.......P<........d_...`V....w..G.#......;[.$....AE.. ?..A....G.BK.^...O.$.W@(.... ...L..(..i.........}.m.5.!.f....r..z....{......3..@^nn\..3`.p..e...Q...QC..~.s{..(B.(.....IZ......... .Z.h...3.../-...+...e. .......vx....".........c..A.s..ev.d......J@.PAAy."..oO..;.f..Y@......[.{Z........./...H.Q.5...rOM.i...ty.x2..fMd`z9.P.)...2.........5Y.N.....2#B.......`....iB./..4.C.!.`.._.\.d..d.G...R(......u.5....r.7:".`.L.5.>@..<.@..|?...O...!P..$....{p.x..........Sd~.....)n4..e..Q..Q....Z..Te....'.....Af..n.Ngf...N"..(MX.....y.....a@.+.a.."2.

                                                                                                                                                                                                                                      Chrome Cache Entry: 2080

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):8721
                                                                                                                                                                                                                                      Entropy (8bit):7.96734007915922
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:cOlNrds88PQ061z/R83YEh6MOiv9xwIwHBtwSRN/GwHpZ/00dD:cOlNrds8UIza3Q+oIGL/NJZ/009
                                                                                                                                                                                                                                      MD5:C91DF9A1E91A8B1F29305A960BC5A3FA
                                                                                                                                                                                                                                      SHA1:E1AA14FC05CB8D4E7824ED7CA72B29A3515855B3
                                                                                                                                                                                                                                      SHA-256:3972AC10AB53131F0716F9DF1216280CE88EDFF95BD34D4469F7FBAD78C7BFE2
                                                                                                                                                                                                                                      SHA-512:CF08F00190EE5EF04EF2B465340EA530195698638C619EB61003D7F4C7CEE1DB68F37FA8A2ACD36CD663B6E397072EFD0C84192C0D89E8CD9D466C3EDB02AB20
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T..!.IDATx..y.$.y.....w.;{ry..%Y.%.Bl...$1l.1`.F...i..;..........#N..|@.#..!!.D..y.ys..^..s.Y..GU....,w.;...G.........;.......@..@..@..@..@..@..@..@..@..@..@..@..@.G....?......;.K...y..?..g..\.0w..}.......5..#?"Q)Z._...Y6R_{..O.....=........'.O...w7.........X.*&..y......8..._}......K8.-...@..3?..s..o,5...}.S....8OP.zNe..l.?..c.=..; ..~..p'=..ik~.._..J.-Q..y.s3?..~.#..}<...=..W...=5....4..E..?.......u...$*!.cb...c.s......(......G....of@.7....?8:{.o5..m..D..yL.'..@O.\?......s/=...h......H!>e.=o./e.y.....}.;.x|..C....y.8..Q:VF.'U......../..._^......a...'g..y..G..`b.).{.U.!...&...-_0...m.s.i..@.,N.2.\}-.fO.................u..G4.]....I@.%......t..7.H.6qXg.Vc.....s..3.^.qjr.d..'.z..............S...=.c...D......N.hy....c...C...qXg=........9W..8..Mn..~r...o....).........>.......j....hP.B.TR..|P.....<I..q.M...".D.}..g.e...F.8...2O.~<.H...?.g...~.......F..........@Y.0}:.|.y.W....H.....:. .BM...ZC...3JF.Y<.y"O.S...>...

                                                                                                                                                                                                                                      Chrome Cache Entry: 2081

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:PNG image data, 100 x 88, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                      Size (bytes):11105
                                                                                                                                                                                                                                      Entropy (8bit):7.9753014530675514
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:192:fjm/rSHFKTggBK44rNRaznwoD9eZz1yc4fLg6onMrhGpoYu28CSG5ipPJY2Lqq22:bm/rScTggw3Nk9OP4fLg6onMFGk22God
                                                                                                                                                                                                                                      MD5:68E9FAC523DC2E95B9610A805989249E
                                                                                                                                                                                                                                      SHA1:880A4BDEE67114F18C85F7741D326233335D204B
                                                                                                                                                                                                                                      SHA-256:F04FC53A79368360F59682285DAAF3A53D3B07FF5B2A9331DD953366D7611F4C
                                                                                                                                                                                                                                      SHA-512:D2AFBB44C199A5DC6CEEC695634E3678E8B8D74C36E0F800DA5306DBB5A04C4F2B1A59EBA25D1076A29AD40102771D0B823C5501A79FD38606A22094A564DE5B
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...X......ZR.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..*.IDATx..}i..W..w..\+k....[..X.%y..-.6....l.x.g....z..zNC/..9...f.16...x./...ly.nI.....Je...{w~DDf.V.h.....H)....w...w.{A...Q...=2.R.SLK{g;.k.....o.........<x.Wc..*z<.i..D.i...:f.q.L.u....&....;......ZZ..k......../}.4.....t..D..P=......`M..)f8.4'..#.y@...u.E.2...a....+..F.. .p|......o.N%v.f#.......i...*...0)."............ W...Y#.k.`c.!...<.....[|$.=.x../........J...'=.[m..y..(.-gv..a(.E.s.0..2......AD.....$+.......{.$^...k..=F.oX.)Y.F.^.....M.....}..V".mQ..=_!{......J...C...r.^..OJ..4.Md............J..2U.@.0gH.)..wne..>....S... 7....t>....(..P.2.5.=....%...^.h...3. $.....4...q...$.....,..R.....c....qp...1....W......'hO.....+=..V..N).W*.`..6.x.-...z.Y.....S...)...1.qPR|.!...M...q....^=/.../.......m\.....|....-.s...........@k-8..u.n..".a..F....k|......!..R....dd..q.y.t.%.;_.....}8{x~n.[b...T.b}.9..o.@~z.G.......B~.....a...n.....4n......H.38.....Z..'P.........

                                                                                                                                                                                                                                      Chrome Cache Entry: 2082

                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                      Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65386)
                                                                                                                                                                                                                                      Category:downloaded
                                                                                                                                                                                                                                      Size (bytes):430175
                                                                                                                                                                                                                                      Entropy (8bit):5.493415494712504
                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                      SSDEEP:12288:QBypz8OMLS75n6aSR+QlF85xM1+NWHqB/:J8OMLS75nnSR5ladNb
                                                                                                                                                                                                                                      MD5:D7F34F4035DD35ADD630CB95A2DEC40F
                                                                                                                                                                                                                                      SHA1:4641CBA44D943F6BE94129ACD9A28EA2905E5A52
                                                                                                                                                                                                                                      SHA-256:DF83D1810776EA1EFFD8A536F0AD32F5A400168A2EFAA48C97C1FCF57724900A
                                                                                                                                                                                                                                      SHA-512:407C243390C6F38936C870AF1B0E5C93A83EED9B35727F82E47B1139B9A62D375DED1428EE11153CFFA3941582A7BC570EFDA36FCF82531FACED179459F63688
                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                      Reputation:unknown
                                                                                                                                                                                                                                      URL:https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310240101/pubads_impl.js?cb=31079134
                                                                                                                                                                                                                                      Preview:(function(_){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ ./* . . SPDX-License-Identifier: Apache-2.0 .*/ .var ea,ha,ja,ka,la,pa,ra,ta,xa,va,ya,za,Ba,Ca,Da,Fa,Ga,Ka,La,Ma,Na,Va,Xa,Za,bb,ib,kb,ob,rb,ub,vb,Ab,Cb,Eb,Gb,Kb,Nb,Hb,Ob,Sb,Ub,Wb,Xb,Yb,Zb,bc,cc,dc,hc,ic,kc,lc,nc,pc,mc,sc,uc,vc,xc,yc,zc,Ac,Bc,Cc,Fc,Hc,Ic,Jc,Kc,Lc,Mc,Pc,Oc,Rc,Sc,Yc,ad,bd,dd,ed,fd,hd,gd,ld,nd,md,pd,od,qd,sd,cd,wd,Ad,Cd,Dd,Ed,Hd,Id,Jd,Kd,Nd,Od,Bd,Pd,Qd,Rd,Sd,Zd,$d,ae,Ud,ee,Yd,fe,je,le,ne,pe,qe,re,se,ve,ye,Ae,Be,Fe,Ge,He,Je,Ke,Le,Ne,Pe,Te,We,Xe,Ye,af,cf,df,ff,hf,jf,kf,lf,nf,of,qf,rf,uf,wf,xf,yf,zf,Cf,Lf,Nf,Rf,Pf,Vf,Wf,Xf,Tf,Uf,Yf,ag,bg,fg,gg,ng,og,rg,vg,zg,Hg,Jg,Lg,Mg,Ng,Og,Pg,Qg,Sg,Ug,$g,gh,I,hh,nh,lh,Dh,Fh,Hh,Ih,Nh,Qh,Uh,Yh,oi,ni,vi,wi,xi,yi,pi,zi,qi,Bi,Ci,Ei,Ii,Ki,Ji,Mi,Ri,Pi,Si,aj,dj,Wi,Xi,ej,hj,ij,jj,tj,nj,vj,yj,zj,Kj,Qj,Oj,Pj,Vj,Zj,bk,ck,dk,fk,jk,tk,mk,gk,Bk,zk,Ak,Dk,Fk,Ik,O,Kk,Lk,Mk,Ok,Qk,Rk,Yk,Zk,al,bl,gl,il,jl,nl,Nl,Ol,Pl,Rl,Vl,$l,bm,cm,em,fm,jm,km,lm,pm,im,rm,sm,tm

                                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                      Entropy (8bit):7.44947779423579
                                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 98.04%
                                                                                                                                                                                                                                      • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                                                                                                      • InstallShield setup (43055/19) 0.42%
                                                                                                                                                                                                                                      • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                                                                                                                      • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                                                      File name:teamviewer_Px-yDq1.exe
                                                                                                                                                                                                                                      File size:1'742'072 bytes
                                                                                                                                                                                                                                      MD5:e0cb873b4abc6e0650ebfcf9b7a328ff
                                                                                                                                                                                                                                      SHA1:bacdeece4458ac1ee50cb505bd775588c4616b45
                                                                                                                                                                                                                                      SHA256:3e6dd43ddc4d7f8b25bcfcefa639eb791e837325b92f137f61c1098ea11af0a8
                                                                                                                                                                                                                                      SHA512:1ab61430ad92da86e58f3fc412317f3c1519c23ee976916e09145c6a91649b12162b75f5cc528cb65efba822736a614b669ab589df7c6cb67c3da3d53e9d45da
                                                                                                                                                                                                                                      SSDEEP:24576:l4nXubIQGyxbPV0db26WJ/YENYP9nEbt24behb2GL6ddWB2YQEq:lqe3f67W52XhbTLN2cq
                                                                                                                                                                                                                                      TLSH:CB85C03FF268A13EC4AA1B3245B39350597BBA61681A8C1F07FC390DCF765601E3B656
                                                                                                                                                                                                                                      File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                                      Icon Hash:0c0c2d33ceec80aa

                                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Entrypoint:0x4b5eec
                                                                                                                                                                                                                                      Entrypoint Section:.itext
                                                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                      Time Stamp:0x60B88E27 [Thu Jun 3 08:09:11 2021 UTC]
                                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                                                      OS Version Minor:1
                                                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                                                      File Version Minor:1
                                                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                                                      Subsystem Version Minor:1
                                                                                                                                                                                                                                      Import Hash:5a594319a0d69dbc452e748bcf05892e

                                                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                                                      Signature Issuer:CN=Domain The Net Technologies Ltd CA for Code Signing R2, O=Domain The Net Technologies Ltd, C=IL
                                                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                                                      • 27/11/2022 11:52:06 24/11/2023 11:52:06
                                                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                                                      • CN=INNOVA MEDIA d.o.o., O=INNOVA MEDIA d.o.o., L=Sempeter pri Gorici, S=Goriska, C=SI
                                                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                                                      Thumbprint MD5:88A95CC89FF2E0928AFA5294CB9522E5
                                                                                                                                                                                                                                      Thumbprint SHA-1:C011031C6E7228944060AC53BBD85486596B7464
                                                                                                                                                                                                                                      Thumbprint SHA-256:83CEC634FACF7B6F23C0C3C81BFB935315DA46ECDEF851F39C50B805AC607C1E
                                                                                                                                                                                                                                      Serial:21586DE7F7F20EBBBC73A3FDF4368F4B

                                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                                      add esp, FFFFFFA4h
                                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                                      push edi
                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-3Ch], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-40h], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-5Ch], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-38h], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-34h], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-2Ch], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                                                      mov dword ptr [ebp-14h], eax
                                                                                                                                                                                                                                      mov eax, 004B10F0h
                                                                                                                                                                                                                                      call 00007EFED535E015h
                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                      push 004B65E2h
                                                                                                                                                                                                                                      push dword ptr fs:[eax]
                                                                                                                                                                                                                                      mov dword ptr fs:[eax], esp
                                                                                                                                                                                                                                      xor edx, edx
                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                      push 004B659Eh
                                                                                                                                                                                                                                      push dword ptr fs:[edx]
                                                                                                                                                                                                                                      mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                      mov eax, dword ptr [004BE634h]
                                                                                                                                                                                                                                      call 00007EFED540073Fh
                                                                                                                                                                                                                                      call 00007EFED5400292h
                                                                                                                                                                                                                                      lea edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                      call 00007EFED5373A88h
                                                                                                                                                                                                                                      mov edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                      mov eax, 004C1D84h
                                                                                                                                                                                                                                      call 00007EFED5358C07h
                                                                                                                                                                                                                                      push 00000002h
                                                                                                                                                                                                                                      push 00000000h
                                                                                                                                                                                                                                      push 00000001h
                                                                                                                                                                                                                                      mov ecx, dword ptr [004C1D84h]
                                                                                                                                                                                                                                      mov dl, 01h
                                                                                                                                                                                                                                      mov eax, dword ptr [004237A4h]
                                                                                                                                                                                                                                      call 00007EFED5374AEFh
                                                                                                                                                                                                                                      mov dword ptr [004C1D88h], eax
                                                                                                                                                                                                                                      xor edx, edx
                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                      push 004B654Ah
                                                                                                                                                                                                                                      push dword ptr fs:[edx]
                                                                                                                                                                                                                                      mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                      call 00007EFED54007C7h
                                                                                                                                                                                                                                      mov dword ptr [004C1D90h], eax
                                                                                                                                                                                                                                      mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                      cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                                                      jne 00007EFED5406DAAh
                                                                                                                                                                                                                                      mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                      mov edx, 00000028h
                                                                                                                                                                                                                                      call 00007EFED53753E4h
                                                                                                                                                                                                                                      mov edx, dword ptr [004C1D90h]

                                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xf36.idata
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x10e00.rsrc
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x1a67000x2df8
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0xc22e40x244.idata
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                      .text0x10000xb361c0xb3800False0.3448639341051532data6.356058204328091IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                      .itext0xb50000x16880x1800False0.544921875data5.972750055221053IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                      .data0xb70000x37a40x3800False0.36097935267857145data5.044400562007734IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                      .bss0xbb0000x6de80x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                      .idata0xc20000xf360x1000False0.3681640625data4.8987046479600425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                      .didata0xc30000x1a40x200False0.345703125data2.7563628682496506IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                      .edata0xc40000x9a0x200False0.2578125data1.8722228665884297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                      .tls0xc50000x180x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                      .rdata0xc60000x5d0x200False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                      .rsrc0xc70000x10e000x10e00False0.18833912037037037data3.7107626182318394IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                      RT_ICON0xc76780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                                                                                                                                                                                                                                      RT_ICON0xc80e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                                                                                                                                                                                                                                      RT_ICON0xc87480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                                                                                                                                                                                                                                      RT_ICON0xc8a300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                                                                                                                                                                                                                                      RT_ICON0xc8b580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                                                                                                                                                                                                                                      RT_ICON0xca1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                                                                                                                                                                                                                                      RT_ICON0xcb0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                                                                                                                                                                                                                                      RT_ICON0xcb8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                                                                                                                                                                                                                                      RT_ICON0xcbe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                                                                                                                                                                                                                                      RT_ICON0xcd1200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                                                                                                                                                                                                                                      RT_ICON0xd13480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                                                                                                                                                                                                                                      RT_ICON0xd38f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                                                                                                                                                                                                                                      RT_ICON0xd49980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                                                                                                                                                                                                                                      RT_STRING0xd4e000x360data0.34375
                                                                                                                                                                                                                                      RT_STRING0xd51600x260data0.3256578947368421
                                                                                                                                                                                                                                      RT_STRING0xd53c00x45cdata0.4068100358422939
                                                                                                                                                                                                                                      RT_STRING0xd581c0x40cdata0.3754826254826255
                                                                                                                                                                                                                                      RT_STRING0xd5c280x2d4data0.39226519337016574
                                                                                                                                                                                                                                      RT_STRING0xd5efc0xb8data0.6467391304347826
                                                                                                                                                                                                                                      RT_STRING0xd5fb40x9cdata0.6410256410256411
                                                                                                                                                                                                                                      RT_STRING0xd60500x374data0.4230769230769231
                                                                                                                                                                                                                                      RT_STRING0xd63c40x398data0.3358695652173913
                                                                                                                                                                                                                                      RT_STRING0xd675c0x368data0.3795871559633027
                                                                                                                                                                                                                                      RT_STRING0xd6ac40x2a4data0.4275147928994083
                                                                                                                                                                                                                                      RT_RCDATA0xd6d680x10data1.5
                                                                                                                                                                                                                                      RT_RCDATA0xd6d780x2c4data0.6384180790960452
                                                                                                                                                                                                                                      RT_RCDATA0xd703c0x2cdata1.1590909090909092
                                                                                                                                                                                                                                      RT_GROUP_ICON0xd70680xbcdataEnglishUnited States0.6170212765957447
                                                                                                                                                                                                                                      RT_VERSION0xd71240x584dataEnglishUnited States0.2577903682719547
                                                                                                                                                                                                                                      RT_MANIFEST0xd76a80x726XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4005464480874317

                                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                                      kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                                                                                                                      comctl32.dllInitCommonControls
                                                                                                                                                                                                                                      version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                                                                                                      user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                                                                                                                      oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                                                                                                                      netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                                                                                                                      advapi32.dllRegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                                                                                                                      Exports

                                                                                                                                                                                                                                      NameOrdinalAddress
                                                                                                                                                                                                                                      TMethodImplementationIntercept30x454060
                                                                                                                                                                                                                                      __dbk_fcall_wrapper20x40d0a0
                                                                                                                                                                                                                                      dbkFCallWrapperAddr10x4be63c

                                                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                                      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                                      Start time:14:34:58
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\teamviewer_Px-yDq1.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:C:\Users\user\Desktop\teamviewer_Px-yDq1.exe
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:1'742'072 bytes
                                                                                                                                                                                                                                      MD5 hash:E0CB873B4ABC6E0650EBFCF9B7A328FF
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                                      Start time:14:34:58
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-6V6DR.tmp\teamviewer_Px-yDq1.tmp" /SL5="$20458,831488,831488,C:\Users\user\Desktop\teamviewer_Px-yDq1.exe"
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:3'206'136 bytes
                                                                                                                                                                                                                                      MD5 hash:C2A9A21C0C0BD341958033EA11684FEA
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                                      Start time:14:35:04
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:2'457'016 bytes
                                                                                                                                                                                                                                      MD5 hash:EE66976DF0A5C903F5A718ABF3E8AC85
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                                      Start time:14:35:05
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-M7N7N.tmp\file_Px-yDq1.tmp" /SL5="$40456,1559708,780800,C:\Users\user\AppData\Local\Temp\is-8DTOO.tmp\file_Px-yDq1.exe" /LANG=en /NA=Rh85hR64
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:3'014'144 bytes
                                                                                                                                                                                                                                      MD5 hash:4AFC5E8740E48A3A9DEF088703BF320F
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                                                      Start time:14:35:38
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
                                                                                                                                                                                                                                      Imagebase:0x1000000
                                                                                                                                                                                                                                      File size:1'162'856 bytes
                                                                                                                                                                                                                                      MD5 hash:BB7CF61C4E671FF05649BDA83B85FA3D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                                                      Start time:14:35:39
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I
                                                                                                                                                                                                                                      Imagebase:0xa70000
                                                                                                                                                                                                                                      File size:234'936 bytes
                                                                                                                                                                                                                                      MD5 hash:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                                                      Start time:14:35:41
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Windows\Temp\asw.754e841b27ded488\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /ga_clientid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488
                                                                                                                                                                                                                                      Imagebase:0x1f0000
                                                                                                                                                                                                                                      File size:1'441'080 bytes
                                                                                                                                                                                                                                      MD5 hash:3817B172EA2CEF28D73F746A40F3B275
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                                      Start time:14:35:43
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\Downloads\teamviewer.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Downloads\teamviewer.exe"
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:43'363'312 bytes
                                                                                                                                                                                                                                      MD5 hash:D9CC2F111B059473F9AAEA203B42104F
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                                                                      Start time:14:35:43
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://download.it/?typ=1
                                                                                                                                                                                                                                      Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                                                                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                                                      Start time:14:35:44
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                      Imagebase:0x7ff7403e0000
                                                                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                                                      Start time:14:35:44
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2028,i,935018131516826606,2306456977688268637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                      Imagebase:0x7ff684c40000
                                                                                                                                                                                                                                      File size:3'242'272 bytes
                                                                                                                                                                                                                                      MD5 hash:5BBFA6CBDF4C254EB368D534F9E23C92
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                                                                      Start time:14:35:46
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:42'543'224 bytes
                                                                                                                                                                                                                                      MD5 hash:2E185F8A6622BC3062254F6F195ACC81
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                                                                      Start time:14:35:56
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
                                                                                                                                                                                                                                      Imagebase:0x7d0000
                                                                                                                                                                                                                                      File size:187'904 bytes
                                                                                                                                                                                                                                      MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                                                                      Start time:14:35:57
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                                                                      Start time:14:35:58
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                      File size:42'543'224 bytes
                                                                                                                                                                                                                                      MD5 hash:2E185F8A6622BC3062254F6F195ACC81
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                      • Detection: 0%, Virustotal, Browse
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:18
                                                                                                                                                                                                                                      Start time:14:35:59
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\installer.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-EA0O1.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
                                                                                                                                                                                                                                      Imagebase:0x7ff663f80000
                                                                                                                                                                                                                                      File size:29'187'936 bytes
                                                                                                                                                                                                                                      MD5 hash:58EB889F91B5133D5DB88612CA6E5887
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:19
                                                                                                                                                                                                                                      Start time:14:36:01
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\icarus-info.xml /install /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488
                                                                                                                                                                                                                                      Imagebase:0x7ff68ae40000
                                                                                                                                                                                                                                      File size:7'344'064 bytes
                                                                                                                                                                                                                                      MD5 hash:A87978C382EABC0165DB0C7EDC5797B2
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:20
                                                                                                                                                                                                                                      Start time:14:36:04
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
                                                                                                                                                                                                                                      Imagebase:0x7d0000
                                                                                                                                                                                                                                      File size:187'904 bytes
                                                                                                                                                                                                                                      MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:21
                                                                                                                                                                                                                                      Start time:14:36:04
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:22
                                                                                                                                                                                                                                      Start time:14:36:04
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Program Files\McAfee\Temp3848859477\installer.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:"C:\Program Files\McAfee\Temp3848859477\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
                                                                                                                                                                                                                                      Imagebase:0x7ff75bfa0000
                                                                                                                                                                                                                                      File size:2'526'888 bytes
                                                                                                                                                                                                                                      MD5 hash:38F970B5919FA4F8174F559A91003924
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:23
                                                                                                                                                                                                                                      Start time:14:36:14
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av-vps\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av-vps_slave_ep_5fcecd28-e060-4a60-97eb-9691aa0406f9 /slave:avg-av-vps
                                                                                                                                                                                                                                      Imagebase:0x7ff6e71a0000
                                                                                                                                                                                                                                      File size:7'344'064 bytes
                                                                                                                                                                                                                                      MD5 hash:9A20D03282B552AAE11F3EBB5C6FE6EC
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:24
                                                                                                                                                                                                                                      Start time:14:36:14
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\Temp\asw-b534169b-5495-4b70-b22b-d831ebbfb13f\avg-av\icarus.exe /silent /ws /psh:92pTtVrLghUeCvfh6sys1hVro5yg0iq7IKgSZ1RChFEf8w5S8p6LwoKByiCCzMhQVWgOJacLZrts7I /cookie:mmm_irs_ppi_902_451_o /track-guid:33ceb1b3-6777-46fa-a3c6-05d837543d05 /edat_dir:C:\Windows\Temp\asw.754e841b27ded488 /er_master:master_ep_65686cd9-ebf4-446e-9f7d-0579cd09294f /er_ui:ui_ep_92534759-27b1-4d0c-9ffa-a95984d9cff4 /er_slave:avg-av_slave_ep_1722e0ab-409f-4455-9e1b-59991a5329c1 /slave:avg-av
                                                                                                                                                                                                                                      Imagebase:0x7ff74d6f0000
                                                                                                                                                                                                                                      File size:7'344'064 bytes
                                                                                                                                                                                                                                      MD5 hash:A87978C382EABC0165DB0C7EDC5797B2
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:25
                                                                                                                                                                                                                                      Start time:14:36:19
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
                                                                                                                                                                                                                                      Imagebase:0x7d0000
                                                                                                                                                                                                                                      File size:187'904 bytes
                                                                                                                                                                                                                                      MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                                                                      Start time:14:36:19
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:27
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:sc.exe create "McAfee WebAdvisor" binPath= "\"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe\"" start= auto DisplayName= "McAfee WebAdvisor"
                                                                                                                                                                                                                                      Imagebase:0x7ff740ec0000
                                                                                                                                                                                                                                      File size:72'192 bytes
                                                                                                                                                                                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                                                                                                                                                                                                                                      Imagebase:0x7ff63be60000
                                                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:29
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:30
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline: /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"
                                                                                                                                                                                                                                      Imagebase:0x8a0000
                                                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:31
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:sc.exe description "McAfee WebAdvisor" "McAfee WebAdvisor Service"
                                                                                                                                                                                                                                      Imagebase:0x7ff740ec0000
                                                                                                                                                                                                                                      File size:72'192 bytes
                                                                                                                                                                                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:32
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:33
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"
                                                                                                                                                                                                                                      Imagebase:0x7ff63be60000
                                                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:sc.exe failure "McAfee WebAdvisor" reset= 3600 actions= restart/1/restart/1000/restart/3000/restart/30000/restart/1800000//0
                                                                                                                                                                                                                                      Imagebase:0x7ff740ec0000
                                                                                                                                                                                                                                      File size:72'192 bytes
                                                                                                                                                                                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:35
                                                                                                                                                                                                                                      Start time:14:36:27
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:36
                                                                                                                                                                                                                                      Start time:14:36:36
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
                                                                                                                                                                                                                                      Imagebase:0x7ff63be60000
                                                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:37
                                                                                                                                                                                                                                      Start time:14:36:36
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\sc.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:sc.exe start "McAfee WebAdvisor"
                                                                                                                                                                                                                                      Imagebase:0x7ff740ec0000
                                                                                                                                                                                                                                      File size:72'192 bytes
                                                                                                                                                                                                                                      MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:38
                                                                                                                                                                                                                                      Start time:14:36:37
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      Imagebase:0x7ff66e660000
                                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:39
                                                                                                                                                                                                                                      Start time:14:36:37
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                      Commandline: /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"
                                                                                                                                                                                                                                      Imagebase:0x8a0000
                                                                                                                                                                                                                                      File size:20'992 bytes
                                                                                                                                                                                                                                      MD5 hash:878E47C8656E53AE8A8A21E927C6F7E0
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:40
                                                                                                                                                                                                                                      Start time:14:36:37
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Program Files\McAfee\WebAdvisor\servicehost.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
                                                                                                                                                                                                                                      Imagebase:0x7ff74f100000
                                                                                                                                                                                                                                      File size:882'136 bytes
                                                                                                                                                                                                                                      MD5 hash:786DA7AE2B6CCFE4A6A15675EE687036
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                      Target ID:41
                                                                                                                                                                                                                                      Start time:14:36:37
                                                                                                                                                                                                                                      Start date:27/10/2023
                                                                                                                                                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                      Commandline:regsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"
                                                                                                                                                                                                                                      Imagebase:0x7ff63be60000
                                                                                                                                                                                                                                      File size:25'088 bytes
                                                                                                                                                                                                                                      MD5 hash:B0C2FA35D14A9FAD919E99D9D75E1B9E
                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                        Execution Coverage:16.6%
                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                        Signature Coverage:23%
                                                                                                                                                                                                                                        Total number of Nodes:1288
                                                                                                                                                                                                                                        Total number of Limit Nodes:28
                                                                                                                                                                                                                                        execution_graph 3601 4027c1 3615 402a1d 3601->3615 3603 4027c7 3604 402802 3603->3604 3605 4027eb 3603->3605 3610 4026a6 3603->3610 3608 402818 3604->3608 3609 40280c 3604->3609 3606 4027f0 3605->3606 3607 4027ff 3605->3607 3618 405cf9 lstrcpynA 3606->3618 3607->3610 3619 405c57 wsprintfA 3607->3619 3612 405d1b 18 API calls 3608->3612 3611 402a1d 18 API calls 3609->3611 3611->3607 3612->3607 3616 405d1b 18 API calls 3615->3616 3617 402a31 3616->3617 3617->3603 3618->3610 3619->3610 3620 401cc2 3621 402a1d 18 API calls 3620->3621 3622 401cd2 SetWindowLongA 3621->3622 3623 4028cf 3622->3623 3624 401a43 3625 402a1d 18 API calls 3624->3625 3626 401a49 3625->3626 3627 402a1d 18 API calls 3626->3627 3628 4019f3 3627->3628 3207 401e44 3208 402a3a 18 API calls 3207->3208 3209 401e4a 3208->3209 3210 404f12 25 API calls 3209->3210 3211 401e54 3210->3211 3223 40548a CreateProcessA 3211->3223 3213 401e5a 3214 4026a6 3213->3214 3215 401eb0 CloseHandle 3213->3215 3216 401e79 WaitForSingleObject 3213->3216 3226 4060ce 3213->3226 3215->3214 3216->3213 3217 401e87 GetExitCodeProcess 3216->3217 3219 401ea4 3217->3219 3220 401e99 3217->3220 3219->3215 3221 401ea2 3219->3221 3230 405c57 wsprintfA 3220->3230 3221->3215 3224 4054c9 3223->3224 3225 4054bd CloseHandle 3223->3225 3224->3213 3225->3224 3227 4060eb PeekMessageA 3226->3227 3228 4060e1 DispatchMessageA 3227->3228 3229 4060fb 3227->3229 3228->3227 3229->3216 3230->3221 3629 402644 3630 40264a 3629->3630 3631 402652 FindClose 3630->3631 3632 4028cf 3630->3632 3631->3632 3633 406344 3634 4061c8 3633->3634 3635 406b33 3634->3635 3636 406252 GlobalAlloc 3634->3636 3637 406249 GlobalFree 3634->3637 3638 4062c0 GlobalFree 3634->3638 3639 4062c9 GlobalAlloc 3634->3639 3636->3634 3636->3635 3637->3636 3638->3639 3639->3634 3639->3635 3640 4026c6 3641 402a3a 18 API calls 3640->3641 3642 4026d4 3641->3642 3643 4026ea 3642->3643 3644 402a3a 18 API calls 3642->3644 3645 405947 2 API calls 3643->3645 3644->3643 3646 4026f0 3645->3646 3668 40596c GetFileAttributesA CreateFileA 3646->3668 3648 4026fd 3649 4027a0 3648->3649 3650 402709 GlobalAlloc 3648->3650 3653 4027a8 DeleteFileA 3649->3653 3654 4027bb 3649->3654 3651 402722 3650->3651 3652 402797 CloseHandle 3650->3652 3669 403091 SetFilePointer 3651->3669 3652->3649 3653->3654 3656 402728 3657 40307b ReadFile 3656->3657 3658 402731 GlobalAlloc 3657->3658 3659 402741 3658->3659 3660 402775 3658->3660 3662 402e9f 36 API calls 3659->3662 3661 405a13 WriteFile 3660->3661 3663 402781 GlobalFree 3661->3663 3667 40274e 3662->3667 3664 402e9f 36 API calls 3663->3664 3665 402794 3664->3665 3665->3652 3666 40276c GlobalFree 3666->3660 3667->3666 3668->3648 3669->3656 3670 402847 3671 402a1d 18 API calls 3670->3671 3672 40284d 3671->3672 3673 4026a6 3672->3673 3674 40287e 3672->3674 3676 40285b 3672->3676 3674->3673 3675 405d1b 18 API calls 3674->3675 3675->3673 3676->3673 3678 405c57 wsprintfA 3676->3678 3678->3673 3679 4022c7 3680 402a3a 18 API calls 3679->3680 3681 4022d8 3680->3681 3682 402a3a 18 API calls 3681->3682 3683 4022e1 3682->3683 3684 402a3a 18 API calls 3683->3684 3685 4022eb GetPrivateProfileStringA 3684->3685 3696 405050 3697 405072 GetDlgItem GetDlgItem GetDlgItem 3696->3697 3698 4051fb 3696->3698 3741 403f13 SendMessageA 3697->3741 3700 405203 GetDlgItem CreateThread CloseHandle 3698->3700 3701 40522b 3698->3701 3700->3701 3703 405259 3701->3703 3704 405241 ShowWindow ShowWindow 3701->3704 3705 40527a 3701->3705 3702 4050e2 3711 4050e9 GetClientRect GetSystemMetrics SendMessageA SendMessageA 3702->3711 3706 4052b4 3703->3706 3708 405269 3703->3708 3709 40528d ShowWindow 3703->3709 3746 403f13 SendMessageA 3704->3746 3750 403f45 3705->3750 3706->3705 3712 4052c1 SendMessageA 3706->3712 3747 403eb7 3708->3747 3715 4052ad 3709->3715 3716 40529f 3709->3716 3717 405157 3711->3717 3718 40513b SendMessageA SendMessageA 3711->3718 3714 405286 3712->3714 3719 4052da CreatePopupMenu 3712->3719 3723 403eb7 SendMessageA 3715->3723 3722 404f12 25 API calls 3716->3722 3720 40516a 3717->3720 3721 40515c SendMessageA 3717->3721 3718->3717 3724 405d1b 18 API calls 3719->3724 3742 403ede 3720->3742 3721->3720 3722->3715 3723->3706 3726 4052ea AppendMenuA 3724->3726 3728 405308 GetWindowRect 3726->3728 3729 40531b TrackPopupMenu 3726->3729 3727 40517a 3730 405183 ShowWindow 3727->3730 3731 4051b7 GetDlgItem SendMessageA 3727->3731 3728->3729 3729->3714 3732 405337 3729->3732 3733 4051a6 3730->3733 3734 405199 ShowWindow 3730->3734 3731->3714 3735 4051de SendMessageA SendMessageA 3731->3735 3736 405356 SendMessageA 3732->3736 3745 403f13 SendMessageA 3733->3745 3734->3733 3735->3714 3736->3736 3737 405373 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3736->3737 3739 405395 SendMessageA 3737->3739 3739->3739 3740 4053b7 GlobalUnlock SetClipboardData CloseClipboard 3739->3740 3740->3714 3741->3702 3743 405d1b 18 API calls 3742->3743 3744 403ee9 SetDlgItemTextA 3743->3744 3744->3727 3745->3731 3746->3703 3748 403ec4 SendMessageA 3747->3748 3749 403ebe 3747->3749 3748->3705 3749->3748 3751 403f5d GetWindowLongA 3750->3751 3761 403fe6 3750->3761 3752 403f6e 3751->3752 3751->3761 3753 403f80 3752->3753 3754 403f7d GetSysColor 3752->3754 3755 403f90 SetBkMode 3753->3755 3756 403f86 SetTextColor 3753->3756 3754->3753 3757 403fa8 GetSysColor 3755->3757 3758 403fae 3755->3758 3756->3755 3757->3758 3759 403fb5 SetBkColor 3758->3759 3760 403fbf 3758->3760 3759->3760 3760->3761 3762 403fd2 DeleteObject 3760->3762 3763 403fd9 CreateBrushIndirect 3760->3763 3761->3714 3762->3763 3763->3761 3061 401751 3062 402a3a 18 API calls 3061->3062 3063 401758 3062->3063 3064 401776 3063->3064 3065 40177e 3063->3065 3121 405cf9 lstrcpynA 3064->3121 3122 405cf9 lstrcpynA 3065->3122 3068 40177c 3072 405f64 5 API calls 3068->3072 3069 401789 3123 40576b lstrlenA CharPrevA 3069->3123 3092 40179b 3072->3092 3076 4017b2 CompareFileTime 3076->3092 3077 401876 3079 404f12 25 API calls 3077->3079 3078 40184d 3080 404f12 25 API calls 3078->3080 3089 401862 3078->3089 3082 401880 3079->3082 3080->3089 3081 405cf9 lstrcpynA 3081->3092 3100 402e9f 3082->3100 3085 4018a7 SetFileTime 3086 4018b9 FindCloseChangeNotification 3085->3086 3088 4018ca 3086->3088 3086->3089 3087 405d1b 18 API calls 3087->3092 3090 4018e2 3088->3090 3091 4018cf 3088->3091 3094 405d1b 18 API calls 3090->3094 3093 405d1b 18 API calls 3091->3093 3092->3076 3092->3077 3092->3078 3092->3081 3092->3087 3099 40596c GetFileAttributesA CreateFileA 3092->3099 3126 405ffd FindFirstFileA 3092->3126 3129 405947 GetFileAttributesA 3092->3129 3132 4054ef 3092->3132 3096 4018d7 lstrcatA 3093->3096 3097 4018ea 3094->3097 3096->3097 3098 4054ef MessageBoxIndirectA 3097->3098 3098->3089 3099->3092 3102 402eb5 3100->3102 3101 402ee0 3136 40307b 3101->3136 3102->3101 3148 403091 SetFilePointer 3102->3148 3106 40301b 3108 40301f 3106->3108 3113 403037 3106->3113 3107 402efd GetTickCount 3117 402f10 3107->3117 3110 40307b ReadFile 3108->3110 3109 401893 3109->3085 3109->3086 3110->3109 3111 40307b ReadFile 3111->3113 3112 40307b ReadFile 3112->3117 3113->3109 3113->3111 3114 405a13 WriteFile 3113->3114 3114->3113 3116 402f76 GetTickCount 3116->3117 3117->3109 3117->3112 3117->3116 3118 402f9f MulDiv wsprintfA 3117->3118 3139 406195 3117->3139 3146 405a13 WriteFile 3117->3146 3119 404f12 25 API calls 3118->3119 3119->3117 3121->3068 3122->3069 3124 40178f lstrcatA 3123->3124 3125 405785 lstrcatA 3123->3125 3124->3068 3125->3124 3127 406013 FindClose 3126->3127 3128 40601e 3126->3128 3127->3128 3128->3092 3130 405966 3129->3130 3131 405959 SetFileAttributesA 3129->3131 3130->3092 3131->3130 3133 405504 3132->3133 3134 405550 3133->3134 3135 405518 MessageBoxIndirectA 3133->3135 3134->3092 3135->3134 3149 4059e4 ReadFile 3136->3149 3140 4061c2 3139->3140 3141 4061ba 3139->3141 3140->3141 3142 406252 GlobalAlloc 3140->3142 3143 406249 GlobalFree 3140->3143 3144 4062c0 GlobalFree 3140->3144 3145 4062c9 GlobalAlloc 3140->3145 3141->3117 3142->3140 3142->3141 3143->3142 3144->3145 3145->3140 3145->3141 3147 405a31 3146->3147 3147->3117 3148->3101 3150 402eeb 3149->3150 3150->3106 3150->3107 3150->3109 3764 401651 3765 402a3a 18 API calls 3764->3765 3766 401657 3765->3766 3767 405ffd 2 API calls 3766->3767 3768 40165d 3767->3768 3769 401951 3770 402a1d 18 API calls 3769->3770 3771 401958 3770->3771 3772 402a1d 18 API calls 3771->3772 3773 401962 3772->3773 3774 402a3a 18 API calls 3773->3774 3775 40196b 3774->3775 3776 40197e lstrlenA 3775->3776 3777 4019b9 3775->3777 3778 401988 3776->3778 3778->3777 3782 405cf9 lstrcpynA 3778->3782 3780 4019a2 3780->3777 3781 4019af lstrlenA 3780->3781 3781->3777 3782->3780 3783 4019d2 3784 402a3a 18 API calls 3783->3784 3785 4019d9 3784->3785 3786 402a3a 18 API calls 3785->3786 3787 4019e2 3786->3787 3788 4019e9 lstrcmpiA 3787->3788 3789 4019fb lstrcmpA 3787->3789 3790 4019ef 3788->3790 3789->3790 3791 4021d2 3792 402a3a 18 API calls 3791->3792 3793 4021d8 3792->3793 3794 402a3a 18 API calls 3793->3794 3795 4021e1 3794->3795 3796 402a3a 18 API calls 3795->3796 3797 4021ea 3796->3797 3798 405ffd 2 API calls 3797->3798 3799 4021f3 3798->3799 3800 402204 lstrlenA lstrlenA 3799->3800 3804 4021f7 3799->3804 3802 404f12 25 API calls 3800->3802 3801 404f12 25 API calls 3805 4021ff 3801->3805 3803 402240 SHFileOperationA 3802->3803 3803->3804 3803->3805 3804->3801 3804->3805 3806 402254 3807 40225b 3806->3807 3810 40226e 3806->3810 3808 405d1b 18 API calls 3807->3808 3809 402268 3808->3809 3811 4054ef MessageBoxIndirectA 3809->3811 3811->3810 3812 4042d5 3813 4042e5 3812->3813 3814 40430b 3812->3814 3815 403ede 19 API calls 3813->3815 3816 403f45 8 API calls 3814->3816 3817 4042f2 SetDlgItemTextA 3815->3817 3818 404317 3816->3818 3817->3814 3819 4014d6 3820 402a1d 18 API calls 3819->3820 3821 4014dc Sleep 3820->3821 3823 4028cf 3821->3823 3231 4030d9 SetErrorMode GetVersion 3232 403110 3231->3232 3233 403116 3231->3233 3234 406092 5 API calls 3232->3234 3235 406024 3 API calls 3233->3235 3234->3233 3236 40312c lstrlenA 3235->3236 3236->3233 3237 40313b 3236->3237 3238 406092 5 API calls 3237->3238 3239 403143 3238->3239 3240 406092 5 API calls 3239->3240 3241 40314a #17 OleInitialize SHGetFileInfoA 3240->3241 3319 405cf9 lstrcpynA 3241->3319 3243 403187 GetCommandLineA 3320 405cf9 lstrcpynA 3243->3320 3245 403199 GetModuleHandleA 3246 4031b0 3245->3246 3247 405796 CharNextA 3246->3247 3248 4031c4 CharNextA 3247->3248 3253 4031d4 3248->3253 3249 40329e 3250 4032b1 GetTempPathA 3249->3250 3321 4030a8 3250->3321 3252 4032c9 3254 403323 DeleteFileA 3252->3254 3255 4032cd GetWindowsDirectoryA lstrcatA 3252->3255 3253->3249 3256 405796 CharNextA 3253->3256 3261 4032a0 3253->3261 3331 402c66 GetTickCount GetModuleFileNameA 3254->3331 3258 4030a8 12 API calls 3255->3258 3256->3253 3260 4032e9 3258->3260 3259 403337 3262 4033d1 ExitProcess OleUninitialize 3259->3262 3265 4033bd 3259->3265 3270 405796 CharNextA 3259->3270 3260->3254 3264 4032ed GetTempPathA lstrcatA SetEnvironmentVariableA SetEnvironmentVariableA 3260->3264 3416 405cf9 lstrcpynA 3261->3416 3266 403505 3262->3266 3267 4033e7 3262->3267 3268 4030a8 12 API calls 3264->3268 3359 403679 3265->3359 3272 403587 ExitProcess 3266->3272 3273 40350d GetCurrentProcess OpenProcessToken 3266->3273 3271 4054ef MessageBoxIndirectA 3267->3271 3274 40331b 3268->3274 3276 403352 3270->3276 3278 4033f5 ExitProcess 3271->3278 3279 403558 3273->3279 3280 403528 LookupPrivilegeValueA AdjustTokenPrivileges 3273->3280 3274->3254 3274->3262 3282 403398 3276->3282 3283 4033fd 3276->3283 3281 406092 5 API calls 3279->3281 3280->3279 3284 40355f 3281->3284 3417 405859 3282->3417 3286 405472 5 API calls 3283->3286 3285 403574 ExitWindowsEx 3284->3285 3288 403580 3284->3288 3285->3272 3285->3288 3289 403402 lstrcatA 3286->3289 3439 40140b 3288->3439 3292 403413 lstrcatA 3289->3292 3293 40341e lstrcatA lstrcmpiA 3289->3293 3292->3293 3293->3262 3294 40343a 3293->3294 3296 403446 3294->3296 3297 40343f 3294->3297 3301 405455 2 API calls 3296->3301 3299 4053d8 4 API calls 3297->3299 3298 4033b2 3432 405cf9 lstrcpynA 3298->3432 3302 403444 3299->3302 3303 40344b SetCurrentDirectoryA 3301->3303 3302->3303 3304 403465 3303->3304 3305 40345a 3303->3305 3434 405cf9 lstrcpynA 3304->3434 3433 405cf9 lstrcpynA 3305->3433 3308 405d1b 18 API calls 3309 4034a4 DeleteFileA 3308->3309 3310 4034b1 CopyFileA 3309->3310 3316 403473 3309->3316 3310->3316 3311 4034f9 3312 405bb4 38 API calls 3311->3312 3314 403500 3312->3314 3314->3262 3315 405d1b 18 API calls 3315->3316 3316->3308 3316->3311 3316->3315 3317 40548a 2 API calls 3316->3317 3318 4034e5 CloseHandle 3316->3318 3435 405bb4 MoveFileExA 3316->3435 3317->3316 3318->3316 3319->3243 3320->3245 3322 405f64 5 API calls 3321->3322 3323 4030b4 3322->3323 3324 4030be 3323->3324 3325 40576b 3 API calls 3323->3325 3324->3252 3326 4030c6 3325->3326 3327 405455 2 API calls 3326->3327 3328 4030cc 3327->3328 3442 40599b 3328->3442 3446 40596c GetFileAttributesA CreateFileA 3331->3446 3333 402ca6 3352 402cb6 3333->3352 3447 405cf9 lstrcpynA 3333->3447 3335 402ccc 3448 4057b2 lstrlenA 3335->3448 3339 402cdd GetFileSize 3340 402dd9 3339->3340 3358 402cf4 3339->3358 3453 402c02 3340->3453 3342 402de2 3344 402e12 GlobalAlloc 3342->3344 3342->3352 3465 403091 SetFilePointer 3342->3465 3343 40307b ReadFile 3343->3358 3464 403091 SetFilePointer 3344->3464 3347 402e45 3349 402c02 6 API calls 3347->3349 3348 402e2d 3351 402e9f 36 API calls 3348->3351 3349->3352 3350 402dfb 3353 40307b ReadFile 3350->3353 3356 402e39 3351->3356 3352->3259 3355 402e06 3353->3355 3354 402c02 6 API calls 3354->3358 3355->3344 3355->3352 3356->3352 3356->3356 3357 402e76 SetFilePointer 3356->3357 3357->3352 3358->3340 3358->3343 3358->3347 3358->3352 3358->3354 3360 406092 5 API calls 3359->3360 3361 40368d 3360->3361 3362 403693 3361->3362 3363 4036a5 3361->3363 3475 405c57 wsprintfA 3362->3475 3364 405be0 3 API calls 3363->3364 3365 4036d0 3364->3365 3367 4036ee lstrcatA 3365->3367 3369 405be0 3 API calls 3365->3369 3368 4036a3 3367->3368 3466 40393e 3368->3466 3369->3367 3372 405859 18 API calls 3373 403720 3372->3373 3374 4037a9 3373->3374 3376 405be0 3 API calls 3373->3376 3375 405859 18 API calls 3374->3375 3377 4037af 3375->3377 3378 40374c 3376->3378 3379 4037bf LoadImageA 3377->3379 3380 405d1b 18 API calls 3377->3380 3378->3374 3383 403768 lstrlenA 3378->3383 3386 405796 CharNextA 3378->3386 3381 403865 3379->3381 3382 4037e6 RegisterClassA 3379->3382 3380->3379 3385 40140b 2 API calls 3381->3385 3384 40381c SystemParametersInfoA CreateWindowExA 3382->3384 3393 4033cd 3382->3393 3387 403776 lstrcmpiA 3383->3387 3388 40379c 3383->3388 3384->3381 3392 40386b 3385->3392 3390 403766 3386->3390 3387->3388 3391 403786 GetFileAttributesA 3387->3391 3389 40576b 3 API calls 3388->3389 3395 4037a2 3389->3395 3390->3383 3396 403792 3391->3396 3392->3393 3394 40393e 19 API calls 3392->3394 3393->3262 3397 40387c 3394->3397 3476 405cf9 lstrcpynA 3395->3476 3396->3388 3399 4057b2 2 API calls 3396->3399 3400 403888 ShowWindow 3397->3400 3401 40390b 3397->3401 3399->3388 3403 406024 3 API calls 3400->3403 3477 404fe4 OleInitialize 3401->3477 3405 4038a0 3403->3405 3404 403911 3406 403915 3404->3406 3407 40392d 3404->3407 3408 4038ae GetClassInfoA 3405->3408 3410 406024 3 API calls 3405->3410 3406->3393 3413 40140b 2 API calls 3406->3413 3409 40140b 2 API calls 3407->3409 3411 4038c2 GetClassInfoA RegisterClassA 3408->3411 3412 4038d8 DialogBoxParamA 3408->3412 3409->3393 3410->3408 3411->3412 3414 40140b 2 API calls 3412->3414 3413->3393 3415 403900 3414->3415 3415->3393 3416->3250 3492 405cf9 lstrcpynA 3417->3492 3419 40586a 3420 405804 4 API calls 3419->3420 3421 405870 3420->3421 3422 4033a3 3421->3422 3423 405f64 5 API calls 3421->3423 3422->3262 3431 405cf9 lstrcpynA 3422->3431 3429 405880 3423->3429 3424 4058ab lstrlenA 3425 4058b6 3424->3425 3424->3429 3426 40576b 3 API calls 3425->3426 3428 4058bb GetFileAttributesA 3426->3428 3427 405ffd 2 API calls 3427->3429 3428->3422 3429->3422 3429->3424 3429->3427 3430 4057b2 2 API calls 3429->3430 3430->3424 3431->3298 3432->3265 3433->3304 3434->3316 3436 405bc8 3435->3436 3438 405bd5 3435->3438 3493 405a42 lstrcpyA 3436->3493 3438->3316 3440 401389 2 API calls 3439->3440 3441 401420 3440->3441 3441->3272 3443 4059a6 GetTickCount GetTempFileNameA 3442->3443 3444 4030d7 3443->3444 3445 4059d3 3443->3445 3444->3252 3445->3443 3445->3444 3446->3333 3447->3335 3449 4057bf 3448->3449 3450 402cd2 3449->3450 3451 4057c4 CharPrevA 3449->3451 3452 405cf9 lstrcpynA 3450->3452 3451->3449 3451->3450 3452->3339 3454 402c23 3453->3454 3455 402c0b 3453->3455 3458 402c33 GetTickCount 3454->3458 3459 402c2b 3454->3459 3456 402c14 DestroyWindow 3455->3456 3457 402c1b 3455->3457 3456->3457 3457->3342 3461 402c41 CreateDialogParamA ShowWindow 3458->3461 3462 402c64 3458->3462 3460 4060ce 2 API calls 3459->3460 3463 402c31 3460->3463 3461->3462 3462->3342 3463->3342 3464->3348 3465->3350 3467 403952 3466->3467 3484 405c57 wsprintfA 3467->3484 3469 4039c3 3470 405d1b 18 API calls 3469->3470 3471 4039cf SetWindowTextA 3470->3471 3472 4036fe 3471->3472 3473 4039eb 3471->3473 3472->3372 3473->3472 3474 405d1b 18 API calls 3473->3474 3474->3473 3475->3368 3476->3374 3485 403f2a 3477->3485 3479 405007 3483 40502e 3479->3483 3488 401389 3479->3488 3480 403f2a SendMessageA 3481 405040 OleUninitialize 3480->3481 3481->3404 3483->3480 3484->3469 3486 403f42 3485->3486 3487 403f33 SendMessageA 3485->3487 3486->3479 3487->3486 3490 401390 3488->3490 3489 4013fe 3489->3479 3490->3489 3491 4013cb MulDiv SendMessageA 3490->3491 3491->3490 3492->3419 3494 405a90 GetShortPathNameA 3493->3494 3495 405a6a 3493->3495 3497 405aa5 3494->3497 3498 405baf 3494->3498 3520 40596c GetFileAttributesA CreateFileA 3495->3520 3497->3498 3500 405aad wsprintfA 3497->3500 3498->3438 3499 405a74 CloseHandle GetShortPathNameA 3499->3498 3501 405a88 3499->3501 3502 405d1b 18 API calls 3500->3502 3501->3494 3501->3498 3503 405ad5 3502->3503 3521 40596c GetFileAttributesA CreateFileA 3503->3521 3505 405ae2 3505->3498 3506 405af1 GetFileSize GlobalAlloc 3505->3506 3507 405b13 3506->3507 3508 405ba8 CloseHandle 3506->3508 3509 4059e4 ReadFile 3507->3509 3508->3498 3510 405b1b 3509->3510 3510->3508 3522 4058d1 lstrlenA 3510->3522 3513 405b32 lstrcpyA 3515 405b54 3513->3515 3514 405b46 3516 4058d1 4 API calls 3514->3516 3517 405b8b SetFilePointer 3515->3517 3516->3515 3518 405a13 WriteFile 3517->3518 3519 405ba1 GlobalFree 3518->3519 3519->3508 3520->3499 3521->3505 3523 405912 lstrlenA 3522->3523 3524 40591a 3523->3524 3525 4058eb lstrcmpiA 3523->3525 3524->3513 3524->3514 3525->3524 3526 405909 CharNextA 3525->3526 3526->3523 3824 40155b 3825 401577 ShowWindow 3824->3825 3826 40157e 3824->3826 3825->3826 3827 40158c ShowWindow 3826->3827 3828 4028cf 3826->3828 3827->3828 3829 40255c 3830 402a1d 18 API calls 3829->3830 3836 402566 3830->3836 3831 4025d0 3832 4059e4 ReadFile 3832->3836 3833 4025d2 3838 405c57 wsprintfA 3833->3838 3835 4025e2 3835->3831 3837 4025f8 SetFilePointer 3835->3837 3836->3831 3836->3832 3836->3833 3836->3835 3837->3831 3838->3831 3839 40205e 3840 402a3a 18 API calls 3839->3840 3841 402065 3840->3841 3842 402a3a 18 API calls 3841->3842 3843 40206f 3842->3843 3844 402a3a 18 API calls 3843->3844 3845 402079 3844->3845 3846 402a3a 18 API calls 3845->3846 3847 402083 3846->3847 3848 402a3a 18 API calls 3847->3848 3849 40208d 3848->3849 3850 4020cc CoCreateInstance 3849->3850 3851 402a3a 18 API calls 3849->3851 3854 4020eb 3850->3854 3856 402193 3850->3856 3851->3850 3852 401423 25 API calls 3853 4021c9 3852->3853 3855 402173 MultiByteToWideChar 3854->3855 3854->3856 3855->3856 3856->3852 3856->3853 3857 40265e 3858 402664 3857->3858 3859 402668 FindNextFileA 3858->3859 3861 40267a 3858->3861 3860 4026b9 3859->3860 3859->3861 3863 405cf9 lstrcpynA 3860->3863 3863->3861 3864 401cde GetDlgItem GetClientRect 3865 402a3a 18 API calls 3864->3865 3866 401d0e LoadImageA SendMessageA 3865->3866 3867 401d2c DeleteObject 3866->3867 3868 4028cf 3866->3868 3867->3868 3869 401662 3870 402a3a 18 API calls 3869->3870 3871 401669 3870->3871 3872 402a3a 18 API calls 3871->3872 3873 401672 3872->3873 3874 402a3a 18 API calls 3873->3874 3875 40167b MoveFileA 3874->3875 3876 40168e 3875->3876 3882 401687 3875->3882 3877 4021c9 3876->3877 3879 405ffd 2 API calls 3876->3879 3878 401423 25 API calls 3878->3877 3880 40169d 3879->3880 3880->3877 3881 405bb4 38 API calls 3880->3881 3881->3882 3882->3878 3890 402364 3891 40236a 3890->3891 3892 402a3a 18 API calls 3891->3892 3893 40237c 3892->3893 3894 402a3a 18 API calls 3893->3894 3895 402386 RegCreateKeyExA 3894->3895 3896 4023b0 3895->3896 3897 4028cf 3895->3897 3898 4023c8 3896->3898 3899 402a3a 18 API calls 3896->3899 3901 402a1d 18 API calls 3898->3901 3903 4023d4 3898->3903 3900 4023c1 lstrlenA 3899->3900 3900->3898 3901->3903 3902 4023ef RegSetValueExA 3905 402405 RegCloseKey 3902->3905 3903->3902 3904 402e9f 36 API calls 3903->3904 3904->3902 3905->3897 3907 401dea 3908 402a3a 18 API calls 3907->3908 3909 401df0 3908->3909 3910 402a3a 18 API calls 3909->3910 3911 401df9 3910->3911 3912 402a3a 18 API calls 3911->3912 3913 401e02 3912->3913 3914 402a3a 18 API calls 3913->3914 3915 401e0b 3914->3915 3916 401423 25 API calls 3915->3916 3917 401e12 ShellExecuteA 3916->3917 3918 401e3f 3917->3918 3919 40466d 3920 404699 3919->3920 3921 40467d 3919->3921 3923 4046cc 3920->3923 3924 40469f SHGetPathFromIDListA 3920->3924 3930 4054d3 GetDlgItemTextA 3921->3930 3926 4046b6 SendMessageA 3924->3926 3927 4046af 3924->3927 3925 40468a SendMessageA 3925->3920 3926->3923 3928 40140b 2 API calls 3927->3928 3928->3926 3930->3925 3931 401eee 3932 402a3a 18 API calls 3931->3932 3933 401ef5 3932->3933 3934 406092 5 API calls 3933->3934 3935 401f04 3934->3935 3936 401f1c GlobalAlloc 3935->3936 3939 401f84 3935->3939 3937 401f30 3936->3937 3936->3939 3938 406092 5 API calls 3937->3938 3940 401f37 3938->3940 3941 406092 5 API calls 3940->3941 3942 401f41 3941->3942 3942->3939 3946 405c57 wsprintfA 3942->3946 3944 401f78 3947 405c57 wsprintfA 3944->3947 3946->3944 3947->3939 3948 4014f0 SetForegroundWindow 3949 4028cf 3948->3949 3950 403ff2 lstrcpynA lstrlenA 3956 4018f5 3957 40192c 3956->3957 3958 402a3a 18 API calls 3957->3958 3959 401931 3958->3959 3960 40559b 69 API calls 3959->3960 3961 40193a 3960->3961 3962 4024f7 3963 402a3a 18 API calls 3962->3963 3964 4024fe 3963->3964 3967 40596c GetFileAttributesA CreateFileA 3964->3967 3966 40250a 3967->3966 3968 4018f8 3969 402a3a 18 API calls 3968->3969 3970 4018ff 3969->3970 3971 4054ef MessageBoxIndirectA 3970->3971 3972 401908 3971->3972 3987 4014fe 3988 401506 3987->3988 3990 401519 3987->3990 3989 402a1d 18 API calls 3988->3989 3989->3990 3991 402b7f 3992 402b8e SetTimer 3991->3992 3995 402ba7 3991->3995 3992->3995 3993 402bfc 3994 402bc1 MulDiv wsprintfA SetWindowTextA SetDlgItemTextA 3994->3993 3995->3993 3995->3994 3996 401000 3997 401037 BeginPaint GetClientRect 3996->3997 3998 40100c DefWindowProcA 3996->3998 4000 4010f3 3997->4000 4001 401179 3998->4001 4002 401073 CreateBrushIndirect FillRect DeleteObject 4000->4002 4003 4010fc 4000->4003 4002->4000 4004 401102 CreateFontIndirectA 4003->4004 4005 401167 EndPaint 4003->4005 4004->4005 4006 401112 6 API calls 4004->4006 4005->4001 4006->4005 4014 401b02 4015 402a3a 18 API calls 4014->4015 4016 401b09 4015->4016 4017 402a1d 18 API calls 4016->4017 4018 401b12 wsprintfA 4017->4018 4019 4028cf 4018->4019 4020 402482 4030 402b44 4020->4030 4022 40248c 4023 402a1d 18 API calls 4022->4023 4024 402495 4023->4024 4025 4026a6 4024->4025 4026 4024b8 RegEnumValueA 4024->4026 4027 4024ac RegEnumKeyA 4024->4027 4026->4025 4028 4024d1 RegCloseKey 4026->4028 4027->4028 4028->4025 4031 402a3a 18 API calls 4030->4031 4032 402b5d 4031->4032 4033 402b6b RegOpenKeyExA 4032->4033 4033->4022 3151 402283 3152 402291 3151->3152 3153 40228b 3151->3153 3155 402a3a 18 API calls 3152->3155 3157 4022a1 3152->3157 3154 402a3a 18 API calls 3153->3154 3154->3152 3155->3157 3156 4022af 3159 402a3a 18 API calls 3156->3159 3157->3156 3158 402a3a 18 API calls 3157->3158 3158->3156 3160 4022b8 WritePrivateProfileStringA 3159->3160 4034 401a03 4035 402a3a 18 API calls 4034->4035 4036 401a0c ExpandEnvironmentStringsA 4035->4036 4037 401a20 4036->4037 4039 401a33 4036->4039 4038 401a25 lstrcmpA 4037->4038 4037->4039 4038->4039 4040 404e86 4041 404e96 4040->4041 4042 404eaa 4040->4042 4043 404e9c 4041->4043 4052 404ef3 4041->4052 4044 404eb2 IsWindowVisible 4042->4044 4048 404ec9 4042->4048 4046 403f2a SendMessageA 4043->4046 4047 404ebf 4044->4047 4044->4052 4045 404ef8 CallWindowProcA 4049 404ea6 4045->4049 4046->4049 4053 4047dd SendMessageA 4047->4053 4048->4045 4058 40485d 4048->4058 4052->4045 4054 404800 GetMessagePos ScreenToClient SendMessageA 4053->4054 4055 40483c SendMessageA 4053->4055 4056 404834 4054->4056 4057 404839 4054->4057 4055->4056 4056->4048 4057->4055 4067 405cf9 lstrcpynA 4058->4067 4060 404870 4068 405c57 wsprintfA 4060->4068 4062 40487a 4063 40140b 2 API calls 4062->4063 4064 404883 4063->4064 4069 405cf9 lstrcpynA 4064->4069 4066 40488a 4066->4052 4067->4060 4068->4062 4069->4066 4070 402308 4071 402338 4070->4071 4072 40230d 4070->4072 4074 402a3a 18 API calls 4071->4074 4073 402b44 19 API calls 4072->4073 4075 402314 4073->4075 4076 40233f 4074->4076 4077 402a3a 18 API calls 4075->4077 4080 402355 4075->4080 4081 402a7a RegOpenKeyExA 4076->4081 4078 402325 RegDeleteValueA RegCloseKey 4077->4078 4078->4080 4088 402aa5 4081->4088 4090 402af1 4081->4090 4082 402acb RegEnumKeyA 4083 402add RegCloseKey 4082->4083 4082->4088 4084 406092 5 API calls 4083->4084 4087 402aed 4084->4087 4085 402b02 RegCloseKey 4085->4090 4086 402a7a 5 API calls 4086->4088 4089 402b1d RegDeleteKeyA 4087->4089 4087->4090 4088->4082 4088->4083 4088->4085 4088->4086 4089->4090 4090->4080 4091 402688 4092 402a3a 18 API calls 4091->4092 4093 40268f FindFirstFileA 4092->4093 4094 4026b2 4093->4094 4098 4026a2 4093->4098 4095 4026b9 4094->4095 4099 405c57 wsprintfA 4094->4099 4100 405cf9 lstrcpynA 4095->4100 4099->4095 4100->4098 3527 401389 3529 401390 3527->3529 3528 4013fe 3529->3528 3530 4013cb MulDiv SendMessageA 3529->3530 3530->3529 4101 401c8a 4102 402a1d 18 API calls 4101->4102 4103 401c90 IsWindow 4102->4103 4104 4019f3 4103->4104 4105 403a0b 4106 403a23 4105->4106 4107 403b5e 4105->4107 4106->4107 4108 403a2f 4106->4108 4109 403b6f GetDlgItem GetDlgItem 4107->4109 4114 403baf 4107->4114 4110 403a3a SetWindowPos 4108->4110 4111 403a4d 4108->4111 4112 403ede 19 API calls 4109->4112 4110->4111 4116 403a52 ShowWindow 4111->4116 4117 403a6a 4111->4117 4118 403b99 SetClassLongA 4112->4118 4113 403c09 4115 403f2a SendMessageA 4113->4115 4119 403b59 4113->4119 4114->4113 4123 401389 2 API calls 4114->4123 4144 403c1b 4115->4144 4116->4117 4120 403a72 DestroyWindow 4117->4120 4121 403a8c 4117->4121 4122 40140b 2 API calls 4118->4122 4125 403e67 4120->4125 4126 403a91 SetWindowLongA 4121->4126 4127 403aa2 4121->4127 4122->4114 4124 403be1 4123->4124 4124->4113 4128 403be5 SendMessageA 4124->4128 4125->4119 4134 403e98 ShowWindow 4125->4134 4126->4119 4131 403b19 4127->4131 4132 403aae GetDlgItem 4127->4132 4128->4119 4129 40140b 2 API calls 4129->4144 4130 403e69 DestroyWindow EndDialog 4130->4125 4133 403f45 8 API calls 4131->4133 4135 403ac1 SendMessageA IsWindowEnabled 4132->4135 4136 403ade 4132->4136 4133->4119 4134->4119 4135->4119 4135->4136 4138 403aeb 4136->4138 4139 403b32 SendMessageA 4136->4139 4140 403afe 4136->4140 4148 403ae3 4136->4148 4137 405d1b 18 API calls 4137->4144 4138->4139 4138->4148 4139->4131 4142 403b06 4140->4142 4143 403b1b 4140->4143 4141 403eb7 SendMessageA 4141->4131 4145 40140b 2 API calls 4142->4145 4146 40140b 2 API calls 4143->4146 4144->4119 4144->4129 4144->4130 4144->4137 4147 403ede 19 API calls 4144->4147 4149 403ede 19 API calls 4144->4149 4164 403da9 DestroyWindow 4144->4164 4145->4148 4146->4148 4147->4144 4148->4131 4148->4141 4150 403c96 GetDlgItem 4149->4150 4151 403cb3 ShowWindow EnableWindow 4150->4151 4152 403cab 4150->4152 4173 403f00 EnableWindow 4151->4173 4152->4151 4154 403cdd EnableWindow 4157 403cf1 4154->4157 4155 403cf6 GetSystemMenu EnableMenuItem SendMessageA 4156 403d26 SendMessageA 4155->4156 4155->4157 4156->4157 4157->4155 4174 403f13 SendMessageA 4157->4174 4175 405cf9 lstrcpynA 4157->4175 4160 403d54 lstrlenA 4161 405d1b 18 API calls 4160->4161 4162 403d65 SetWindowTextA 4161->4162 4163 401389 2 API calls 4162->4163 4163->4144 4164->4125 4165 403dc3 CreateDialogParamA 4164->4165 4165->4125 4166 403df6 4165->4166 4167 403ede 19 API calls 4166->4167 4168 403e01 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4167->4168 4169 401389 2 API calls 4168->4169 4170 403e47 4169->4170 4170->4119 4171 403e4f ShowWindow 4170->4171 4172 403f2a SendMessageA 4171->4172 4172->4125 4173->4154 4174->4157 4175->4160 4176 40488f GetDlgItem GetDlgItem 4177 4048e1 7 API calls 4176->4177 4185 404af9 4176->4185 4178 404984 DeleteObject 4177->4178 4179 404977 SendMessageA 4177->4179 4180 40498d 4178->4180 4179->4178 4181 4049c4 4180->4181 4184 405d1b 18 API calls 4180->4184 4186 403ede 19 API calls 4181->4186 4182 404c89 4188 404c93 SendMessageA 4182->4188 4189 404c9b 4182->4189 4183 404bdd 4183->4182 4192 404c36 SendMessageA 4183->4192 4219 404aec 4183->4219 4190 4049a6 SendMessageA SendMessageA 4184->4190 4185->4183 4195 4047dd 5 API calls 4185->4195 4210 404b6a 4185->4210 4187 4049d8 4186->4187 4191 403ede 19 API calls 4187->4191 4188->4189 4199 404cb4 4189->4199 4200 404cad ImageList_Destroy 4189->4200 4206 404cc4 4189->4206 4190->4180 4212 4049e6 4191->4212 4197 404c4b SendMessageA 4192->4197 4192->4219 4193 403f45 8 API calls 4198 404e7f 4193->4198 4194 404bcf SendMessageA 4194->4183 4195->4210 4196 404e33 4204 404e45 ShowWindow GetDlgItem ShowWindow 4196->4204 4196->4219 4203 404c5e 4197->4203 4201 404cbd GlobalFree 4199->4201 4199->4206 4200->4199 4201->4206 4202 404aba GetWindowLongA SetWindowLongA 4205 404ad3 4202->4205 4213 404c6f SendMessageA 4203->4213 4204->4219 4207 404af1 4205->4207 4208 404ad9 ShowWindow 4205->4208 4206->4196 4218 40485d 4 API calls 4206->4218 4223 404cff 4206->4223 4228 403f13 SendMessageA 4207->4228 4227 403f13 SendMessageA 4208->4227 4210->4183 4210->4194 4211 404a35 SendMessageA 4211->4212 4212->4202 4212->4211 4214 404ab4 4212->4214 4216 404a71 SendMessageA 4212->4216 4217 404a82 SendMessageA 4212->4217 4213->4182 4214->4202 4214->4205 4216->4212 4217->4212 4218->4223 4219->4193 4220 404e09 InvalidateRect 4220->4196 4221 404e1f 4220->4221 4229 404798 4221->4229 4222 404d2d SendMessageA 4226 404d43 4222->4226 4223->4222 4223->4226 4225 404db7 SendMessageA SendMessageA 4225->4226 4226->4220 4226->4225 4227->4219 4228->4185 4232 4046d3 4229->4232 4231 4047ad 4231->4196 4233 4046e9 4232->4233 4234 405d1b 18 API calls 4233->4234 4235 40474d 4234->4235 4236 405d1b 18 API calls 4235->4236 4237 404758 4236->4237 4238 405d1b 18 API calls 4237->4238 4239 40476e lstrlenA wsprintfA SetDlgItemTextA 4238->4239 4239->4231 2984 401f90 2985 401fa2 2984->2985 2986 402050 2984->2986 3002 402a3a 2985->3002 2989 401423 25 API calls 2986->2989 2995 4021c9 2989->2995 2990 402a3a 18 API calls 2991 401fb2 2990->2991 2992 401fc7 LoadLibraryExA 2991->2992 2993 401fba GetModuleHandleA 2991->2993 2992->2986 2994 401fd7 GetProcAddress 2992->2994 2993->2992 2993->2994 2996 402023 2994->2996 2997 401fe6 2994->2997 3011 404f12 2996->3011 3000 401ff6 2997->3000 3008 401423 2997->3008 3000->2995 3001 402044 FreeLibrary 3000->3001 3001->2995 3003 402a46 3002->3003 3022 405d1b 3003->3022 3006 401fa9 3006->2990 3009 404f12 25 API calls 3008->3009 3010 401431 3009->3010 3010->3000 3012 404f2d 3011->3012 3021 404fd0 3011->3021 3013 404f4a lstrlenA 3012->3013 3016 405d1b 18 API calls 3012->3016 3014 404f73 3013->3014 3015 404f58 lstrlenA 3013->3015 3018 404f86 3014->3018 3019 404f79 SetWindowTextA 3014->3019 3017 404f6a lstrcatA 3015->3017 3015->3021 3016->3013 3017->3014 3020 404f8c SendMessageA SendMessageA SendMessageA 3018->3020 3018->3021 3019->3018 3020->3021 3021->3000 3039 405d28 3022->3039 3023 405f4b 3024 402a67 3023->3024 3056 405cf9 lstrcpynA 3023->3056 3024->3006 3040 405f64 3024->3040 3026 405dc9 GetVersion 3026->3039 3027 405f22 lstrlenA 3027->3039 3029 405d1b 10 API calls 3029->3027 3032 405e41 GetSystemDirectoryA 3032->3039 3033 405e54 GetWindowsDirectoryA 3033->3039 3034 405f64 5 API calls 3034->3039 3035 405d1b 10 API calls 3035->3039 3036 405ecb lstrcatA 3036->3039 3037 405e88 SHGetSpecialFolderLocation 3038 405ea0 SHGetPathFromIDListA CoTaskMemFree 3037->3038 3037->3039 3038->3039 3039->3023 3039->3026 3039->3027 3039->3029 3039->3032 3039->3033 3039->3034 3039->3035 3039->3036 3039->3037 3049 405be0 RegOpenKeyExA 3039->3049 3054 405c57 wsprintfA 3039->3054 3055 405cf9 lstrcpynA 3039->3055 3041 405f70 3040->3041 3043 405fcd CharNextA 3041->3043 3044 405fd8 3041->3044 3047 405fbb CharNextA 3041->3047 3048 405fc8 CharNextA 3041->3048 3057 405796 3041->3057 3042 405fdc CharPrevA 3042->3044 3043->3041 3043->3044 3044->3042 3045 405ff7 3044->3045 3045->3006 3047->3041 3048->3043 3050 405c51 3049->3050 3051 405c13 RegQueryValueExA 3049->3051 3050->3039 3052 405c34 RegCloseKey 3051->3052 3052->3050 3054->3039 3055->3039 3056->3024 3058 40579c 3057->3058 3059 4057af 3058->3059 3060 4057a2 CharNextA 3058->3060 3059->3041 3060->3058 4240 402410 4241 402b44 19 API calls 4240->4241 4242 40241a 4241->4242 4243 402a3a 18 API calls 4242->4243 4244 402423 4243->4244 4245 40242d RegQueryValueExA 4244->4245 4249 4026a6 4244->4249 4246 402453 RegCloseKey 4245->4246 4247 40244d 4245->4247 4246->4249 4247->4246 4251 405c57 wsprintfA 4247->4251 4251->4246 4252 401490 4253 404f12 25 API calls 4252->4253 4254 401497 4253->4254 4255 406690 4259 4061c8 4255->4259 4256 406b33 4257 406252 GlobalAlloc 4257->4256 4257->4259 4258 406249 GlobalFree 4258->4257 4259->4256 4259->4257 4259->4258 4259->4259 4260 4062c0 GlobalFree 4259->4260 4261 4062c9 GlobalAlloc 4259->4261 4260->4261 4261->4256 4261->4259 4262 401595 4263 402a3a 18 API calls 4262->4263 4264 40159c SetFileAttributesA 4263->4264 4265 4015ae 4264->4265 4266 402616 4267 40261d 4266->4267 4270 40287c 4266->4270 4268 402a1d 18 API calls 4267->4268 4269 402628 4268->4269 4271 40262f SetFilePointer 4269->4271 4271->4270 4272 40263f 4271->4272 4274 405c57 wsprintfA 4272->4274 4274->4270 4275 401717 4276 402a3a 18 API calls 4275->4276 4277 40171e SearchPathA 4276->4277 4278 401739 4277->4278 4279 402519 4280 40252e 4279->4280 4281 40251e 4279->4281 4283 402a3a 18 API calls 4280->4283 4282 402a1d 18 API calls 4281->4282 4284 402527 4282->4284 4285 402535 lstrlenA 4283->4285 4286 405a13 WriteFile 4284->4286 4287 402557 4284->4287 4285->4284 4286->4287 4288 40431c 4289 404348 4288->4289 4290 404359 4288->4290 4349 4054d3 GetDlgItemTextA 4289->4349 4292 404365 GetDlgItem 4290->4292 4299 4043c4 4290->4299 4297 404379 4292->4297 4293 404353 4294 405f64 5 API calls 4293->4294 4294->4290 4295 4044a8 4298 404652 4295->4298 4351 4054d3 GetDlgItemTextA 4295->4351 4296 40438d SetWindowTextA 4301 403ede 19 API calls 4296->4301 4297->4296 4305 405804 4 API calls 4297->4305 4304 403f45 8 API calls 4298->4304 4299->4295 4299->4298 4302 405d1b 18 API calls 4299->4302 4306 4043a9 4301->4306 4307 404438 SHBrowseForFolderA 4302->4307 4303 4044d8 4308 405859 18 API calls 4303->4308 4309 404666 4304->4309 4310 404383 4305->4310 4311 403ede 19 API calls 4306->4311 4307->4295 4312 404450 CoTaskMemFree 4307->4312 4313 4044de 4308->4313 4310->4296 4316 40576b 3 API calls 4310->4316 4314 4043b7 4311->4314 4315 40576b 3 API calls 4312->4315 4352 405cf9 lstrcpynA 4313->4352 4350 403f13 SendMessageA 4314->4350 4318 40445d 4315->4318 4316->4296 4321 404494 SetDlgItemTextA 4318->4321 4325 405d1b 18 API calls 4318->4325 4320 4043bd 4323 406092 5 API calls 4320->4323 4321->4295 4322 4044f5 4324 406092 5 API calls 4322->4324 4323->4299 4332 4044fc 4324->4332 4326 40447c lstrcmpiA 4325->4326 4326->4321 4329 40448d lstrcatA 4326->4329 4327 404538 4353 405cf9 lstrcpynA 4327->4353 4329->4321 4330 40453f 4331 405804 4 API calls 4330->4331 4333 404545 GetDiskFreeSpaceA 4331->4333 4332->4327 4335 4057b2 2 API calls 4332->4335 4337 404590 4332->4337 4336 404569 MulDiv 4333->4336 4333->4337 4335->4332 4336->4337 4338 404601 4337->4338 4339 404798 21 API calls 4337->4339 4340 404624 4338->4340 4342 40140b 2 API calls 4338->4342 4341 4045ee 4339->4341 4354 403f00 EnableWindow 4340->4354 4344 404603 SetDlgItemTextA 4341->4344 4345 4045f3 4341->4345 4342->4340 4344->4338 4347 4046d3 21 API calls 4345->4347 4346 404640 4346->4298 4355 4042b1 4346->4355 4347->4338 4349->4293 4350->4320 4351->4303 4352->4322 4353->4330 4354->4346 4356 4042c4 SendMessageA 4355->4356 4357 4042bf 4355->4357 4356->4298 4357->4356 4358 40149d 4359 4014ab PostQuitMessage 4358->4359 4360 40226e 4358->4360 4359->4360 3590 40359f 3591 4035b7 3590->3591 3592 4035a9 CloseHandle 3590->3592 3597 4035e4 3591->3597 3592->3591 3595 40559b 69 API calls 3596 4035c8 3595->3596 3598 4035f2 3597->3598 3599 4035bc 3598->3599 3600 4035f7 FreeLibrary GlobalFree 3598->3600 3599->3595 3600->3599 3600->3600 4361 401b23 4362 401b30 4361->4362 4363 401b74 4361->4363 4364 401bb8 4362->4364 4369 401b47 4362->4369 4365 401b78 4363->4365 4366 401b9d GlobalAlloc 4363->4366 4368 405d1b 18 API calls 4364->4368 4374 40226e 4364->4374 4365->4374 4382 405cf9 lstrcpynA 4365->4382 4367 405d1b 18 API calls 4366->4367 4367->4364 4370 402268 4368->4370 4380 405cf9 lstrcpynA 4369->4380 4376 4054ef MessageBoxIndirectA 4370->4376 4372 401b8a GlobalFree 4372->4374 4375 401b56 4381 405cf9 lstrcpynA 4375->4381 4376->4374 4378 401b65 4383 405cf9 lstrcpynA 4378->4383 4380->4375 4381->4378 4382->4372 4383->4374 4384 404027 4385 40403d 4384->4385 4390 404149 4384->4390 4388 403ede 19 API calls 4385->4388 4386 4041b8 4387 40428c 4386->4387 4389 4041c2 GetDlgItem 4386->4389 4393 403f45 8 API calls 4387->4393 4391 404093 4388->4391 4395 4041d8 4389->4395 4396 40424a 4389->4396 4390->4386 4390->4387 4392 40418d GetDlgItem SendMessageA 4390->4392 4394 403ede 19 API calls 4391->4394 4415 403f00 EnableWindow 4392->4415 4398 404287 4393->4398 4399 4040a0 CheckDlgButton 4394->4399 4395->4396 4400 4041fe 6 API calls 4395->4400 4396->4387 4401 40425c 4396->4401 4413 403f00 EnableWindow 4399->4413 4400->4396 4404 404262 SendMessageA 4401->4404 4405 404273 4401->4405 4402 4041b3 4407 4042b1 SendMessageA 4402->4407 4404->4405 4405->4398 4406 404279 SendMessageA 4405->4406 4406->4398 4407->4386 4408 4040be GetDlgItem 4414 403f13 SendMessageA 4408->4414 4410 4040d4 SendMessageA 4411 4040f2 GetSysColor 4410->4411 4412 4040fb SendMessageA SendMessageA lstrlenA SendMessageA SendMessageA 4410->4412 4411->4412 4412->4398 4413->4408 4414->4410 4415->4402 4416 401ca7 4417 402a1d 18 API calls 4416->4417 4418 401cae 4417->4418 4419 402a1d 18 API calls 4418->4419 4420 401cb6 GetDlgItem 4419->4420 4421 402513 4420->4421 3531 40192a 3532 40192c 3531->3532 3533 402a3a 18 API calls 3532->3533 3534 401931 3533->3534 3537 40559b 3534->3537 3538 405859 18 API calls 3537->3538 3539 4055bb 3538->3539 3540 4055c3 DeleteFileA 3539->3540 3541 4055da 3539->3541 3545 40193a 3540->3545 3543 405708 3541->3543 3574 405cf9 lstrcpynA 3541->3574 3543->3545 3548 405ffd 2 API calls 3543->3548 3544 405600 3546 405613 3544->3546 3547 405606 lstrcatA 3544->3547 3550 4057b2 2 API calls 3546->3550 3549 405619 3547->3549 3552 40572c 3548->3552 3551 405627 lstrcatA 3549->3551 3553 405632 lstrlenA FindFirstFileA 3549->3553 3550->3549 3551->3553 3552->3545 3554 40576b 3 API calls 3552->3554 3553->3543 3572 405656 3553->3572 3556 405736 3554->3556 3555 405796 CharNextA 3555->3572 3557 405553 5 API calls 3556->3557 3558 405742 3557->3558 3559 405746 3558->3559 3560 40575c 3558->3560 3559->3545 3565 404f12 25 API calls 3559->3565 3561 404f12 25 API calls 3560->3561 3561->3545 3562 4056e7 FindNextFileA 3564 4056ff FindClose 3562->3564 3562->3572 3564->3543 3566 405753 3565->3566 3567 405bb4 38 API calls 3566->3567 3567->3545 3569 40559b 62 API calls 3569->3572 3570 404f12 25 API calls 3570->3562 3571 404f12 25 API calls 3571->3572 3572->3555 3572->3562 3572->3569 3572->3570 3572->3571 3573 405bb4 38 API calls 3572->3573 3575 405cf9 lstrcpynA 3572->3575 3576 405553 3572->3576 3573->3572 3574->3544 3575->3572 3577 405947 2 API calls 3576->3577 3578 40555f 3577->3578 3579 405580 3578->3579 3580 405576 DeleteFileA 3578->3580 3581 40556e RemoveDirectoryA 3578->3581 3579->3572 3582 40557c 3580->3582 3581->3582 3582->3579 3583 40558c SetFileAttributesA 3582->3583 3583->3579 4429 4028aa SendMessageA 4430 4028c4 InvalidateRect 4429->4430 4431 4028cf 4429->4431 4430->4431 3161 4015b3 3162 402a3a 18 API calls 3161->3162 3163 4015ba 3162->3163 3180 405804 CharNextA CharNextA 3163->3180 3165 40161c 3167 401621 3165->3167 3168 40164a 3165->3168 3166 405796 CharNextA 3176 4015c2 3166->3176 3169 401423 25 API calls 3167->3169 3170 401423 25 API calls 3168->3170 3171 401628 3169->3171 3178 401642 3170->3178 3194 405cf9 lstrcpynA 3171->3194 3175 401633 SetCurrentDirectoryA 3175->3178 3176->3165 3176->3166 3177 401604 GetFileAttributesA 3176->3177 3186 405472 3176->3186 3189 4053d8 CreateDirectoryA 3176->3189 3195 405455 CreateDirectoryA 3176->3195 3177->3176 3181 40581f 3180->3181 3184 40582f 3180->3184 3182 40582a CharNextA 3181->3182 3181->3184 3185 40584f 3182->3185 3183 405796 CharNextA 3183->3184 3184->3183 3184->3185 3185->3176 3198 406092 GetModuleHandleA 3186->3198 3190 405425 3189->3190 3191 405429 GetLastError 3189->3191 3190->3176 3191->3190 3192 405438 SetFileSecurityA 3191->3192 3192->3190 3193 40544e GetLastError 3192->3193 3193->3190 3194->3175 3196 405465 3195->3196 3197 405469 GetLastError 3195->3197 3196->3176 3197->3196 3199 4060b8 GetProcAddress 3198->3199 3200 4060ae 3198->3200 3202 405479 3199->3202 3204 406024 GetSystemDirectoryA 3200->3204 3202->3176 3203 4060b4 3203->3199 3203->3202 3205 406046 wsprintfA LoadLibraryExA 3204->3205 3205->3203 4432 4016b3 4433 402a3a 18 API calls 4432->4433 4434 4016b9 GetFullPathNameA 4433->4434 4435 4016f1 4434->4435 4436 4016d0 4434->4436 4437 401705 GetShortPathNameA 4435->4437 4438 4028cf 4435->4438 4436->4435 4439 405ffd 2 API calls 4436->4439 4437->4438 4440 4016e1 4439->4440 4440->4435 4442 405cf9 lstrcpynA 4440->4442 4442->4435 4443 403637 4444 403642 4443->4444 4445 403646 4444->4445 4446 403649 GlobalAlloc 4444->4446 4446->4445 4454 4014b7 4455 4014bd 4454->4455 4456 401389 2 API calls 4455->4456 4457 4014c5 4456->4457 4458 401d38 GetDC GetDeviceCaps 4459 402a1d 18 API calls 4458->4459 4460 401d56 MulDiv ReleaseDC 4459->4460 4461 402a1d 18 API calls 4460->4461 4462 401d75 4461->4462 4463 405d1b 18 API calls 4462->4463 4464 401dae CreateFontIndirectA 4463->4464 4465 402513 4464->4465 3584 40173e 3585 402a3a 18 API calls 3584->3585 3586 401745 3585->3586 3587 40599b 2 API calls 3586->3587 3588 40174c 3587->3588 3589 40599b 2 API calls 3588->3589 3589->3588 4466 401ebe 4467 402a3a 18 API calls 4466->4467 4468 401ec5 4467->4468 4469 405ffd 2 API calls 4468->4469 4470 401ecb 4469->4470 4472 401edd 4470->4472 4473 405c57 wsprintfA 4470->4473 4473->4472 4474 40193f 4475 402a3a 18 API calls 4474->4475 4476 401946 lstrlenA 4475->4476 4477 402513 4476->4477

                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                        Function 004030D9 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 357stringcomfileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 0 4030d9-40310e SetErrorMode GetVersion 1 403110-403118 call 406092 0->1 2 403121 0->2 1->2 8 40311a 1->8 3 403126-403139 call 406024 lstrlenA 2->3 9 40313b-4031ae call 406092 * 2 #17 OleInitialize SHGetFileInfoA call 405cf9 GetCommandLineA call 405cf9 GetModuleHandleA 3->9 8->2 18 4031b0-4031b5 9->18 19 4031ba-4031cf call 405796 CharNextA 9->19 18->19 22 403294-403298 19->22 23 4031d4-4031d7 22->23 24 40329e 22->24 25 4031d9-4031dd 23->25 26 4031df-4031e7 23->26 27 4032b1-4032cb GetTempPathA call 4030a8 24->27 25->25 25->26 28 4031e9-4031ea 26->28 29 4031ef-4031f2 26->29 36 403323-40333d DeleteFileA call 402c66 27->36 37 4032cd-4032eb GetWindowsDirectoryA lstrcatA call 4030a8 27->37 28->29 31 403284-403291 call 405796 29->31 32 4031f8-4031fc 29->32 31->22 47 403293 31->47 34 403214-403241 32->34 35 4031fe-403204 32->35 43 403243-403249 34->43 44 403254-403282 34->44 41 403206-403208 35->41 42 40320a 35->42 52 4033d1-4033e1 ExitProcess OleUninitialize 36->52 53 403343-403349 36->53 37->36 55 4032ed-40331d GetTempPathA lstrcatA SetEnvironmentVariableA * 2 call 4030a8 37->55 41->34 41->42 42->34 48 40324b-40324d 43->48 49 40324f 43->49 44->31 51 4032a0-4032ac call 405cf9 44->51 47->22 48->44 48->49 49->44 51->27 58 403505-40350b 52->58 59 4033e7-4033f7 call 4054ef ExitProcess 52->59 56 4033c1-4033c8 call 403679 53->56 57 40334b-403356 call 405796 53->57 55->36 55->52 67 4033cd 56->67 74 403358-403381 57->74 75 40338c-403396 57->75 64 403587-40358f 58->64 65 40350d-403526 GetCurrentProcess OpenProcessToken 58->65 69 403591 64->69 70 403595-403599 ExitProcess 64->70 72 403558-403566 call 406092 65->72 73 403528-403552 LookupPrivilegeValueA AdjustTokenPrivileges 65->73 67->52 69->70 81 403574-40357e ExitWindowsEx 72->81 82 403568-403572 72->82 73->72 77 403383-403385 74->77 78 403398-4033a5 call 405859 75->78 79 4033fd-403411 call 405472 lstrcatA 75->79 77->75 83 403387-40338a 77->83 78->52 93 4033a7-4033bd call 405cf9 * 2 78->93 91 403413-403419 lstrcatA 79->91 92 40341e-403438 lstrcatA lstrcmpiA 79->92 81->64 86 403580-403582 call 40140b 81->86 82->81 82->86 83->75 83->77 86->64 91->92 92->52 94 40343a-40343d 92->94 93->56 96 403446 call 405455 94->96 97 40343f-403444 call 4053d8 94->97 104 40344b-403458 SetCurrentDirectoryA 96->104 97->104 105 403465-40348d call 405cf9 104->105 106 40345a-403460 call 405cf9 104->106 110 403493-4034af call 405d1b DeleteFileA 105->110 106->105 113 4034f0-4034f7 110->113 114 4034b1-4034c1 CopyFileA 110->114 113->110 115 4034f9-403500 call 405bb4 113->115 114->113 116 4034c3-4034e3 call 405bb4 call 405d1b call 40548a 114->116 115->52 116->113 125 4034e5-4034ec CloseHandle 116->125 125->113
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetErrorMode.KERNELBASE ref: 004030FE
                                                                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 00403104
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040312D
                                                                                                                                                                                                                                        • #17.COMCTL32(00000007,00000009), ref: 0040314F
                                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403156
                                                                                                                                                                                                                                        • SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000), ref: 00403172
                                                                                                                                                                                                                                        • GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403187
                                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Downloads\teamviewer.exe" ,00000000), ref: 0040319A
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000,"C:\Users\user\Downloads\teamviewer.exe" ,00000020), ref: 004031C5
                                                                                                                                                                                                                                        • GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032C2
                                                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D3
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032DF
                                                                                                                                                                                                                                        • GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F3
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FB
                                                                                                                                                                                                                                        • SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330C
                                                                                                                                                                                                                                        • SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403314
                                                                                                                                                                                                                                        • DeleteFileA.KERNELBASE(1033), ref: 00403328
                                                                                                                                                                                                                                          • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                                                                                                                                                                          • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32(?), ref: 004033D1
                                                                                                                                                                                                                                        • OleUninitialize.OLE32(?), ref: 004033D6
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004033F7
                                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403514
                                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 0040351B
                                                                                                                                                                                                                                        • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403533
                                                                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403552
                                                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 00403576
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403599
                                                                                                                                                                                                                                          • Part of subcall function 004054EF: MessageBoxIndirectA.USER32(00409218), ref: 0040554A
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
                                                                                                                                                                                                                                        • String ID: "$"C:\Users\user\Downloads\teamviewer.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer$C:\Users\user\Downloads$C:\Users\user\Downloads\teamviewer.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`K$v$~nsu
                                                                                                                                                                                                                                        • API String ID: 3329125770-3978548709
                                                                                                                                                                                                                                        • Opcode ID: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
                                                                                                                                                                                                                                        • Instruction ID: e7c85c4fe1f62676e3f8a08d8ca43f8bf3783ba147aef7bb7f1979754dcbcc24
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7C1E5706083417AE711AF71AD8DA2B7EA8EB85306F04457FF541B61D2C77C5A05CB2E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D1B Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 267 405d1b-405d26 268 405d28-405d37 267->268 269 405d39-405d4e 267->269 268->269 270 405f41-405f45 269->270 271 405d54-405d5f 269->271 273 405d71-405d7b 270->273 274 405f4b-405f55 270->274 271->270 272 405d65-405d6c 271->272 272->270 273->274 275 405d81-405d88 273->275 276 405f60-405f61 274->276 277 405f57-405f5b call 405cf9 274->277 278 405f34 275->278 279 405d8e-405dc3 275->279 277->276 281 405f36-405f3c 278->281 282 405f3e-405f40 278->282 283 405dc9-405dd4 GetVersion 279->283 284 405ede-405ee1 279->284 281->270 282->270 285 405dd6-405dda 283->285 286 405dee 283->286 287 405f11-405f14 284->287 288 405ee3-405ee6 284->288 285->286 292 405ddc-405de0 285->292 289 405df5-405dfc 286->289 290 405f22-405f32 lstrlenA 287->290 291 405f16-405f1d call 405d1b 287->291 293 405ef6-405f02 call 405cf9 288->293 294 405ee8-405ef4 call 405c57 288->294 295 405e01-405e03 289->295 296 405dfe-405e00 289->296 290->270 291->290 292->286 299 405de2-405de6 292->299 304 405f07-405f0d 293->304 294->304 302 405e05-405e28 call 405be0 295->302 303 405e3c-405e3f 295->303 296->295 299->286 305 405de8-405dec 299->305 315 405ec5-405ec9 302->315 316 405e2e-405e37 call 405d1b 302->316 308 405e41-405e4d GetSystemDirectoryA 303->308 309 405e4f-405e52 303->309 304->290 307 405f0f 304->307 305->289 311 405ed6-405edc call 405f64 307->311 312 405ec0-405ec3 308->312 313 405e54-405e62 GetWindowsDirectoryA 309->313 314 405ebc-405ebe 309->314 311->290 312->311 312->315 313->314 314->312 317 405e64-405e6e 314->317 315->311 320 405ecb-405ed1 lstrcatA 315->320 316->312 322 405e70-405e73 317->322 323 405e88-405e9e SHGetSpecialFolderLocation 317->323 320->311 322->323 327 405e75-405e7c 322->327 324 405ea0-405eb7 SHGetPathFromIDListA CoTaskMemFree 323->324 325 405eb9 323->325 324->312 324->325 325->314 328 405e84-405e86 327->328 328->312 328->323
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetVersion.KERNEL32(?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405DCC
                                                                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E47
                                                                                                                                                                                                                                        • GetWindowsDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E5A
                                                                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,0040E8C0), ref: 00405E96
                                                                                                                                                                                                                                        • SHGetPathFromIDListA.SHELL32(0040E8C0,004226A0), ref: 00405EA4
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(0040E8C0), ref: 00405EAF
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(004226A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED1
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(004226A0,?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405F23
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 00405ECB
                                                                                                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E16
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                                                                        • String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                                        • API String ID: 900638850-730719616
                                                                                                                                                                                                                                        • Opcode ID: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
                                                                                                                                                                                                                                        • Instruction ID: 70d043a0125fa0970afc212ad974551980140434863585fcf13b89b4fbf53fe2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD61F471A04A01ABDF205F64DC88B7F3BA8DB41305F50803BE941B62D0D27D4A82DF5E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040559B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 329 40559b-4055c1 call 405859 332 4055c3-4055d5 DeleteFileA 329->332 333 4055da-4055e1 329->333 334 405764-405768 332->334 335 4055e3-4055e5 333->335 336 4055f4-405604 call 405cf9 333->336 337 405712-405717 335->337 338 4055eb-4055ee 335->338 344 405613-405614 call 4057b2 336->344 345 405606-405611 lstrcatA 336->345 337->334 340 405719-40571c 337->340 338->336 338->337 342 405726-40572e call 405ffd 340->342 343 40571e-405724 340->343 342->334 353 405730-405744 call 40576b call 405553 342->353 343->334 347 405619-40561c 344->347 345->347 349 405627-40562d lstrcatA 347->349 350 40561e-405625 347->350 352 405632-405650 lstrlenA FindFirstFileA 349->352 350->349 350->352 354 405656-40566d call 405796 352->354 355 405708-40570c 352->355 368 405746-405749 353->368 369 40575c-40575f call 404f12 353->369 362 405678-40567b 354->362 363 40566f-405673 354->363 355->337 357 40570e 355->357 357->337 366 40567d-405682 362->366 367 40568e-40569c call 405cf9 362->367 363->362 365 405675 363->365 365->362 371 405684-405686 366->371 372 4056e7-4056f9 FindNextFileA 366->372 380 4056b3-4056be call 405553 367->380 381 40569e-4056a6 367->381 368->343 374 40574b-40575a call 404f12 call 405bb4 368->374 369->334 371->367 377 405688-40568c 371->377 372->354 375 4056ff-405702 FindClose 372->375 374->334 375->355 377->367 377->372 389 4056c0-4056c3 380->389 390 4056df-4056e2 call 404f12 380->390 381->372 382 4056a8-4056b1 call 40559b 381->382 382->372 391 4056c5-4056d5 call 404f12 call 405bb4 389->391 392 4056d7-4056dd 389->392 390->372 391->372 392->372
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DeleteFileA.KERNELBASE(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C4
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040560C
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040562D
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405633
                                                                                                                                                                                                                                        • FindFirstFileA.KERNELBASE(00420D10,?,?,?,00409014,?,00420D10,?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405644
                                                                                                                                                                                                                                        • FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F1
                                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405702
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • \*.*, xrefs: 00405606
                                                                                                                                                                                                                                        • "C:\Users\user\Downloads\teamviewer.exe" , xrefs: 0040559B
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004055A8
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                                                                                                                                                                        • API String ID: 2035342205-3672199748
                                                                                                                                                                                                                                        • Opcode ID: 7603539ad9b5937c9e56f8599475f37639822dfa53d4c139a839f7a9c6ea227f
                                                                                                                                                                                                                                        • Instruction ID: 44541a5d5af4c0b2911f4644f2fa5328a4f1ed3919081d24b86541679c9c03d6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7603539ad9b5937c9e56f8599475f37639822dfa53d4c139a839f7a9c6ea227f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F51CF30804A04BADF217A658C85BBF7AB8DF82318F54847BF445761D2C73D4982EE6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 603 406344-406349 604 4063ba-4063d8 603->604 605 40634b-40637a 603->605 606 4069b0-4069c5 604->606 607 406381-406385 605->607 608 40637c-40637f 605->608 609 4069c7-4069dd 606->609 610 4069df-4069f5 606->610 612 406387-40638b 607->612 613 40638d 607->613 611 406391-406394 608->611 616 4069f8-4069ff 609->616 610->616 614 4063b2-4063b5 611->614 615 406396-40639f 611->615 612->611 613->611 619 406587-4065a5 614->619 617 4063a1 615->617 618 4063a4-4063b0 615->618 620 406a01-406a05 616->620 621 406a26-406a32 616->621 617->618 622 40641a-406448 618->622 626 4065a7-4065bb 619->626 627 4065bd-4065cf 619->627 623 406bb4-406bbe 620->623 624 406a0b-406a23 620->624 630 4061c8-4061d1 621->630 631 406464-40647e 622->631 632 40644a-406462 622->632 629 406bca-406bdd 623->629 624->621 628 4065d2-4065dc 626->628 627->628 633 4065de 628->633 634 40657f-406585 628->634 638 406be2-406be6 629->638 635 4061d7 630->635 636 406bdf 630->636 637 406481-40648b 631->637 632->637 654 406564-40657c 633->654 655 406b66-406b70 633->655 634->619 644 406523-40652d 634->644 640 406283-406287 635->640 641 4062f3-4062f7 635->641 642 4061de-4061e2 635->642 643 40631e-40633f 635->643 636->638 645 406491 637->645 646 406402-406408 637->646 656 406b33-406b3d 640->656 657 40628d-4062a6 640->657 648 406b42-406b4c 641->648 649 4062fd-406311 641->649 642->629 647 4061e8-4061f5 642->647 643->606 650 406b72-406b7c 644->650 651 406533-4066fc 644->651 663 4063e7-4063ff 645->663 664 406b4e-406b58 645->664 652 4064bb-4064c1 646->652 653 40640e-406414 646->653 647->636 662 4061fb-406241 647->662 648->629 665 406314-40631c 649->665 650->629 651->630 660 4064c3-4064e1 652->660 661 40651f 652->661 653->622 653->661 654->634 655->629 656->629 659 4062a9-4062ad 657->659 659->640 667 4062af-4062b5 659->667 668 4064e3-4064f7 660->668 669 4064f9-40650b 660->669 661->644 670 406243-406247 662->670 671 406269-40626b 662->671 663->646 664->629 665->641 665->643 672 4062b7-4062be 667->672 673 4062df-4062f1 667->673 674 40650e-406518 668->674 669->674 675 406252-406260 GlobalAlloc 670->675 676 406249-40624c GlobalFree 670->676 677 406279-406281 671->677 678 40626d-406277 671->678 679 4062c0-4062c3 GlobalFree 672->679 680 4062c9-4062d9 GlobalAlloc 672->680 673->665 674->652 681 40651a 674->681 675->636 682 406266 675->682 676->675 677->659 678->677 678->678 679->680 680->636 680->673 684 4064a0-4064b8 681->684 685 406b5a-406b64 681->685 682->671 684->652 685->629
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                                                                                                                                                                                                        • Instruction ID: a8746b25a1c6b49bbeafbf020c2dfcaa04563a9eac1a8e827fb2969916571183
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70F17670D00229CBCF18CFA8C8946ADBBB1FF44305F25816ED856BB281D7786A96CF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405FFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindFirstFileA.KERNELBASE(76233410,00421558,C:\,0040589C,C:\,C:\,00000000,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\), ref: 00406008
                                                                                                                                                                                                                                        • FindClose.KERNELBASE(00000000), ref: 00406014
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                                                        • API String ID: 2295610775-3404278061
                                                                                                                                                                                                                                        • Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                                                                                                                                                                        • Instruction ID: 1297c1e42099762feae64532f60583430090df1d404adb2e37743a0561846f6f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8CD012319491206BC3105B38AD0C85B7A599F593317118A33F567F52F0C7788C7296E9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403679 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 126 403679-403691 call 406092 129 403693-4036a3 call 405c57 126->129 130 4036a5-4036d6 call 405be0 126->130 139 4036f9-403722 call 40393e call 405859 129->139 135 4036d8-4036e9 call 405be0 130->135 136 4036ee-4036f4 lstrcatA 130->136 135->136 136->139 144 403728-40372d 139->144 145 4037a9-4037b1 call 405859 139->145 144->145 146 40372f-403753 call 405be0 144->146 151 4037b3-4037ba call 405d1b 145->151 152 4037bf-4037e4 LoadImageA 145->152 146->145 153 403755-403757 146->153 151->152 155 403865-40386d call 40140b 152->155 156 4037e6-403816 RegisterClassA 152->156 157 403768-403774 lstrlenA 153->157 158 403759-403766 call 405796 153->158 170 403877-403882 call 40393e 155->170 171 40386f-403872 155->171 159 403934 156->159 160 40381c-403860 SystemParametersInfoA CreateWindowExA 156->160 164 403776-403784 lstrcmpiA 157->164 165 40379c-4037a4 call 40576b call 405cf9 157->165 158->157 163 403936-40393d 159->163 160->155 164->165 169 403786-403790 GetFileAttributesA 164->169 165->145 174 403792-403794 169->174 175 403796-403797 call 4057b2 169->175 179 403888-4038a2 ShowWindow call 406024 170->179 180 40390b-403913 call 404fe4 170->180 171->163 174->165 174->175 175->165 187 4038a4-4038a9 call 406024 179->187 188 4038ae-4038c0 GetClassInfoA 179->188 185 403915-40391b 180->185 186 40392d-40392f call 40140b 180->186 185->171 189 403921-403928 call 40140b 185->189 186->159 187->188 192 4038c2-4038d2 GetClassInfoA RegisterClassA 188->192 193 4038d8-403909 DialogBoxParamA call 40140b call 4035c9 188->193 189->171 192->193 193->163
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                                                                                                                                                                          • Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,76233410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Downloads\teamviewer.exe" ,00000000), ref: 004036F4
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(004226A0,?,?,?,004226A0,00000000,00429400,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,76233410), ref: 00403769
                                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(?,.exe), ref: 0040377C
                                                                                                                                                                                                                                        • GetFileAttributesA.KERNEL32(004226A0), ref: 00403787
                                                                                                                                                                                                                                        • LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037D0
                                                                                                                                                                                                                                          • Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64
                                                                                                                                                                                                                                        • RegisterClassA.USER32(00422EA0), ref: 0040380D
                                                                                                                                                                                                                                        • SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403825
                                                                                                                                                                                                                                        • CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040385A
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 00403890
                                                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004038BC
                                                                                                                                                                                                                                        • GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004038C9
                                                                                                                                                                                                                                        • RegisterClassA.USER32(00422EA0), ref: 004038D2
                                                                                                                                                                                                                                        • DialogBoxParamA.USER32(?,00000000,00403A0B,00000000), ref: 004038F1
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                                                                                                                                                                                                        • API String ID: 1975747703-2261313971
                                                                                                                                                                                                                                        • Opcode ID: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
                                                                                                                                                                                                                                        • Instruction ID: cdcda0c5d6d895e27caec97b3fe99e3f57ebd92391a3aca4eab7d54baf018be6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA61C8B16442007ED620BF669D45F373AACEB44759F40447FF941B22E2C77CAD029A2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 200 402c66-402cb4 GetTickCount GetModuleFileNameA call 40596c 203 402cc0-402cee call 405cf9 call 4057b2 call 405cf9 GetFileSize 200->203 204 402cb6-402cbb 200->204 212 402cf4 203->212 213 402ddb-402de9 call 402c02 203->213 205 402e98-402e9c 204->205 215 402cf9-402d10 212->215 219 402deb-402dee 213->219 220 402e3e-402e43 213->220 217 402d12 215->217 218 402d14-402d1d call 40307b 215->218 217->218 227 402d23-402d2a 218->227 228 402e45-402e4d call 402c02 218->228 222 402df0-402e08 call 403091 call 40307b 219->222 223 402e12-402e3c GlobalAlloc call 403091 call 402e9f 219->223 220->205 222->220 251 402e0a-402e10 222->251 223->220 249 402e4f-402e60 223->249 229 402da6-402daa 227->229 230 402d2c-402d40 call 405927 227->230 228->220 237 402db4-402dba 229->237 238 402dac-402db3 call 402c02 229->238 230->237 247 402d42-402d49 230->247 240 402dc9-402dd3 237->240 241 402dbc-402dc6 call 406107 237->241 238->237 240->215 248 402dd9 240->248 241->240 247->237 253 402d4b-402d52 247->253 248->213 254 402e62 249->254 255 402e68-402e6d 249->255 251->220 251->223 253->237 256 402d54-402d5b 253->256 254->255 257 402e6e-402e74 255->257 256->237 258 402d5d-402d64 256->258 257->257 259 402e76-402e91 SetFilePointer call 405927 257->259 258->237 260 402d66-402d86 258->260 263 402e96 259->263 260->220 262 402d8c-402d90 260->262 264 402d92-402d96 262->264 265 402d98-402da0 262->265 263->205 264->248 264->265 265->237 266 402da2-402da4 265->266 266->237
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C77
                                                                                                                                                                                                                                        • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Downloads\teamviewer.exe,00000400), ref: 00402C93
                                                                                                                                                                                                                                          • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 00405970
                                                                                                                                                                                                                                          • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Downloads,C:\Users\user\Downloads,C:\Users\user\Downloads\teamviewer.exe,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 00402CDF
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 00402CB6
                                                                                                                                                                                                                                        • C:\Users\user\Downloads\teamviewer.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0
                                                                                                                                                                                                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
                                                                                                                                                                                                                                        • "C:\Users\user\Downloads\teamviewer.exe" , xrefs: 00402C66
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
                                                                                                                                                                                                                                        • Null, xrefs: 00402D5D
                                                                                                                                                                                                                                        • C:\Users\user\Downloads, xrefs: 00402CC1, 00402CC6, 00402CCC
                                                                                                                                                                                                                                        • Inst, xrefs: 00402D4B
                                                                                                                                                                                                                                        • soft, xrefs: 00402D54
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\Downloads$C:\Users\user\Downloads\teamviewer.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
                                                                                                                                                                                                                                        • API String ID: 4283519449-1024060293
                                                                                                                                                                                                                                        • Opcode ID: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                                                                                                                                                                                                        • Instruction ID: 1839f4375b44da3097aca9d4a8c6c84b0463c2d100b7a2d698c12080187f488f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF51B6B1A41214ABDF109F65DE89B9E7AB4EF00355F14403BF904B62D1C7BC9E418B9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401751 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147stringtimeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 398 401751-401774 call 402a3a call 4057d8 403 401776-40177c call 405cf9 398->403 404 40177e-401790 call 405cf9 call 40576b lstrcatA 398->404 409 401795-40179b call 405f64 403->409 404->409 414 4017a0-4017a4 409->414 415 4017a6-4017b0 call 405ffd 414->415 416 4017d7-4017da 414->416 423 4017c2-4017d4 415->423 424 4017b2-4017c0 CompareFileTime 415->424 417 4017e2-4017fe call 40596c 416->417 418 4017dc-4017dd call 405947 416->418 426 401800-401803 417->426 427 401876-40189f call 404f12 call 402e9f 417->427 418->417 423->416 424->423 428 401805-401847 call 405cf9 * 2 call 405d1b call 405cf9 call 4054ef 426->428 429 401858-401862 call 404f12 426->429 439 4018a1-4018a5 427->439 440 4018a7-4018b3 SetFileTime 427->440 428->414 461 40184d-40184e 428->461 441 40186b-401871 429->441 439->440 443 4018b9-4018c4 FindCloseChangeNotification 439->443 440->443 444 4028d8 441->444 446 4018ca-4018cd 443->446 447 4028cf-4028d2 443->447 448 4028da-4028de 444->448 451 4018e2-4018e5 call 405d1b 446->451 452 4018cf-4018e0 call 405d1b lstrcatA 446->452 447->444 458 4018ea-402273 call 4054ef 451->458 452->458 458->447 458->448 461->441 463 401850-401851 461->463 463->429
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\TeamViewer,00000000,00000000,00000031), ref: 00401790
                                                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\TeamViewer,00000000,00000000,00000031), ref: 004017BA
                                                                                                                                                                                                                                          • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\TeamViewer$C:\Users\user\AppData\Local\Temp\nse7C54.tmp$C:\Users\user\AppData\Local\Temp\nse7C54.tmp\System.dll$Call
                                                                                                                                                                                                                                        • API String ID: 1941528284-3285565645
                                                                                                                                                                                                                                        • Opcode ID: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
                                                                                                                                                                                                                                        • Instruction ID: dfa66b7161a0f16b13ad00a25904a83b243dedeb6ee7557d1be3b523159fd244
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5641D572910515BACF107BB5CC85EAF3679EF45329B20823BF521F20E2D63C4A419B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004053D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 465 4053d8-405423 CreateDirectoryA 466 405425-405427 465->466 467 405429-405436 GetLastError 465->467 468 405450-405452 466->468 467->468 469 405438-40544c SetFileSecurityA 467->469 469->466 470 40544e GetLastError 469->470 470->468
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0040542F
                                                                                                                                                                                                                                        • SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405444
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0040544E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Downloads$ds@$ts@
                                                                                                                                                                                                                                        • API String ID: 3449924974-295845544
                                                                                                                                                                                                                                        • Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                                                                                                                                                                                                        • Instruction ID: 5d613d5f07efa900d759e60f8f8ec78c4c71b6ffd2fe208e339ff175f81ef67f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3010871D14259EADF119FA0D9487EFBFB8EB04315F00417AE904B6280D378A644CFAA
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406024 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 471 406024-406044 GetSystemDirectoryA 472 406046 471->472 473 406048-40604a 471->473 472->473 474 40605a-40605c 473->474 475 40604c-406054 473->475 477 40605d-40608f wsprintfA LoadLibraryExA 474->477 475->474 476 406056-406058 475->476 476->477
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00406074
                                                                                                                                                                                                                                        • LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                                        • String ID: %s%s.dll$UXTHEME$\
                                                                                                                                                                                                                                        • API String ID: 2200240437-4240819195
                                                                                                                                                                                                                                        • Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                                                                                                                                                                                                        • Instruction ID: 72752c577983536edbae7b7a4b2c1439e1101fa4b93fa8d0208d5a4e16dde88a
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E6F0FC30A40109AADB14E764DC0DFEB365CAB09305F140576A546E11D1D578E9258B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 478 402e9f-402eb3 479 402eb5 478->479 480 402ebc-402ec4 478->480 479->480 481 402ec6 480->481 482 402ecb-402ed0 480->482 481->482 483 402ee0-402eed call 40307b 482->483 484 402ed2-402edb call 403091 482->484 488 403032 483->488 489 402ef3-402ef7 483->489 484->483 492 403034-403035 488->492 490 40301b-40301d 489->490 491 402efd-402f1d GetTickCount call 406175 489->491 493 403066-40306a 490->493 494 40301f-403022 490->494 502 403071 491->502 504 402f23-402f2b 491->504 496 403074-403078 492->496 497 403037-40303d 493->497 498 40306c 493->498 499 403024 494->499 500 403027-403030 call 40307b 494->500 505 403042-403050 call 40307b 497->505 506 40303f 497->506 498->502 499->500 500->488 511 40306e 500->511 502->496 508 402f30-402f3e call 40307b 504->508 509 402f2d 504->509 505->488 514 403052-403057 call 405a13 505->514 506->505 508->488 517 402f44-402f4d 508->517 509->508 511->502 518 40305c-40305e 514->518 519 402f53-402f70 call 406195 517->519 520 403060-403063 518->520 521 403017-403019 518->521 524 403013-403015 519->524 525 402f76-402f8d GetTickCount 519->525 520->493 521->492 524->492 526 402fd2-402fd4 525->526 527 402f8f-402f97 525->527 530 402fd6-402fda 526->530 531 403007-40300b 526->531 528 402f99-402f9d 527->528 529 402f9f-402fcf MulDiv wsprintfA call 404f12 527->529 528->526 528->529 529->526 534 402fdc-402fe1 call 405a13 530->534 535 402fef-402ff5 530->535 531->504 532 403011 531->532 532->502 539 402fe6-402fe8 534->539 538 402ffb-402fff 535->538 538->519 540 403005 538->540 539->521 541 402fea-402fed 539->541 540->502 541->538
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CountTick$wsprintf
                                                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                                                        • API String ID: 551687249-2449383134
                                                                                                                                                                                                                                        • Opcode ID: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
                                                                                                                                                                                                                                        • Instruction ID: 4ab2a5a1bcd3fb7fa9d72e81aa521510b391fe67da8672e6f00875cd24a8b3cf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D518F729022199BDF10DF65DA08A9F7BB8AF40795F14413BF800B72C4C7789E51DBAA
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040599B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 542 40599b-4059a5 543 4059a6-4059d1 GetTickCount GetTempFileNameA 542->543 544 4059e0-4059e2 543->544 545 4059d3-4059d5 543->545 546 4059da-4059dd 544->546 545->543 547 4059d7 545->547 547->546
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 004059AF
                                                                                                                                                                                                                                        • GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059C9
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • "C:\Users\user\Downloads\teamviewer.exe" , xrefs: 0040599B
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
                                                                                                                                                                                                                                        • nsa, xrefs: 004059A6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                                        • API String ID: 1716503409-611676037
                                                                                                                                                                                                                                        • Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                                                                                                                                                                                                        • Instruction ID: 3a3981258a6ccd3f3c7180c2fb01dffc681fdc90015df490a153c8b64b3610b8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6DF08276708214ABEB108F55EC04B9B7B9CDF91760F10C03BFA48DA190D6B599548B99
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405859 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 548 405859-405874 call 405cf9 call 405804 553 405876-405878 548->553 554 40587a-405887 call 405f64 548->554 555 4058cc-4058ce 553->555 558 405893-405895 554->558 559 405889-40588d 554->559 561 4058ab-4058b4 lstrlenA 558->561 559->553 560 40588f-405891 559->560 560->553 560->558 562 4058b6-4058ca call 40576b GetFileAttributesA 561->562 563 405897-40589e call 405ffd 561->563 562->555 568 4058a0-4058a3 563->568 569 4058a5-4058a6 call 4057b2 563->569 568->553 568->569 569->561
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058AC
                                                                                                                                                                                                                                        • GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\), ref: 004058BC
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                                        • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 3248276644-615423462
                                                                                                                                                                                                                                        • Opcode ID: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                                                                                                                                                                                                        • Instruction ID: 1d2993da53655c0900dfa7f8eb6ffa86a16769ab8224128061af08a25d69d353
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 16F0F427105E5165DA22323B1C05B9F1A44CD86354718C53BFC51F22D2DA3CC8629DBE
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 571 401f90-401f9c 572 401fa2-401fb8 call 402a3a * 2 571->572 573 402057-402059 571->573 582 401fc7-401fd5 LoadLibraryExA 572->582 583 401fba-401fc5 GetModuleHandleA 572->583 574 4021c4-4021c9 call 401423 573->574 581 4028cf-4028de 574->581 585 401fd7-401fe4 GetProcAddress 582->585 586 402050-402052 582->586 583->582 583->585 588 402023-402028 call 404f12 585->588 589 401fe6-401fec 585->589 586->574 593 40202d-402030 588->593 591 402005-402019 589->591 592 401fee-401ffa call 401423 589->592 597 40201e-402021 591->597 592->593 602 401ffc-402003 592->602 593->581 595 402036-40203e call 403619 593->595 595->581 601 402044-40204b FreeLibrary 595->601 597->593 601->581 602->593
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                                                                                                                                                                        • LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2987980305-0
                                                                                                                                                                                                                                        • Opcode ID: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
                                                                                                                                                                                                                                        • Instruction ID: 033e4e5f5e4c037d50d2464c5542d6b5672e4837e9f8cb01fb8d89ff16108e1c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A212B72904211FBDF217FA48E49AAE76B1AB45318F30423BF701B62D0C7BD49459A6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 686 4015b3-4015c6 call 402a3a call 405804 691 4015c8-4015db call 405796 686->691 692 40161c-40161f 686->692 700 4015f3-4015f4 call 405455 691->700 701 4015dd-4015e0 691->701 694 401621-40163c call 401423 call 405cf9 SetCurrentDirectoryA 692->694 695 40164a-4021c9 call 401423 692->695 708 4028cf-4028de 694->708 711 401642-401645 694->711 695->708 707 4015f9-4015fb 700->707 701->700 705 4015e2-4015e9 call 405472 701->705 705->700 716 4015eb-4015ec call 4053d8 705->716 712 401612-40161a 707->712 713 4015fd-401602 707->713 711->708 712->691 712->692 717 401604-40160d GetFileAttributesA 713->717 718 40160f 713->718 721 4015f1 716->721 717->712 717->718 718->712 721->707
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
                                                                                                                                                                                                                                          • Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B
                                                                                                                                                                                                                                        • GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605
                                                                                                                                                                                                                                          • Part of subcall function 004053D8: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
                                                                                                                                                                                                                                        • SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\TeamViewer,00000000,00000000,000000F0), ref: 00401634
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer, xrefs: 00401629
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\TeamViewer
                                                                                                                                                                                                                                        • API String ID: 1892508949-2358812827
                                                                                                                                                                                                                                        • Opcode ID: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                                                                                                                                                                                                        • Instruction ID: 4fb2b9239308f527e4829455642bf5c86be9504270dcf99fcce102751257b2ff
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1611E736508141ABEF217F650D415BF27B0EA92325738467FE592B62E2C63C4942A63F
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040548A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 722 40548a-4054bb CreateProcessA 723 4054c9-4054ca 722->723 724 4054bd-4054c6 CloseHandle 722->724 724->723
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 004054C0
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 0040549D
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                                        • String ID: Error launching installer
                                                                                                                                                                                                                                        • API String ID: 3712363035-66219284
                                                                                                                                                                                                                                        • Opcode ID: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                                                                                                                                                                                                        • Instruction ID: 90ee3f3d0c484d323fd0424032eb65db2415cafeee3384e03f1d9bc4b04e7a5d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FFE04FB4A002097FEB009B60EC05F7B7BBCEB00348F408561BD11F21A0E374A9508A78
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004035E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,76233410,00000000,C:\Users\user\AppData\Local\Temp\,004035BC,004033D6,?), ref: 004035FE
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00403605
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004035E4
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 1100898210-3936084776
                                                                                                                                                                                                                                        • Opcode ID: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                                                                                                                                                                                                        • Instruction ID: f6c6d059f9b75f5cc6a79e0049e3afa1176d7e4558308c53008dbe788c85df41
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3EE0C2338100206BC7211F0AED04B5E77AC6F48B22F054066FC407B3A08B742C418BCC
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                                                                                                                                                                                                        • Instruction ID: ac331763182a67db8ffe8b732b67c8974d54266b30473341b06133cd37c0d4bc
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ECA13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                                                                                                                                                                                                        • Instruction ID: e89747aace1fce0fcb13a8d80e6f88749465aa03c559881c8099c8d07fdfb4d2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                                                                                                                                                                                                        • Instruction ID: d456333056e0522eb9a81365918d8492ce98a85054e5b278218ea4b7938feab7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1814671D04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C778AA96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                                                                                                                                                                                                        • Instruction ID: 4327eab70650ef0c96a691b493921a8ab8e5ba0d824f916f670fcb6a13d6a8f8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11816671D04228DBDF24CFA8C8447ADBBB1FB44315F2181AED856BB281C7786A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                                                                                                                                                                                                        • Instruction ID: 63ee65aff5d1ea53a99bb7455827a561e54e570c364fe5978cc4b9ff32097947
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9711271D04228CBDF24CFA8C8547ADBBF1FB48305F15806AD856BB281D7786A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                                                                                                                                                                                                        • Instruction ID: 2ec41c1936be718984cf19d05ce660ecedc56656b80368bbb2ce29215557a5c8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53712571E04228CBDF28CF98C854BADBBB1FB44305F15816ED856BB281C7785996DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                                                                                                                                                                                                        • Instruction ID: 94740bf10ed9628fc2a816943eb7322e71ed29eec5e37d1a6fe0f7c23d4f3e83
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D714571E04228CBDF28CF98C854BADBBB1FB44305F11806ED856BB281C7786A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                                                                                                                                                          • Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                                                                                                                                                                          • Part of subcall function 0040548A: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
                                                                                                                                                                                                                                          • Part of subcall function 0040548A: CloseHandle.KERNEL32(?), ref: 004054C0
                                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
                                                                                                                                                                                                                                        • GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E8E
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3521207402-0
                                                                                                                                                                                                                                        • Opcode ID: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
                                                                                                                                                                                                                                        • Instruction ID: 49f7d359c4d218189077cc8fb8a526ed56d4096950e75cb47e310611910bd6fc
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C4016D31904104EBDF11AFA1C984A9E77B2EF00354F10817BFA01B52E1C7785A85AB9A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405553 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405947: GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
                                                                                                                                                                                                                                          • Part of subcall function 00405947: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960
                                                                                                                                                                                                                                        • RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405742), ref: 0040556E
                                                                                                                                                                                                                                        • DeleteFileA.KERNELBASE(?,?,?,00000000,00405742), ref: 00405576
                                                                                                                                                                                                                                        • SetFileAttributesA.KERNEL32(?,00000000), ref: 0040558E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1655745494-0
                                                                                                                                                                                                                                        • Opcode ID: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
                                                                                                                                                                                                                                        • Instruction ID: 364b991763a9b947ff98ca2783b3bb2cd1a0068a6ee853e10d07d538a8c3989e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6CE0E531519A91B6C61057309C08F5F2AD6EFCA338F040A36F891B21C4C33C88068E7E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                                        • Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                                                                                                                                                                                                        • Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 004060BF
                                                                                                                                                                                                                                          • Part of subcall function 00406024: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
                                                                                                                                                                                                                                          • Part of subcall function 00406024: wsprintfA.USER32 ref: 00406074
                                                                                                                                                                                                                                          • Part of subcall function 00406024: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2547128583-0
                                                                                                                                                                                                                                        • Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                                                                                                                                                                                                        • Instruction ID: f390ed2799c289b087c769a87f24dfac638062b8da6604b2acd18c4b1555f769
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4E08632644111A6D320A7709D0493B72EC9E84710302483EF906F2191D738AC259669
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040596C Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 00405970
                                                                                                                                                                                                                                        • CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                                                        • Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                                                                                                                                                                                                        • Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405947 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
                                                                                                                                                                                                                                        • SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                                                        • Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                                                                                                                                                                                                        • Instruction ID: 96e5362f07f59601f7516fe8bcac2aa0a8151a45168581d09323fa3b8cc485cf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7D01272908121AFC2102738ED0C89BBF65EB543717058B35FDB9F22F0D7304C568AA6
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040359F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,004033D6,?), ref: 004035AA
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nse7C54.tmp\, xrefs: 004035BE
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nse7C54.tmp\
                                                                                                                                                                                                                                        • API String ID: 2962429428-3283267547
                                                                                                                                                                                                                                        • Opcode ID: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
                                                                                                                                                                                                                                        • Instruction ID: f4b59f51dd056b556ace1dccfc0996fbca79989fe12c672f2328a55b3cb2227a
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FBC08030504640B7D1247F79AD4B5193A145B40335FA04376F8B4F00F1C73C5B45555D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405455 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040545B
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405469
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                                                                        • Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                                                                                                                                                                                                        • Instruction ID: ace853db513f64caea17b5c73fb52fb3118c2a3fabff3065b7385b8b337d2f64
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9DC08C30B18101EAC6100B30AE087073D50AB00742F1444356206E10E0C6309050CD2F
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: PrivateProfileStringWrite
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 390214022-0
                                                                                                                                                                                                                                        • Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                                                                                                                                                                                                        • Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405A13 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405A27
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                                                                        • Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                                                                                                                                                                                                        • Instruction ID: edb1125888c6416cb1e0b95ca9609c2ac4c4c792cbd4e8f88826aa2405e91300
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D7E0EC3261425EEFDF109E659C40AEB7B6DEB053A4F048532FD25E2150E271E8219FB5
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004059E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059F8
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                                                        • Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                                                                                                                                                                                                        • Instruction ID: 6c2e581bc83b2d89c4a498056592e8f52b2bea012b9e1656670f40d352b29975
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4DE0EC3272429AABDF109E559C44EEF7BACEB05360F048932FD15E3190D235ED219FA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                                        • Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                                                                                                                                                                        • Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                        Function 0040488F Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 004048A7
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 004048B2
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 004048FC
                                                                                                                                                                                                                                        • LoadBitmapA.USER32(0000006E), ref: 0040490F
                                                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000FC,00404E86), ref: 00404928
                                                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040493C
                                                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 0040494E
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001109,00000002), ref: 00404964
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404970
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404982
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00404985
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049B0
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049BC
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A51
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A7C
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A90
                                                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000F0), ref: 00404ABF
                                                                                                                                                                                                                                        • SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404ACD
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404ADE
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BDB
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C40
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C55
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C79
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C99
                                                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00404CAE
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00404CBE
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D37
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001102,?,?), ref: 00404DE0
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DEF
                                                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00404E0F
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00404E5D
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00404E68
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00404E6F
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                                                                        • Opcode ID: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
                                                                                                                                                                                                                                        • Instruction ID: e7c54df8ad39b376662a796d960b289492e5a6982c1727c2c37b81bede79f7f2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43025EB0A00209AFEF109F54DC85AAE7BB5FB84315F10817AF611B62E1D7789E42DF58
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405050 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 004050AF
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 004050BE
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 004050FB
                                                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000002), ref: 00405102
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405123
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405134
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001001,00000000,?), ref: 00405147
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001026,00000000,?), ref: 00405155
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001024,00000000,?), ref: 00405168
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040518A
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040519E
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004051BF
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051CF
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051E8
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004051F4
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 004050CD
                                                                                                                                                                                                                                          • Part of subcall function 00403F13: SendMessageA.USER32(00000028,?,00000001,00403D44), ref: 00403F21
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 00405210
                                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00004FE4,00000000), ref: 0040521E
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00405225
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00405248
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040524F
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405295
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052C9
                                                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004052DA
                                                                                                                                                                                                                                        • AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052EF
                                                                                                                                                                                                                                        • GetWindowRect.USER32(?,000000FF), ref: 0040530F
                                                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405328
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405364
                                                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405374
                                                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 0040537A
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,?), ref: 00405383
                                                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0040538D
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053A1
                                                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 004053BA
                                                                                                                                                                                                                                        • SetClipboardData.USER32(00000001,00000000), ref: 004053C5
                                                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 004053CB
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 590372296-0
                                                                                                                                                                                                                                        • Opcode ID: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
                                                                                                                                                                                                                                        • Instruction ID: d5cc627e10ac9a037e5b70d1472d8d3a221fef050c439e23246209dc4a3cc6f1
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53A159B1900208BFDB219FA0DD85AAE7F79FB48355F10407AFA01B61A0C7B55E41DF69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040431C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 0040436B
                                                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,?), ref: 00404395
                                                                                                                                                                                                                                        • SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404446
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00404451
                                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(004226A0,0041FD08), ref: 00404483
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,004226A0), ref: 0040448F
                                                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044A1
                                                                                                                                                                                                                                          • Part of subcall function 004054D3: GetDlgItemTextA.USER32(?,?,00000400,004044D8), ref: 004054E6
                                                                                                                                                                                                                                          • Part of subcall function 00405F64: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Downloads\teamviewer.exe" ,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                                                                                                                                                                                                          • Part of subcall function 00405F64: CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                                                                                                                                                                                                          • Part of subcall function 00405F64: CharNextA.USER32(?,"C:\Users\user\Downloads\teamviewer.exe" ,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                                                                                                                                                                                                          • Part of subcall function 00405F64: CharPrevA.USER32(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                                                                                                                                                                                                        • GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040455F
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457A
                                                                                                                                                                                                                                          • Part of subcall function 004046D3: lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
                                                                                                                                                                                                                                          • Part of subcall function 004046D3: wsprintfA.USER32 ref: 00404779
                                                                                                                                                                                                                                          • Part of subcall function 004046D3: SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: A
                                                                                                                                                                                                                                        • API String ID: 2624150263-3554254475
                                                                                                                                                                                                                                        • Opcode ID: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
                                                                                                                                                                                                                                        • Instruction ID: 222947b4accbc62cc0073c5541b0f9589876626f1104fcc3d8441c992cea6716
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71A17EB1900209ABDB11AFA5CC45BEFB6B8EF84315F14843BF711B62D1D77C8A418B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
                                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer, xrefs: 0040211D
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ByteCharCreateInstanceMultiWide
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\TeamViewer
                                                                                                                                                                                                                                        • API String ID: 123533781-2358812827
                                                                                                                                                                                                                                        • Opcode ID: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                                                                                                                                                                                                        • Instruction ID: 15b8319daa3a69dadbe16bc3493db081a7dc62ee607a685d27ecc12527328b4b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 785138B1A00208BFCF10DFA4C988A9D7BB5FF48319F20856AF515EB2D1DB799941CB54
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                                                                        • Opcode ID: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                                                                                                                                                                                                        • Instruction ID: a95b2630499809d01a6e7b037cab792d100f7a465f9f887e4e98b5ff960ae470
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79F0A7726082009BE701E7A49949AEE7778DB61314F60057BE241A21C1D7B84985AB3A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403A0B Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A47
                                                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 00403A64
                                                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 00403A78
                                                                                                                                                                                                                                        • SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A94
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403AB5
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AC9
                                                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403AD0
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403B7E
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403B88
                                                                                                                                                                                                                                        • SetClassLongA.USER32(?,000000F2,?), ref: 00403BA2
                                                                                                                                                                                                                                        • SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403BF3
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403C99
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00403CBA
                                                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403CCC
                                                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00403CE7
                                                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CFD
                                                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00403D04
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D1C
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D2F
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FD08,?,0041FD08,00422F00), ref: 00403D58
                                                                                                                                                                                                                                        • SetWindowTextA.USER32(?,0041FD08), ref: 00403D67
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 00403E9B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 184305955-0
                                                                                                                                                                                                                                        • Opcode ID: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
                                                                                                                                                                                                                                        • Instruction ID: e8e4c14712e0ebd1bd3c96694815290efe84e81baa174b168cbdfcdac135d6c4
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 29C1DF71A04205BBDB20AF61EE45E2B3E7CFB45706B40453EF601B11E1C779A942AB6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404027 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040B2
                                                                                                                                                                                                                                        • GetDlgItem.USER32(00000000,000003E8), ref: 004040C6
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040E4
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 004040F5
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404104
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404113
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(?), ref: 00404116
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404125
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040413A
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 0040419C
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000), ref: 0040419F
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 004041CA
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040420A
                                                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F02), ref: 00404219
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00404222
                                                                                                                                                                                                                                        • ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,00000001), ref: 00404235
                                                                                                                                                                                                                                        • LoadCursorA.USER32(00000000,00007F00), ref: 00404242
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00404245
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000111,00000001,00000000), ref: 00404271
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000010,00000000,00000000), ref: 00404285
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                                                                        • String ID: N$open
                                                                                                                                                                                                                                        • API String ID: 3615053054-904208323
                                                                                                                                                                                                                                        • Opcode ID: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                                                                                                                                                                                                        • Instruction ID: f5dd8c80699fee66c1c508087d6ededbe7bbcdfb93c9c5870bdb982cd402330a
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1261C5B1A40209BFEB109F61DC45F6A7B79FB84741F10807AFB057A2D1C7B8A951CB98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(?), ref: 00401105
                                                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                                        • DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                                                                        • Opcode ID: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                                                                                                                                                                                                        • Instruction ID: a0b7ce50fec83efafeb16569406a1c152c04985fcf8b97c7298fc3655e55bd79
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CD419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405A42 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
                                                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E
                                                                                                                                                                                                                                          • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                                                                                                                                                                                                          • Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                                                                                                                                                                                                        • GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405AB9
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
                                                                                                                                                                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00405BA2
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BA9
                                                                                                                                                                                                                                          • Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 00405970
                                                                                                                                                                                                                                          • Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                                                                                                                                                                                                        • String ID: %s=%s$NUL$[Rename]
                                                                                                                                                                                                                                        • API String ID: 222337774-4148678300
                                                                                                                                                                                                                                        • Opcode ID: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
                                                                                                                                                                                                                                        • Instruction ID: 42b7cc2c3f2f4ef7c3412fd2f3d3cbe4eee66c4c235e50fd6e5efd85f9217fc4
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9931E271A04B19ABD2206B619C89F6B3A6CDF45755F14003AFE05F62D2DA7CBC008E6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405F64 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Downloads\teamviewer.exe" ,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
                                                                                                                                                                                                                                        • CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
                                                                                                                                                                                                                                        • CharNextA.USER32(?,"C:\Users\user\Downloads\teamviewer.exe" ,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
                                                                                                                                                                                                                                        • CharPrevA.USER32(?,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • *?|<>/":, xrefs: 00405FAC
                                                                                                                                                                                                                                        • "C:\Users\user\Downloads\teamviewer.exe" , xrefs: 00405FA0
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F65
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 589700163-3267963112
                                                                                                                                                                                                                                        • Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                                                                                                                                                                                                        • Instruction ID: a0964663e3c08fb0288e5f4f4a0160773f2bbbf5a4d40b443b4f636863f092b1
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C611C451808F922EEB3216640C44BBB7F99CF5A760F18007BE9D4B22C2D67C5C429F6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403F45 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetWindowLongA.USER32(?,000000EB), ref: 00403F62
                                                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00403F7E
                                                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00403F8A
                                                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 00403F96
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 00403FA9
                                                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 00403FB9
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00403FD3
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00403FDD
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                                                        • Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                                                                                                                                                                                                        • Instruction ID: 563dd17f99c902cd34f005863f03740a6a5938172a6e5e033378c94734032825
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B4214271908705ABC7219F68DD48F4BBFF8AF01715B048A29E895E26E0D735EA04CB55
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404F12 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
                                                                                                                                                                                                                                        • SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                                                                        • Opcode ID: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
                                                                                                                                                                                                                                        • Instruction ID: 5a9a404093729f8c7a4ed64dcb73daf90ff889549f225b9df3951733f5861a8d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB219DB1A00119BADF119FA5DD84ADEBFB9EF44354F14807AF904B6290C7788E41DBA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004047DD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047F8
                                                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 00404800
                                                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 0040481A
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,00001111,00000000,?), ref: 0040482C
                                                                                                                                                                                                                                        • SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404852
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                                                        • Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                                                                                                                                                                        • Instruction ID: 206dc1e0429e6aa6b627cd25208fa2295557d59b2a7717453fa0c9894da25502
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E6015276D00259BADB01DB94DC45FFEBBBCAF55711F10412BBA10B61C0C7B4A501CBA5
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(02957CB3,00000064,0295ABF0), ref: 00402BC5
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00402BD5
                                                                                                                                                                                                                                        • SetWindowTextA.USER32(?,?), ref: 00402BE5
                                                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • verifying installer: %d%%, xrefs: 00402BCF
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                                        • String ID: verifying installer: %d%%
                                                                                                                                                                                                                                        • API String ID: 1451636040-82062127
                                                                                                                                                                                                                                        • Opcode ID: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                                                                                                                                                                                                        • Instruction ID: bd73235a5a2a729140de961e31d76a0e47d27260d0eaef7d75f80e35c4c54abd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF01F471540208BBEF109F60DD49EEE3B79EB04305F008039FA16B51D1D7B59955DF59
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 0040276F
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402782
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
                                                                                                                                                                                                                                        • DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2667972263-0
                                                                                                                                                                                                                                        • Opcode ID: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
                                                                                                                                                                                                                                        • Instruction ID: 55e8cf3ffad71cabca96213aa966ad8f6b0c6824c0bc9dabfeb9c0d6c9f08848
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03217C71800124BBCF216FA5DE89EAE7A79EF09324F14023AF950762D1C7795D418FA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402364 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nse7C54.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
                                                                                                                                                                                                                                        • RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nse7C54.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nse7C54.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nse7C54.tmp
                                                                                                                                                                                                                                        • API String ID: 1356686001-2974485127
                                                                                                                                                                                                                                        • Opcode ID: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                                                                                                                                                                                                        • Instruction ID: 26fcae0a7b2a502e926faea7c6e927eea7b3aae3134fdb689c9e3a18d41500d2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E1145B1E00108BFEB10AFA5EE89EAF767DEB54358F10403AF505B71D1D6B85D419B28
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
                                                                                                                                                                                                                                        • RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402AE0
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402B05
                                                                                                                                                                                                                                        • RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                                                                        • Opcode ID: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
                                                                                                                                                                                                                                        • Instruction ID: feb6aed171ad8b85e204e5b4e2feb4536d295dbd67c3687bd8867431d3a466b7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53117F71A00108FFDF229F90DE89EAE3B7DEB54349B104076FA01B10A0D7749E51DB69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?), ref: 00401CE2
                                                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401CEF
                                                                                                                                                                                                                                        • LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
                                                                                                                                                                                                                                        • SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D2D
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                                                        • Opcode ID: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                                                                                                                                                                                                        • Instruction ID: 14b9f5ff68e8b0ed0f2204d74c17d06140583eb6ed2bbf798243b331d3a4cd3b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9F0E7B2A04114AFEB01ABE4DE88DAFB7BDEB54305B10447AF602F6191C7789D018B79
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D3B
                                                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
                                                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401D68
                                                                                                                                                                                                                                        • CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3808545654-0
                                                                                                                                                                                                                                        • Opcode ID: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
                                                                                                                                                                                                                                        • Instruction ID: 818c9bdddfe1b1fffd76dbb1b88acba4993fd419864b94457e62d7fc32e1ff32
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E3C67811569B3F
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004046D3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00404779
                                                                                                                                                                                                                                        • SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                                        • Opcode ID: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
                                                                                                                                                                                                                                        • Instruction ID: 079308417c3a62341de1df324b483ce4e469374b9790fc4fe8de96a48b85a08e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F011A573A0412837EB0065699C45EAF3298DB86374F254637FA25F71D2EA788C5245A8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040576B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405771
                                                                                                                                                                                                                                        • CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040577A
                                                                                                                                                                                                                                        • lstrcatA.KERNEL32(?,00409014), ref: 0040578B
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 0040576B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 2659869361-3936084776
                                                                                                                                                                                                                                        • Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                                                                                                                                                                                                        • Instruction ID: 00e6a1abdfef3fccf4d12e3b382aa79108487555f8088e95eeaee7bf5793dfbe
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94D0A9B2A05A307AD3122715AC0DE8B2A08CF82300B094023F200B72A2CB3C1D418BFE
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405804 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,76233410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,76233410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 00405817
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000), ref: 0040582B
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                                                        • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                                        • Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                                                                                                                                                                                                        • Instruction ID: 4ca260c7e1a22d06af12069221c3406c2bee361732d71c1e98a9e22686a99acb
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71F0C253908F942BFB3276641C44B675F88DB55350F04C07BEA80B62C2C6788860CBEA
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402C33
                                                                                                                                                                                                                                        • CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402C5E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2102729457-0
                                                                                                                                                                                                                                        • Opcode ID: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                                                                                                                                                                                                        • Instruction ID: 69bd14cd8f1a0d496662edafeb8c2727d8675a530a128bc1770b64b88ff4c26b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2CF05E7090A220ABD6217F64FE0CDDF7BA4FB41B527018576F144B21E4C379988ACB9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040393E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetWindowTextA.USER32(00000000,00422F00), ref: 004039D6
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\Downloads\teamviewer.exe" $1033
                                                                                                                                                                                                                                        • API String ID: 530164218-2004290341
                                                                                                                                                                                                                                        • Opcode ID: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
                                                                                                                                                                                                                                        • Instruction ID: 79edc1b1becbb318b5d11430581b7fe373163fbdb48c995140def98ab9010f1e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B311F3F1B04611ABCB20DF14DD809737BADEBC4756328823FE941A73A0C67D9D029B98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404E86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00404EB5
                                                                                                                                                                                                                                        • CallWindowProcA.USER32(?,?,?,?), ref: 00404F06
                                                                                                                                                                                                                                          • Part of subcall function 00403F2A: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403F3C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                                        • Opcode ID: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                                                                                                                                                                                                        • Instruction ID: f49a9e3fcece2dd6490d1841f3d0f5b5163df4d3f93a23d44cf999a9bd086e10
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D10171B110020EABDF209F11DC84A9B3725FBC4754F208037FB11761D1DB799C61A7A9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004057B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(80000000,C:\Users\user\Downloads,00402CD2,C:\Users\user\Downloads,C:\Users\user\Downloads,C:\Users\user\Downloads\teamviewer.exe,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 004057B8
                                                                                                                                                                                                                                        • CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Downloads,00402CD2,C:\Users\user\Downloads,C:\Users\user\Downloads,C:\Users\user\Downloads\teamviewer.exe,C:\Users\user\Downloads\teamviewer.exe,80000000,00000003), ref: 004057C6
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\Downloads, xrefs: 004057B2
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                                                                        • String ID: C:\Users\user\Downloads
                                                                                                                                                                                                                                        • API String ID: 2709904686-2402431655
                                                                                                                                                                                                                                        • Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                                                                                                                                                                                                        • Instruction ID: 15550f116ff3ce815c4487a542d9ae56249738f0e4d38f85a76656e2d55d0e49
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FAD0C7B2409D705EF31353149C08B9F6A58DF16700F195463E141EB591C6785D415BBD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004058D1 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
                                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004058F9
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590A
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000A.00000002.3064318601.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064238326.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064374197.0000000000407000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000409000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000421000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.0000000000429000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064420437.000000000042D000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.000000000042F000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000A.00000002.3064652794.0000000000471000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_10_2_400000_teamviewer.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                                                        • Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                                                                                                                                                                                                        • Instruction ID: 481a9c588bbd1c68550dea5b76d7ebd72626077616c8f786d6c844a28ee3c139
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9EF0F632504418FFCB02AFA5DC0099EBBA8EF46360B2540B9F800F7310D274EF01ABA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                        Execution Coverage:25.9%
                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                                                                        Total number of Nodes:1341
                                                                                                                                                                                                                                        Total number of Limit Nodes:42
                                                                                                                                                                                                                                        execution_graph 4037 402840 4038 402bbf 18 API calls 4037->4038 4040 40284e 4038->4040 4039 402864 4042 405d2e 2 API calls 4039->4042 4040->4039 4041 402bbf 18 API calls 4040->4041 4041->4039 4043 40286a 4042->4043 4065 405d53 GetFileAttributesW CreateFileW 4043->4065 4045 402877 4046 402883 GlobalAlloc 4045->4046 4047 40291a 4045->4047 4050 402911 CloseHandle 4046->4050 4051 40289c 4046->4051 4048 402922 DeleteFileW 4047->4048 4049 402935 4047->4049 4048->4049 4050->4047 4066 40336e SetFilePointer 4051->4066 4053 4028a2 4054 403358 ReadFile 4053->4054 4055 4028ab GlobalAlloc 4054->4055 4056 4028bb 4055->4056 4057 4028ef 4055->4057 4058 4030e7 45 API calls 4056->4058 4059 405e05 WriteFile 4057->4059 4060 4028c8 4058->4060 4061 4028fb GlobalFree 4059->4061 4063 4028e6 GlobalFree 4060->4063 4062 4030e7 45 API calls 4061->4062 4064 40290e 4062->4064 4063->4057 4064->4050 4065->4045 4066->4053 4067 401cc0 4068 402ba2 18 API calls 4067->4068 4069 401cc7 4068->4069 4070 402ba2 18 API calls 4069->4070 4071 401ccf GetDlgItem 4070->4071 4072 402531 4071->4072 4072->4072 4073 4029c0 4074 402ba2 18 API calls 4073->4074 4075 4029c6 4074->4075 4076 4029f9 4075->4076 4077 40281e 4075->4077 4079 4029d4 4075->4079 4076->4077 4078 4061a0 18 API calls 4076->4078 4078->4077 4079->4077 4081 4060c5 wsprintfW 4079->4081 4081->4077 3102 401fc3 3103 401fd5 3102->3103 3104 402087 3102->3104 3122 402bbf 3103->3122 3106 401423 25 API calls 3104->3106 3113 4021e1 3106->3113 3108 402bbf 18 API calls 3109 401fe5 3108->3109 3110 401ffb LoadLibraryExW 3109->3110 3111 401fed GetModuleHandleW 3109->3111 3110->3104 3112 40200c 3110->3112 3111->3110 3111->3112 3128 4065c7 WideCharToMultiByte 3112->3128 3116 402056 3134 4052dd 3116->3134 3117 40201d 3120 40202d 3117->3120 3131 401423 3117->3131 3120->3113 3121 402079 FreeLibrary 3120->3121 3121->3113 3123 402bcb 3122->3123 3145 4061a0 3123->3145 3126 401fdc 3126->3108 3129 4065f1 GetProcAddress 3128->3129 3130 402017 3128->3130 3129->3130 3130->3116 3130->3117 3132 4052dd 25 API calls 3131->3132 3133 401431 3132->3133 3133->3120 3135 4052f8 3134->3135 3136 40539a 3134->3136 3137 405314 lstrlenW 3135->3137 3138 4061a0 18 API calls 3135->3138 3136->3120 3139 405322 lstrlenW 3137->3139 3140 40533d 3137->3140 3138->3137 3139->3136 3141 405334 lstrcatW 3139->3141 3142 405350 3140->3142 3143 405343 SetWindowTextW 3140->3143 3141->3140 3142->3136 3144 405356 SendMessageW SendMessageW SendMessageW 3142->3144 3143->3142 3144->3136 3151 4061ad 3145->3151 3146 4063f8 3147 402bec 3146->3147 3179 40617e lstrcpynW 3146->3179 3147->3126 3163 406412 3147->3163 3149 406260 GetVersion 3149->3151 3150 4063c6 lstrlenW 3150->3151 3151->3146 3151->3149 3151->3150 3152 4061a0 10 API calls 3151->3152 3155 4062db GetSystemDirectoryW 3151->3155 3157 4062ee GetWindowsDirectoryW 3151->3157 3158 406412 5 API calls 3151->3158 3159 4061a0 10 API calls 3151->3159 3160 406367 lstrcatW 3151->3160 3161 406322 SHGetSpecialFolderLocation 3151->3161 3172 40604b RegOpenKeyExW 3151->3172 3177 4060c5 wsprintfW 3151->3177 3178 40617e lstrcpynW 3151->3178 3152->3150 3155->3151 3157->3151 3158->3151 3159->3151 3160->3151 3161->3151 3162 40633a SHGetPathFromIDListW CoTaskMemFree 3161->3162 3162->3151 3164 40641f 3163->3164 3166 406495 3164->3166 3167 406488 CharNextW 3164->3167 3170 406474 CharNextW 3164->3170 3171 406483 CharNextW 3164->3171 3180 405b5f 3164->3180 3165 40649a CharPrevW 3165->3166 3166->3165 3168 4064bb 3166->3168 3167->3164 3167->3166 3168->3126 3170->3164 3171->3167 3173 4060bf 3172->3173 3174 40607f RegQueryValueExW 3172->3174 3173->3151 3175 4060a0 RegCloseKey 3174->3175 3175->3173 3177->3151 3178->3151 3179->3147 3181 405b65 3180->3181 3182 405b7b 3181->3182 3183 405b6c CharNextW 3181->3183 3182->3164 3183->3181 4082 4016c4 4083 402bbf 18 API calls 4082->4083 4084 4016ca GetFullPathNameW 4083->4084 4087 4016e4 4084->4087 4091 401706 4084->4091 4085 40171b GetShortPathNameW 4086 402a4c 4085->4086 4088 4064c1 2 API calls 4087->4088 4087->4091 4089 4016f6 4088->4089 4089->4091 4092 40617e lstrcpynW 4089->4092 4091->4085 4091->4086 4092->4091 4093 406846 4099 4066ca 4093->4099 4094 407035 4095 406754 GlobalAlloc 4095->4094 4095->4099 4096 40674b GlobalFree 4096->4095 4097 4067c2 GlobalFree 4098 4067cb GlobalAlloc 4097->4098 4098->4094 4098->4099 4099->4094 4099->4095 4099->4096 4099->4097 4099->4098 4103 40194e 4104 402bbf 18 API calls 4103->4104 4105 401955 lstrlenW 4104->4105 4106 402531 4105->4106 4107 4027ce 4108 4027d6 4107->4108 4109 4027da FindNextFileW 4108->4109 4111 4027ec 4108->4111 4110 402833 4109->4110 4109->4111 4113 40617e lstrcpynW 4110->4113 4113->4111 4121 405251 4122 405261 4121->4122 4123 405275 4121->4123 4124 405267 4122->4124 4133 4052be 4122->4133 4125 40527d IsWindowVisible 4123->4125 4131 405294 4123->4131 4126 40428e SendMessageW 4124->4126 4127 40528a 4125->4127 4125->4133 4129 405271 4126->4129 4134 404ba7 SendMessageW 4127->4134 4128 4052c3 CallWindowProcW 4128->4129 4131->4128 4139 404c27 4131->4139 4133->4128 4135 404c06 SendMessageW 4134->4135 4136 404bca GetMessagePos ScreenToClient SendMessageW 4134->4136 4138 404bfe 4135->4138 4137 404c03 4136->4137 4136->4138 4137->4135 4138->4131 4148 40617e lstrcpynW 4139->4148 4141 404c3a 4149 4060c5 wsprintfW 4141->4149 4143 404c44 4144 40140b 2 API calls 4143->4144 4145 404c4d 4144->4145 4150 40617e lstrcpynW 4145->4150 4147 404c54 4147->4133 4148->4141 4149->4143 4150->4147 3446 401754 3447 402bbf 18 API calls 3446->3447 3448 40175b 3447->3448 3452 405d82 3448->3452 3450 401762 3451 405d82 2 API calls 3450->3451 3451->3450 3453 405d8f GetTickCount GetTempFileNameW 3452->3453 3454 405dc9 3453->3454 3455 405dc5 3453->3455 3454->3450 3455->3453 3455->3454 3456 4038d5 3457 4038f0 3456->3457 3458 4038e6 CloseHandle 3456->3458 3459 403904 3457->3459 3460 4038fa CloseHandle 3457->3460 3458->3457 3465 403932 3459->3465 3460->3459 3466 403940 3465->3466 3467 403909 3466->3467 3468 403945 FreeLibrary GlobalFree 3466->3468 3469 40596f 3467->3469 3468->3467 3468->3468 3505 405c3a 3469->3505 3472 405997 DeleteFileW 3502 403915 3472->3502 3473 4059ae 3474 405ace 3473->3474 3519 40617e lstrcpynW 3473->3519 3481 4064c1 2 API calls 3474->3481 3474->3502 3476 4059d4 3477 4059e7 3476->3477 3478 4059da lstrcatW 3476->3478 3521 405b7e lstrlenW 3477->3521 3479 4059ed 3478->3479 3482 4059fd lstrcatW 3479->3482 3484 405a08 lstrlenW FindFirstFileW 3479->3484 3483 405af3 3481->3483 3482->3484 3486 405b32 3 API calls 3483->3486 3483->3502 3484->3474 3485 405a2a 3484->3485 3488 405ab1 FindNextFileW 3485->3488 3497 40596f 62 API calls 3485->3497 3501 4052dd 25 API calls 3485->3501 3503 4052dd 25 API calls 3485->3503 3520 40617e lstrcpynW 3485->3520 3525 405927 3485->3525 3533 40601f MoveFileExW 3485->3533 3487 405afd 3486->3487 3489 405927 5 API calls 3487->3489 3488->3485 3492 405ac7 FindClose 3488->3492 3491 405b09 3489->3491 3493 405b23 3491->3493 3496 405b0d 3491->3496 3492->3474 3495 4052dd 25 API calls 3493->3495 3495->3502 3498 4052dd 25 API calls 3496->3498 3496->3502 3497->3485 3499 405b1a 3498->3499 3500 40601f 38 API calls 3499->3500 3500->3502 3501->3488 3503->3485 3537 40617e lstrcpynW 3505->3537 3507 405c4b 3538 405bdd CharNextW CharNextW 3507->3538 3510 40598f 3510->3472 3510->3473 3511 406412 5 API calls 3517 405c61 3511->3517 3512 405c92 lstrlenW 3513 405c9d 3512->3513 3512->3517 3514 405b32 3 API calls 3513->3514 3516 405ca2 GetFileAttributesW 3514->3516 3515 4064c1 2 API calls 3515->3517 3516->3510 3517->3510 3517->3512 3517->3515 3518 405b7e 2 API calls 3517->3518 3518->3512 3519->3476 3520->3485 3522 405b8c 3521->3522 3523 405b92 CharPrevW 3522->3523 3524 405b9e 3522->3524 3523->3522 3523->3524 3524->3479 3526 405d2e 2 API calls 3525->3526 3527 405933 3526->3527 3528 405954 3527->3528 3529 405942 RemoveDirectoryW 3527->3529 3530 40594a DeleteFileW 3527->3530 3528->3485 3531 405950 3529->3531 3530->3531 3531->3528 3532 405960 SetFileAttributesW 3531->3532 3532->3528 3534 406033 3533->3534 3536 406040 3533->3536 3544 405ead lstrcpyW 3534->3544 3536->3485 3537->3507 3540 405c0c 3538->3540 3541 405bfa 3538->3541 3539 405c30 3539->3510 3539->3511 3540->3539 3543 405b5f CharNextW 3540->3543 3541->3540 3542 405c07 CharNextW 3541->3542 3542->3539 3543->3540 3545 405ed5 3544->3545 3546 405efb GetShortPathNameW 3544->3546 3571 405d53 GetFileAttributesW CreateFileW 3545->3571 3548 405f10 3546->3548 3549 40601a 3546->3549 3548->3549 3551 405f18 wsprintfA 3548->3551 3549->3536 3550 405edf CloseHandle GetShortPathNameW 3550->3549 3552 405ef3 3550->3552 3553 4061a0 18 API calls 3551->3553 3552->3546 3552->3549 3554 405f40 3553->3554 3572 405d53 GetFileAttributesW CreateFileW 3554->3572 3556 405f4d 3556->3549 3557 405f5c GetFileSize GlobalAlloc 3556->3557 3558 406013 CloseHandle 3557->3558 3559 405f7e 3557->3559 3558->3549 3560 405dd6 ReadFile 3559->3560 3561 405f86 3560->3561 3561->3558 3573 405cb8 lstrlenA 3561->3573 3564 405fb1 3566 405cb8 4 API calls 3564->3566 3565 405f9d lstrcpyA 3568 405fbf 3565->3568 3566->3568 3567 405ff6 SetFilePointer 3569 405e05 WriteFile 3567->3569 3568->3567 3570 40600c GlobalFree 3569->3570 3570->3558 3571->3550 3572->3556 3574 405cf9 lstrlenA 3573->3574 3575 405d01 3574->3575 3576 405cd2 lstrcmpiA 3574->3576 3575->3564 3575->3565 3576->3575 3577 405cf0 CharNextA 3576->3577 3577->3574 4151 404356 lstrcpynW lstrlenW 4152 401d56 GetDC GetDeviceCaps 4153 402ba2 18 API calls 4152->4153 4154 401d74 MulDiv ReleaseDC 4153->4154 4155 402ba2 18 API calls 4154->4155 4156 401d93 4155->4156 4157 4061a0 18 API calls 4156->4157 4158 401dcc CreateFontIndirectW 4157->4158 4159 402531 4158->4159 4160 401a57 4161 402ba2 18 API calls 4160->4161 4162 401a5d 4161->4162 4163 402ba2 18 API calls 4162->4163 4164 401a05 4163->4164 4165 4014d7 4166 402ba2 18 API calls 4165->4166 4167 4014dd Sleep 4166->4167 4169 402a4c 4167->4169 4170 404c59 GetDlgItem GetDlgItem 4171 404cab 7 API calls 4170->4171 4178 404ec4 4170->4178 4172 404d41 SendMessageW 4171->4172 4173 404d4e DeleteObject 4171->4173 4172->4173 4174 404d57 4173->4174 4176 404d8e 4174->4176 4177 4061a0 18 API calls 4174->4177 4175 404fa8 4180 405054 4175->4180 4190 405001 SendMessageW 4175->4190 4210 404eb7 4175->4210 4179 404242 19 API calls 4176->4179 4181 404d70 SendMessageW SendMessageW 4177->4181 4178->4175 4188 404ba7 5 API calls 4178->4188 4213 404f35 4178->4213 4184 404da2 4179->4184 4182 405066 4180->4182 4183 40505e SendMessageW 4180->4183 4181->4174 4187 40508f 4182->4187 4192 405078 ImageList_Destroy 4182->4192 4193 40507f 4182->4193 4183->4182 4189 404242 19 API calls 4184->4189 4185 4042a9 8 API calls 4191 40524a 4185->4191 4186 404f9a SendMessageW 4186->4175 4195 4051fe 4187->4195 4209 404c27 4 API calls 4187->4209 4217 4050ca 4187->4217 4188->4213 4194 404db0 4189->4194 4196 405016 SendMessageW 4190->4196 4190->4210 4192->4193 4193->4187 4197 405088 GlobalFree 4193->4197 4198 404e85 GetWindowLongW SetWindowLongW 4194->4198 4205 404e7f 4194->4205 4208 404e00 SendMessageW 4194->4208 4211 404e3c SendMessageW 4194->4211 4212 404e4d SendMessageW 4194->4212 4200 405210 ShowWindow GetDlgItem ShowWindow 4195->4200 4195->4210 4199 405029 4196->4199 4197->4187 4201 404e9e 4198->4201 4204 40503a SendMessageW 4199->4204 4200->4210 4202 404ea4 ShowWindow 4201->4202 4203 404ebc 4201->4203 4221 404277 SendMessageW 4202->4221 4222 404277 SendMessageW 4203->4222 4204->4180 4205->4198 4205->4201 4208->4194 4209->4217 4210->4185 4211->4194 4212->4194 4213->4175 4213->4186 4214 4051d4 InvalidateRect 4214->4195 4215 4051ea 4214->4215 4223 404b62 4215->4223 4216 4050f8 SendMessageW 4220 40510e 4216->4220 4217->4216 4217->4220 4219 405182 SendMessageW SendMessageW 4219->4220 4220->4214 4220->4219 4221->4210 4222->4178 4226 404a99 4223->4226 4225 404b77 4225->4195 4227 404ab2 4226->4227 4228 4061a0 18 API calls 4227->4228 4229 404b16 4228->4229 4230 4061a0 18 API calls 4229->4230 4231 404b21 4230->4231 4232 4061a0 18 API calls 4231->4232 4233 404b37 lstrlenW wsprintfW SetDlgItemTextW 4232->4233 4233->4225 4234 40155b 4235 4029f2 4234->4235 4238 4060c5 wsprintfW 4235->4238 4237 4029f7 4238->4237 3908 401ddc 3909 402ba2 18 API calls 3908->3909 3910 401de2 3909->3910 3911 402ba2 18 API calls 3910->3911 3912 401deb 3911->3912 3913 401df2 ShowWindow 3912->3913 3914 401dfd KiUserCallbackDispatcher 3912->3914 3915 402a4c 3913->3915 3914->3915 4239 4046dd 4240 404709 4239->4240 4241 40471a 4239->4241 4300 4058a7 GetDlgItemTextW 4240->4300 4243 404726 GetDlgItem 4241->4243 4249 404785 4241->4249 4244 40473a 4243->4244 4248 40474e SetWindowTextW 4244->4248 4252 405bdd 4 API calls 4244->4252 4245 404869 4298 404a18 4245->4298 4302 4058a7 GetDlgItemTextW 4245->4302 4246 404714 4247 406412 5 API calls 4246->4247 4247->4241 4253 404242 19 API calls 4248->4253 4249->4245 4254 4061a0 18 API calls 4249->4254 4249->4298 4251 4042a9 8 API calls 4256 404a2c 4251->4256 4257 404744 4252->4257 4258 40476a 4253->4258 4259 4047f9 SHBrowseForFolderW 4254->4259 4255 404899 4260 405c3a 18 API calls 4255->4260 4257->4248 4264 405b32 3 API calls 4257->4264 4261 404242 19 API calls 4258->4261 4259->4245 4262 404811 CoTaskMemFree 4259->4262 4263 40489f 4260->4263 4265 404778 4261->4265 4266 405b32 3 API calls 4262->4266 4303 40617e lstrcpynW 4263->4303 4264->4248 4301 404277 SendMessageW 4265->4301 4268 40481e 4266->4268 4271 404855 SetDlgItemTextW 4268->4271 4275 4061a0 18 API calls 4268->4275 4270 40477e 4273 406558 5 API calls 4270->4273 4271->4245 4272 4048b6 4274 406558 5 API calls 4272->4274 4273->4249 4286 4048bd 4274->4286 4276 40483d lstrcmpiW 4275->4276 4276->4271 4278 40484e lstrcatW 4276->4278 4277 4048fe 4304 40617e lstrcpynW 4277->4304 4278->4271 4280 404905 4281 405bdd 4 API calls 4280->4281 4282 40490b GetDiskFreeSpaceW 4281->4282 4284 40492f MulDiv 4282->4284 4287 404956 4282->4287 4284->4287 4285 405b7e 2 API calls 4285->4286 4286->4277 4286->4285 4286->4287 4288 4049c7 4287->4288 4290 404b62 21 API calls 4287->4290 4289 4049ea 4288->4289 4291 40140b 2 API calls 4288->4291 4305 404264 KiUserCallbackDispatcher 4289->4305 4292 4049b4 4290->4292 4291->4289 4294 4049c9 SetDlgItemTextW 4292->4294 4295 4049b9 4292->4295 4294->4288 4296 404a99 21 API calls 4295->4296 4296->4288 4297 404a06 4297->4298 4306 404672 4297->4306 4298->4251 4300->4246 4301->4270 4302->4255 4303->4272 4304->4280 4305->4297 4307 404680 4306->4307 4308 404685 SendMessageW 4306->4308 4307->4308 4308->4298 3985 401bdf 3986 402ba2 18 API calls 3985->3986 3987 401be6 3986->3987 3988 402ba2 18 API calls 3987->3988 3990 401bf0 3988->3990 3989 401c00 3992 401c10 3989->3992 3993 402bbf 18 API calls 3989->3993 3990->3989 3991 402bbf 18 API calls 3990->3991 3991->3989 3994 401c1b 3992->3994 3995 401c5f 3992->3995 3993->3992 3997 402ba2 18 API calls 3994->3997 3996 402bbf 18 API calls 3995->3996 3998 401c64 3996->3998 3999 401c20 3997->3999 4000 402bbf 18 API calls 3998->4000 4001 402ba2 18 API calls 3999->4001 4002 401c6d FindWindowExW 4000->4002 4003 401c29 4001->4003 4006 401c8f 4002->4006 4004 401c31 SendMessageTimeoutW 4003->4004 4005 401c4f SendMessageW 4003->4005 4004->4006 4005->4006 4007 4022df 4008 402bbf 18 API calls 4007->4008 4009 4022ee 4008->4009 4010 402bbf 18 API calls 4009->4010 4011 4022f7 4010->4011 4012 402bbf 18 API calls 4011->4012 4013 402301 GetPrivateProfileStringW 4012->4013 4309 4043df 4311 4043f7 4309->4311 4314 404511 4309->4314 4310 40457b 4312 404585 GetDlgItem 4310->4312 4313 40464d 4310->4313 4317 404242 19 API calls 4311->4317 4315 40460e 4312->4315 4316 40459f 4312->4316 4319 4042a9 8 API calls 4313->4319 4314->4310 4314->4313 4320 40454c GetDlgItem SendMessageW 4314->4320 4315->4313 4324 404620 4315->4324 4316->4315 4323 4045c5 6 API calls 4316->4323 4318 40445e 4317->4318 4321 404242 19 API calls 4318->4321 4322 404648 4319->4322 4340 404264 KiUserCallbackDispatcher 4320->4340 4326 40446b CheckDlgButton 4321->4326 4323->4315 4327 404636 4324->4327 4328 404626 SendMessageW 4324->4328 4338 404264 KiUserCallbackDispatcher 4326->4338 4327->4322 4332 40463c SendMessageW 4327->4332 4328->4327 4329 404576 4330 404672 SendMessageW 4329->4330 4330->4310 4332->4322 4333 404489 GetDlgItem 4339 404277 SendMessageW 4333->4339 4335 40449f SendMessageW 4336 4044c5 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4335->4336 4337 4044bc GetSysColor 4335->4337 4336->4322 4337->4336 4338->4333 4339->4335 4340->4329 4341 401960 4342 402ba2 18 API calls 4341->4342 4343 401967 4342->4343 4344 402ba2 18 API calls 4343->4344 4345 401971 4344->4345 4346 402bbf 18 API calls 4345->4346 4347 40197a 4346->4347 4348 40198e lstrlenW 4347->4348 4349 4019ca 4347->4349 4350 401998 4348->4350 4350->4349 4354 40617e lstrcpynW 4350->4354 4352 4019b3 4352->4349 4353 4019c0 lstrlenW 4352->4353 4353->4349 4354->4352 4355 401662 4356 402bbf 18 API calls 4355->4356 4357 401668 4356->4357 4358 4064c1 2 API calls 4357->4358 4359 40166e 4358->4359 4360 4019e4 4361 402bbf 18 API calls 4360->4361 4362 4019eb 4361->4362 4363 402bbf 18 API calls 4362->4363 4364 4019f4 4363->4364 4365 4019fb lstrcmpiW 4364->4365 4366 401a0d lstrcmpW 4364->4366 4367 401a01 4365->4367 4366->4367 4368 4025e5 4369 402ba2 18 API calls 4368->4369 4371 4025f4 4369->4371 4370 40272d 4371->4370 4372 40263a ReadFile 4371->4372 4373 405dd6 ReadFile 4371->4373 4374 40267a MultiByteToWideChar 4371->4374 4375 40272f 4371->4375 4376 405e34 5 API calls 4371->4376 4378 4026a0 SetFilePointer MultiByteToWideChar 4371->4378 4379 402740 4371->4379 4372->4370 4372->4371 4373->4371 4374->4371 4381 4060c5 wsprintfW 4375->4381 4376->4371 4378->4371 4379->4370 4380 402761 SetFilePointer 4379->4380 4380->4370 4381->4370 4389 401e66 4390 402bbf 18 API calls 4389->4390 4391 401e6c 4390->4391 4392 4052dd 25 API calls 4391->4392 4393 401e76 4392->4393 4394 40585e 2 API calls 4393->4394 4395 401e7c 4394->4395 4396 40281e 4395->4396 4397 401edb CloseHandle 4395->4397 4398 401e8c WaitForSingleObject 4395->4398 4397->4396 4399 401e9e 4398->4399 4400 401eb0 GetExitCodeProcess 4399->4400 4403 406594 2 API calls 4399->4403 4401 401ec2 4400->4401 4402 401ecd 4400->4402 4406 4060c5 wsprintfW 4401->4406 4402->4397 4405 401ea5 WaitForSingleObject 4403->4405 4405->4399 4406->4402 3196 401767 3197 402bbf 18 API calls 3196->3197 3198 40176e 3197->3198 3199 401796 3198->3199 3200 40178e 3198->3200 3251 40617e lstrcpynW 3199->3251 3250 40617e lstrcpynW 3200->3250 3203 4017a1 3252 405b32 lstrlenW CharPrevW 3203->3252 3204 401794 3207 406412 5 API calls 3204->3207 3217 4017b3 3207->3217 3211 4017c5 CompareFileTime 3211->3217 3212 401885 3213 4052dd 25 API calls 3212->3213 3215 40188f 3213->3215 3214 4052dd 25 API calls 3216 401871 3214->3216 3235 4030e7 3215->3235 3217->3211 3217->3212 3221 4061a0 18 API calls 3217->3221 3226 40617e lstrcpynW 3217->3226 3233 40185c 3217->3233 3234 405d53 GetFileAttributesW CreateFileW 3217->3234 3255 4064c1 FindFirstFileW 3217->3255 3258 405d2e GetFileAttributesW 3217->3258 3261 4058c3 3217->3261 3220 4018b6 SetFileTime 3222 4018c8 FindCloseChangeNotification 3220->3222 3221->3217 3222->3216 3223 4018d9 3222->3223 3224 4018f1 3223->3224 3225 4018de 3223->3225 3228 4061a0 18 API calls 3224->3228 3227 4061a0 18 API calls 3225->3227 3226->3217 3229 4018e6 lstrcatW 3227->3229 3230 4018f9 3228->3230 3229->3230 3232 4058c3 MessageBoxIndirectW 3230->3232 3232->3216 3233->3214 3233->3216 3234->3217 3236 403112 3235->3236 3237 4030f6 SetFilePointer 3235->3237 3265 4031ef GetTickCount 3236->3265 3237->3236 3242 4031ef 43 API calls 3243 403149 3242->3243 3244 4031b5 ReadFile 3243->3244 3247 403158 3243->3247 3249 4018a2 3243->3249 3244->3249 3246 405dd6 ReadFile 3246->3247 3247->3246 3247->3249 3280 405e05 WriteFile 3247->3280 3249->3220 3249->3222 3250->3204 3251->3203 3253 4017a7 lstrcatW 3252->3253 3254 405b4e lstrcatW 3252->3254 3253->3204 3254->3253 3256 4064e2 3255->3256 3257 4064d7 FindClose 3255->3257 3256->3217 3257->3256 3259 405d40 SetFileAttributesW 3258->3259 3260 405d4d 3258->3260 3259->3260 3260->3217 3262 4058d8 3261->3262 3263 405924 3262->3263 3264 4058ec MessageBoxIndirectW 3262->3264 3263->3217 3264->3263 3266 403347 3265->3266 3267 40321d 3265->3267 3268 402d9f 33 API calls 3266->3268 3282 40336e SetFilePointer 3267->3282 3274 403119 3268->3274 3270 403228 SetFilePointer 3276 40324d 3270->3276 3274->3249 3278 405dd6 ReadFile 3274->3278 3275 405e05 WriteFile 3275->3276 3276->3274 3276->3275 3277 403328 SetFilePointer 3276->3277 3283 403358 3276->3283 3286 402d9f 3276->3286 3300 406697 3276->3300 3277->3266 3279 403132 3278->3279 3279->3242 3279->3249 3281 405e23 3280->3281 3281->3247 3282->3270 3284 405dd6 ReadFile 3283->3284 3285 40336b 3284->3285 3285->3276 3287 402db0 3286->3287 3288 402dc8 3286->3288 3291 402db9 DestroyWindow 3287->3291 3294 402dc0 3287->3294 3289 402dd0 3288->3289 3290 402dd8 GetTickCount 3288->3290 3310 406594 3289->3310 3293 402de6 3290->3293 3290->3294 3291->3294 3295 402e1b CreateDialogParamW ShowWindow 3293->3295 3296 402dee 3293->3296 3294->3276 3295->3294 3296->3294 3307 402d83 3296->3307 3298 402dfc wsprintfW 3299 4052dd 25 API calls 3298->3299 3299->3294 3301 4066bc 3300->3301 3302 4066c4 3300->3302 3301->3276 3302->3301 3303 406754 GlobalAlloc 3302->3303 3304 40674b GlobalFree 3302->3304 3305 4067c2 GlobalFree 3302->3305 3306 4067cb GlobalAlloc 3302->3306 3303->3301 3303->3302 3304->3303 3305->3306 3306->3301 3306->3302 3308 402d92 3307->3308 3309 402d94 MulDiv 3307->3309 3308->3309 3309->3298 3311 4065b1 PeekMessageW 3310->3311 3312 4065c1 3311->3312 3313 4065a7 DispatchMessageW 3311->3313 3312->3294 3313->3311 4407 401ee9 4408 402bbf 18 API calls 4407->4408 4409 401ef0 4408->4409 4410 4064c1 2 API calls 4409->4410 4411 401ef6 4410->4411 4413 401f07 4411->4413 4414 4060c5 wsprintfW 4411->4414 4414->4413 3314 4021ea 3315 402bbf 18 API calls 3314->3315 3316 4021f0 3315->3316 3317 402bbf 18 API calls 3316->3317 3318 4021f9 3317->3318 3319 402bbf 18 API calls 3318->3319 3320 402202 3319->3320 3321 4064c1 2 API calls 3320->3321 3322 40220b 3321->3322 3323 40221c lstrlenW lstrlenW 3322->3323 3324 40220f 3322->3324 3326 4052dd 25 API calls 3323->3326 3325 4052dd 25 API calls 3324->3325 3328 402217 3324->3328 3325->3328 3327 40225a SHFileOperationW 3326->3327 3327->3324 3327->3328 3329 403d6a 3330 403d82 3329->3330 3331 403ebd 3329->3331 3330->3331 3332 403d8e 3330->3332 3333 403f0e 3331->3333 3334 403ece GetDlgItem GetDlgItem 3331->3334 3335 403d99 SetWindowPos 3332->3335 3336 403dac 3332->3336 3338 403f68 3333->3338 3346 401389 2 API calls 3333->3346 3337 404242 19 API calls 3334->3337 3335->3336 3340 403db1 ShowWindow 3336->3340 3341 403dc9 3336->3341 3342 403ef8 SetClassLongW 3337->3342 3357 403eb8 3338->3357 3397 40428e 3338->3397 3340->3341 3343 403dd1 DestroyWindow 3341->3343 3344 403deb 3341->3344 3345 40140b 2 API calls 3342->3345 3396 4041cb 3343->3396 3347 403df0 SetWindowLongW 3344->3347 3348 403e01 3344->3348 3345->3333 3349 403f40 3346->3349 3347->3357 3352 403e0d GetDlgItem 3348->3352 3366 403e78 3348->3366 3349->3338 3353 403f44 SendMessageW 3349->3353 3350 40140b 2 API calls 3386 403f7a 3350->3386 3351 4041cd DestroyWindow KiUserCallbackDispatcher 3351->3396 3356 403e20 SendMessageW IsWindowEnabled 3352->3356 3359 403e3d 3352->3359 3353->3357 3355 4041fc ShowWindow 3355->3357 3356->3357 3356->3359 3358 4061a0 18 API calls 3358->3386 3360 403e4a 3359->3360 3361 403e91 SendMessageW 3359->3361 3362 403e5d 3359->3362 3370 403e42 3359->3370 3360->3361 3360->3370 3361->3366 3364 403e65 3362->3364 3365 403e7a 3362->3365 3410 40140b 3364->3410 3368 40140b 2 API calls 3365->3368 3416 4042a9 3366->3416 3368->3370 3369 404242 19 API calls 3369->3386 3370->3366 3413 40421b 3370->3413 3372 403ff5 GetDlgItem 3373 404012 ShowWindow KiUserCallbackDispatcher 3372->3373 3374 40400a 3372->3374 3403 404264 KiUserCallbackDispatcher 3373->3403 3374->3373 3376 40403c EnableWindow 3379 404050 3376->3379 3377 404055 GetSystemMenu EnableMenuItem SendMessageW 3378 404085 SendMessageW 3377->3378 3377->3379 3378->3379 3379->3377 3404 404277 SendMessageW 3379->3404 3405 40617e lstrcpynW 3379->3405 3382 4040b3 lstrlenW 3383 4061a0 18 API calls 3382->3383 3384 4040c9 SetWindowTextW 3383->3384 3406 401389 3384->3406 3386->3350 3386->3351 3386->3357 3386->3358 3386->3369 3387 40410d DestroyWindow 3386->3387 3400 404242 3386->3400 3388 404127 CreateDialogParamW 3387->3388 3387->3396 3389 40415a 3388->3389 3388->3396 3390 404242 19 API calls 3389->3390 3391 404165 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3390->3391 3392 401389 2 API calls 3391->3392 3393 4041ab 3392->3393 3393->3357 3394 4041b3 ShowWindow 3393->3394 3395 40428e SendMessageW 3394->3395 3395->3396 3396->3355 3396->3357 3398 4042a6 3397->3398 3399 404297 SendMessageW 3397->3399 3398->3386 3399->3398 3401 4061a0 18 API calls 3400->3401 3402 40424d SetDlgItemTextW 3401->3402 3402->3372 3403->3376 3404->3379 3405->3382 3408 401390 3406->3408 3407 4013fe 3407->3386 3408->3407 3409 4013cb MulDiv SendMessageW 3408->3409 3409->3408 3411 401389 2 API calls 3410->3411 3412 401420 3411->3412 3412->3370 3414 404222 3413->3414 3415 404228 SendMessageW 3413->3415 3414->3415 3415->3366 3417 4042c1 GetWindowLongW 3416->3417 3427 40434a 3416->3427 3418 4042d2 3417->3418 3417->3427 3419 4042e1 GetSysColor 3418->3419 3420 4042e4 3418->3420 3419->3420 3421 4042f4 SetBkMode 3420->3421 3422 4042ea SetTextColor 3420->3422 3423 404312 3421->3423 3424 40430c GetSysColor 3421->3424 3422->3421 3425 404323 3423->3425 3426 404319 SetBkColor 3423->3426 3424->3423 3425->3427 3428 404336 DeleteObject 3425->3428 3429 40433d CreateBrushIndirect 3425->3429 3426->3425 3427->3357 3428->3429 3429->3427 4415 40156b 4416 401584 4415->4416 4417 40157b ShowWindow 4415->4417 4418 401592 ShowWindow 4416->4418 4419 402a4c 4416->4419 4417->4416 4418->4419 4420 40226e 4421 402275 4420->4421 4425 402288 4420->4425 4422 4061a0 18 API calls 4421->4422 4423 402282 4422->4423 4424 4058c3 MessageBoxIndirectW 4423->4424 4424->4425 4426 4014f1 SetForegroundWindow 4427 402a4c 4426->4427 4428 401673 4429 402bbf 18 API calls 4428->4429 4430 40167a 4429->4430 4431 402bbf 18 API calls 4430->4431 4432 401683 4431->4432 4433 402bbf 18 API calls 4432->4433 4434 40168c MoveFileW 4433->4434 4435 40169f 4434->4435 4441 401698 4434->4441 4436 4064c1 2 API calls 4435->4436 4439 4021e1 4435->4439 4438 4016ae 4436->4438 4437 401423 25 API calls 4437->4439 4438->4439 4440 40601f 38 API calls 4438->4440 4440->4441 4441->4437 4442 401cfa GetDlgItem GetClientRect 4443 402bbf 18 API calls 4442->4443 4444 401d2c LoadImageW SendMessageW 4443->4444 4445 401d4a DeleteObject 4444->4445 4446 402a4c 4444->4446 4445->4446 3891 40237b 3892 402381 3891->3892 3893 402bbf 18 API calls 3892->3893 3894 402393 3893->3894 3895 402bbf 18 API calls 3894->3895 3896 40239d RegCreateKeyExW 3895->3896 3897 4023c7 3896->3897 3901 402a4c 3896->3901 3898 4023e2 3897->3898 3899 402bbf 18 API calls 3897->3899 3900 4023ee 3898->3900 3903 402ba2 18 API calls 3898->3903 3902 4023d8 lstrlenW 3899->3902 3904 402409 RegSetValueExW 3900->3904 3905 4030e7 45 API calls 3900->3905 3902->3898 3903->3900 3906 40241f RegCloseKey 3904->3906 3905->3904 3906->3901 4454 4027fb 4455 402bbf 18 API calls 4454->4455 4456 402802 FindFirstFileW 4455->4456 4457 40282a 4456->4457 4460 402815 4456->4460 4458 402833 4457->4458 4462 4060c5 wsprintfW 4457->4462 4463 40617e lstrcpynW 4458->4463 4462->4458 4463->4460 4471 4014ff 4472 401507 4471->4472 4474 40151a 4471->4474 4473 402ba2 18 API calls 4472->4473 4473->4474 4475 401000 4476 401037 BeginPaint GetClientRect 4475->4476 4478 40100c DefWindowProcW 4475->4478 4479 4010f3 4476->4479 4482 401179 4478->4482 4480 401073 CreateBrushIndirect FillRect DeleteObject 4479->4480 4481 4010fc 4479->4481 4480->4479 4483 401102 CreateFontIndirectW 4481->4483 4484 401167 EndPaint 4481->4484 4483->4484 4485 401112 6 API calls 4483->4485 4484->4482 4485->4484 4493 401904 4494 40193b 4493->4494 4495 402bbf 18 API calls 4494->4495 4496 401940 4495->4496 4497 40596f 69 API calls 4496->4497 4498 401949 4497->4498 4499 402d04 4500 402d16 SetTimer 4499->4500 4501 402d2f 4499->4501 4500->4501 4502 402d7d 4501->4502 4503 402d83 MulDiv 4501->4503 4504 402d3d wsprintfW SetWindowTextW SetDlgItemTextW 4503->4504 4504->4502 4506 403985 4507 403990 4506->4507 4508 403994 4507->4508 4509 403997 GlobalAlloc 4507->4509 4509->4508 3184 402786 3185 40278d 3184->3185 3188 4029f7 3184->3188 3192 402ba2 3185->3192 3187 402798 3189 40279f SetFilePointer 3187->3189 3189->3188 3190 4027af 3189->3190 3195 4060c5 wsprintfW 3190->3195 3193 4061a0 18 API calls 3192->3193 3194 402bb6 3193->3194 3194->3187 3195->3188 4510 401907 4511 402bbf 18 API calls 4510->4511 4512 40190e 4511->4512 4513 4058c3 MessageBoxIndirectW 4512->4513 4514 401917 4513->4514 4515 401e08 4516 402bbf 18 API calls 4515->4516 4517 401e0e 4516->4517 4518 402bbf 18 API calls 4517->4518 4519 401e17 4518->4519 4520 402bbf 18 API calls 4519->4520 4521 401e20 4520->4521 4522 402bbf 18 API calls 4521->4522 4523 401e29 4522->4523 4524 401423 25 API calls 4523->4524 4525 401e30 ShellExecuteW 4524->4525 4526 401e61 4525->4526 4532 404390 lstrlenW 4533 4043b1 WideCharToMultiByte 4532->4533 4534 4043af 4532->4534 4534->4533 4535 401491 4536 4052dd 25 API calls 4535->4536 4537 401498 4536->4537 4545 401a15 4546 402bbf 18 API calls 4545->4546 4547 401a1e ExpandEnvironmentStringsW 4546->4547 4548 401a32 4547->4548 4550 401a45 4547->4550 4549 401a37 lstrcmpW 4548->4549 4548->4550 4549->4550 4551 402515 4552 402bbf 18 API calls 4551->4552 4553 40251c 4552->4553 4556 405d53 GetFileAttributesW CreateFileW 4553->4556 4555 402528 4556->4555 4557 402095 4558 402bbf 18 API calls 4557->4558 4559 40209c 4558->4559 4560 402bbf 18 API calls 4559->4560 4561 4020a6 4560->4561 4562 402bbf 18 API calls 4561->4562 4563 4020b0 4562->4563 4564 402bbf 18 API calls 4563->4564 4565 4020ba 4564->4565 4566 402bbf 18 API calls 4565->4566 4568 4020c4 4566->4568 4567 402103 CoCreateInstance 4572 402122 4567->4572 4568->4567 4569 402bbf 18 API calls 4568->4569 4569->4567 4570 401423 25 API calls 4571 4021e1 4570->4571 4572->4570 4572->4571 4573 401b16 4574 402bbf 18 API calls 4573->4574 4575 401b1d 4574->4575 4576 402ba2 18 API calls 4575->4576 4577 401b26 wsprintfW 4576->4577 4578 402a4c 4577->4578 4579 404696 4580 4046a6 4579->4580 4581 4046cc 4579->4581 4582 404242 19 API calls 4580->4582 4583 4042a9 8 API calls 4581->4583 4584 4046b3 SetDlgItemTextW 4582->4584 4585 4046d8 4583->4585 4584->4581 4586 40159b 4587 402bbf 18 API calls 4586->4587 4588 4015a2 SetFileAttributesW 4587->4588 4589 4015b4 4588->4589 3916 40541c 3917 4055c6 3916->3917 3918 40543d GetDlgItem GetDlgItem GetDlgItem 3916->3918 3920 4055f7 3917->3920 3921 4055cf GetDlgItem CreateThread CloseHandle 3917->3921 3961 404277 SendMessageW 3918->3961 3923 405622 3920->3923 3924 405647 3920->3924 3925 40560e ShowWindow ShowWindow 3920->3925 3921->3920 3964 4053b0 5 API calls 3921->3964 3922 4054ad 3927 4054b4 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3922->3927 3926 405682 3923->3926 3929 405636 3923->3929 3930 40565c ShowWindow 3923->3930 3931 4042a9 8 API calls 3924->3931 3963 404277 SendMessageW 3925->3963 3926->3924 3936 405690 SendMessageW 3926->3936 3934 405522 3927->3934 3935 405506 SendMessageW SendMessageW 3927->3935 3937 40421b SendMessageW 3929->3937 3932 40567c 3930->3932 3933 40566e 3930->3933 3938 405655 3931->3938 3940 40421b SendMessageW 3932->3940 3939 4052dd 25 API calls 3933->3939 3941 405535 3934->3941 3942 405527 SendMessageW 3934->3942 3935->3934 3936->3938 3943 4056a9 CreatePopupMenu 3936->3943 3937->3924 3939->3932 3940->3926 3945 404242 19 API calls 3941->3945 3942->3941 3944 4061a0 18 API calls 3943->3944 3946 4056b9 AppendMenuW 3944->3946 3947 405545 3945->3947 3948 4056d6 GetWindowRect 3946->3948 3949 4056e9 TrackPopupMenu 3946->3949 3950 405582 GetDlgItem SendMessageW 3947->3950 3951 40554e ShowWindow 3947->3951 3948->3949 3949->3938 3953 405704 3949->3953 3950->3938 3952 4055a9 SendMessageW SendMessageW 3950->3952 3954 405571 3951->3954 3955 405564 ShowWindow 3951->3955 3952->3938 3956 405720 SendMessageW 3953->3956 3962 404277 SendMessageW 3954->3962 3955->3954 3956->3956 3957 40573d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3956->3957 3959 405762 SendMessageW 3957->3959 3959->3959 3960 40578b GlobalUnlock SetClipboardData CloseClipboard 3959->3960 3960->3938 3961->3922 3962->3950 3963->3923 3965 40229d 3966 4022a5 3965->3966 3967 4022ab 3965->3967 3969 402bbf 18 API calls 3966->3969 3968 4022b9 3967->3968 3970 402bbf 18 API calls 3967->3970 3971 4022c7 3968->3971 3972 402bbf 18 API calls 3968->3972 3969->3967 3970->3968 3973 402bbf 18 API calls 3971->3973 3972->3971 3974 4022d0 WritePrivateProfileStringW 3973->3974 4590 401f1d 4591 402bbf 18 API calls 4590->4591 4592 401f24 4591->4592 4593 406558 5 API calls 4592->4593 4594 401f33 4593->4594 4595 401fb7 4594->4595 4596 401f4f GlobalAlloc 4594->4596 4596->4595 4597 401f63 4596->4597 4598 406558 5 API calls 4597->4598 4599 401f6a 4598->4599 4600 406558 5 API calls 4599->4600 4601 401f74 4600->4601 4601->4595 4605 4060c5 wsprintfW 4601->4605 4603 401fa9 4606 4060c5 wsprintfW 4603->4606 4605->4603 4606->4595 3975 40249e 3976 402cc9 19 API calls 3975->3976 3977 4024a8 3976->3977 3978 402ba2 18 API calls 3977->3978 3979 4024b1 3978->3979 3980 4024d5 RegEnumValueW 3979->3980 3981 4024c9 RegEnumKeyW 3979->3981 3982 40281e 3979->3982 3980->3982 3983 4024ee RegCloseKey 3980->3983 3981->3983 3983->3982 4607 40149e 4608 402288 4607->4608 4609 4014ac PostQuitMessage 4607->4609 4609->4608 4014 40231f 4015 402324 4014->4015 4016 40234f 4014->4016 4018 402cc9 19 API calls 4015->4018 4017 402bbf 18 API calls 4016->4017 4020 402356 4017->4020 4019 40232b 4018->4019 4021 402335 4019->4021 4025 40236c 4019->4025 4026 402bff RegOpenKeyExW 4020->4026 4022 402bbf 18 API calls 4021->4022 4023 40233c RegDeleteValueW RegCloseKey 4022->4023 4023->4025 4027 402c93 4026->4027 4031 402c2a 4026->4031 4027->4025 4028 402c50 RegEnumKeyW 4029 402c62 RegCloseKey 4028->4029 4028->4031 4032 406558 5 API calls 4029->4032 4030 402c87 RegCloseKey 4036 402c76 4030->4036 4031->4028 4031->4029 4031->4030 4033 402bff 5 API calls 4031->4033 4034 402c72 4032->4034 4033->4031 4035 402ca2 RegDeleteKeyW 4034->4035 4034->4036 4035->4036 4036->4027 4610 401ca3 4611 402ba2 18 API calls 4610->4611 4612 401ca9 IsWindow 4611->4612 4613 401a05 4612->4613 4614 402a27 SendMessageW 4615 402a41 InvalidateRect 4614->4615 4616 402a4c 4614->4616 4615->4616 3430 40242a 3441 402cc9 3430->3441 3432 402434 3433 402bbf 18 API calls 3432->3433 3434 40243d 3433->3434 3435 402448 RegQueryValueExW 3434->3435 3438 40281e 3434->3438 3436 402468 3435->3436 3437 40246e RegCloseKey 3435->3437 3436->3437 3445 4060c5 wsprintfW 3436->3445 3437->3438 3442 402bbf 18 API calls 3441->3442 3443 402ce2 3442->3443 3444 402cf0 RegOpenKeyExW 3443->3444 3444->3432 3445->3437 4624 40172d 4625 402bbf 18 API calls 4624->4625 4626 401734 SearchPathW 4625->4626 4627 40174f 4626->4627 4628 404a33 4629 404a43 4628->4629 4630 404a5f 4628->4630 4639 4058a7 GetDlgItemTextW 4629->4639 4632 404a92 4630->4632 4633 404a65 SHGetPathFromIDListW 4630->4633 4634 404a7c SendMessageW 4633->4634 4635 404a75 4633->4635 4634->4632 4637 40140b 2 API calls 4635->4637 4636 404a50 SendMessageW 4636->4630 4637->4634 4639->4636 4640 4027b4 4641 4027ba 4640->4641 4642 4027c2 FindClose 4641->4642 4643 402a4c 4641->4643 4642->4643 3578 4033b6 SetErrorMode GetVersion 3579 4033eb 3578->3579 3580 4033f1 3578->3580 3581 406558 5 API calls 3579->3581 3666 4064e8 GetSystemDirectoryW 3580->3666 3581->3580 3583 403407 lstrlenA 3583->3580 3584 403417 3583->3584 3669 406558 GetModuleHandleA 3584->3669 3587 406558 5 API calls 3588 403426 #17 OleInitialize SHGetFileInfoW 3587->3588 3675 40617e lstrcpynW 3588->3675 3590 403463 GetCommandLineW 3676 40617e lstrcpynW 3590->3676 3592 403475 GetModuleHandleW 3593 40348d 3592->3593 3594 405b5f CharNextW 3593->3594 3595 40349c CharNextW 3594->3595 3596 4035c6 GetTempPathW 3595->3596 3607 4034b5 3595->3607 3677 403385 3596->3677 3598 4035de 3599 4035e2 GetWindowsDirectoryW lstrcatW 3598->3599 3600 403638 DeleteFileW 3598->3600 3602 403385 12 API calls 3599->3602 3687 402e41 GetTickCount GetModuleFileNameW 3600->3687 3605 4035fe 3602->3605 3603 405b5f CharNextW 3603->3607 3604 40364c 3606 403703 ExitProcess OleUninitialize 3604->3606 3610 4036ef 3604->3610 3615 405b5f CharNextW 3604->3615 3605->3600 3608 403602 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3605->3608 3611 403839 3606->3611 3612 403719 3606->3612 3607->3603 3609 4035af 3607->3609 3613 4035b1 3607->3613 3614 403385 12 API calls 3608->3614 3609->3596 3717 4039c7 3610->3717 3619 403841 GetCurrentProcess OpenProcessToken 3611->3619 3620 4038bd ExitProcess 3611->3620 3618 4058c3 MessageBoxIndirectW 3612->3618 3773 40617e lstrcpynW 3613->3773 3621 403630 3614->3621 3632 40366b 3615->3632 3624 403727 ExitProcess 3618->3624 3625 403859 LookupPrivilegeValueW AdjustTokenPrivileges 3619->3625 3626 40388d 3619->3626 3621->3600 3621->3606 3622 4036ff 3622->3606 3625->3626 3627 406558 5 API calls 3626->3627 3628 403894 3627->3628 3631 4038a9 ExitWindowsEx 3628->3631 3635 4038b6 3628->3635 3629 4036c9 3634 405c3a 18 API calls 3629->3634 3630 40372f 3776 405846 3630->3776 3631->3620 3631->3635 3632->3629 3632->3630 3637 4036d5 3634->3637 3638 40140b 2 API calls 3635->3638 3637->3606 3774 40617e lstrcpynW 3637->3774 3638->3620 3639 403750 lstrcatW lstrcmpiW 3639->3606 3642 40376c 3639->3642 3640 403745 lstrcatW 3640->3639 3644 403771 3642->3644 3645 403778 3642->3645 3643 4036e4 3775 40617e lstrcpynW 3643->3775 3779 4057ac CreateDirectoryW 3644->3779 3784 405829 CreateDirectoryW 3645->3784 3650 40377d SetCurrentDirectoryW 3651 403798 3650->3651 3652 40378d 3650->3652 3788 40617e lstrcpynW 3651->3788 3787 40617e lstrcpynW 3652->3787 3655 4061a0 18 API calls 3656 4037d7 DeleteFileW 3655->3656 3657 4037e4 CopyFileW 3656->3657 3663 4037a6 3656->3663 3657->3663 3658 40382d 3660 40601f 38 API calls 3658->3660 3659 40601f 38 API calls 3659->3663 3661 403834 3660->3661 3661->3606 3662 4061a0 18 API calls 3662->3663 3663->3655 3663->3658 3663->3659 3663->3662 3665 403818 CloseHandle 3663->3665 3789 40585e CreateProcessW 3663->3789 3665->3663 3667 40650a wsprintfW LoadLibraryExW 3666->3667 3667->3583 3670 406574 3669->3670 3671 40657e GetProcAddress 3669->3671 3672 4064e8 3 API calls 3670->3672 3673 40341f 3671->3673 3674 40657a 3672->3674 3673->3587 3674->3671 3674->3673 3675->3590 3676->3592 3678 406412 5 API calls 3677->3678 3680 403391 3678->3680 3679 40339b 3679->3598 3680->3679 3681 405b32 3 API calls 3680->3681 3682 4033a3 3681->3682 3683 405829 2 API calls 3682->3683 3684 4033a9 3683->3684 3685 405d82 2 API calls 3684->3685 3686 4033b4 3685->3686 3686->3598 3792 405d53 GetFileAttributesW CreateFileW 3687->3792 3689 402e84 3716 402e91 3689->3716 3793 40617e lstrcpynW 3689->3793 3691 402ea7 3692 405b7e 2 API calls 3691->3692 3693 402ead 3692->3693 3794 40617e lstrcpynW 3693->3794 3695 402eb8 GetFileSize 3696 402fb9 3695->3696 3714 402ecf 3695->3714 3697 402d9f 33 API calls 3696->3697 3699 402fc0 3697->3699 3698 403358 ReadFile 3698->3714 3701 402ffc GlobalAlloc 3699->3701 3699->3716 3796 40336e SetFilePointer 3699->3796 3700 403054 3703 402d9f 33 API calls 3700->3703 3702 403013 3701->3702 3708 405d82 2 API calls 3702->3708 3703->3716 3705 402fdd 3706 403358 ReadFile 3705->3706 3709 402fe8 3706->3709 3707 402d9f 33 API calls 3707->3714 3710 403024 CreateFileW 3708->3710 3709->3701 3709->3716 3711 40305e 3710->3711 3710->3716 3795 40336e SetFilePointer 3711->3795 3713 40306c 3715 4030e7 45 API calls 3713->3715 3714->3696 3714->3698 3714->3700 3714->3707 3714->3716 3715->3716 3716->3604 3718 406558 5 API calls 3717->3718 3719 4039db 3718->3719 3720 4039e1 3719->3720 3721 4039f3 3719->3721 3813 4060c5 wsprintfW 3720->3813 3722 40604b 3 API calls 3721->3722 3723 403a23 3722->3723 3724 403a42 lstrcatW 3723->3724 3726 40604b 3 API calls 3723->3726 3727 4039f1 3724->3727 3726->3724 3797 403c9d 3727->3797 3730 405c3a 18 API calls 3731 403a74 3730->3731 3732 403b08 3731->3732 3734 40604b 3 API calls 3731->3734 3733 405c3a 18 API calls 3732->3733 3735 403b0e 3733->3735 3736 403aa6 3734->3736 3737 403b1e LoadImageW 3735->3737 3740 4061a0 18 API calls 3735->3740 3736->3732 3743 403ac7 lstrlenW 3736->3743 3747 405b5f CharNextW 3736->3747 3738 403bc4 3737->3738 3739 403b45 RegisterClassW 3737->3739 3742 40140b 2 API calls 3738->3742 3741 403b7b SystemParametersInfoW CreateWindowExW 3739->3741 3772 403bce 3739->3772 3740->3737 3741->3738 3746 403bca 3742->3746 3744 403ad5 lstrcmpiW 3743->3744 3745 403afb 3743->3745 3744->3745 3749 403ae5 GetFileAttributesW 3744->3749 3750 405b32 3 API calls 3745->3750 3752 403c9d 19 API calls 3746->3752 3746->3772 3748 403ac4 3747->3748 3748->3743 3751 403af1 3749->3751 3753 403b01 3750->3753 3751->3745 3754 405b7e 2 API calls 3751->3754 3755 403bdb 3752->3755 3814 40617e lstrcpynW 3753->3814 3754->3745 3757 403be7 ShowWindow 3755->3757 3758 403c6a 3755->3758 3760 4064e8 3 API calls 3757->3760 3806 4053b0 OleInitialize 3758->3806 3762 403bff 3760->3762 3761 403c70 3763 403c74 3761->3763 3764 403c8c 3761->3764 3765 403c0d GetClassInfoW 3762->3765 3769 4064e8 3 API calls 3762->3769 3771 40140b 2 API calls 3763->3771 3763->3772 3768 40140b 2 API calls 3764->3768 3766 403c21 GetClassInfoW RegisterClassW 3765->3766 3767 403c37 DialogBoxParamW 3765->3767 3766->3767 3770 40140b 2 API calls 3767->3770 3768->3772 3769->3765 3770->3772 3771->3772 3772->3622 3773->3609 3774->3643 3775->3610 3777 406558 5 API calls 3776->3777 3778 403734 lstrcatW 3777->3778 3778->3639 3778->3640 3780 403776 3779->3780 3781 4057fd GetLastError 3779->3781 3780->3650 3781->3780 3782 40580c SetFileSecurityW 3781->3782 3782->3780 3783 405822 GetLastError 3782->3783 3783->3780 3785 405839 3784->3785 3786 40583d GetLastError 3784->3786 3785->3650 3786->3785 3787->3651 3788->3663 3790 405891 CloseHandle 3789->3790 3791 40589d 3789->3791 3790->3791 3791->3663 3792->3689 3793->3691 3794->3695 3795->3713 3796->3705 3798 403cb1 3797->3798 3815 4060c5 wsprintfW 3798->3815 3800 403d22 3801 4061a0 18 API calls 3800->3801 3802 403d2e SetWindowTextW 3801->3802 3803 403a52 3802->3803 3804 403d4a 3802->3804 3803->3730 3804->3803 3805 4061a0 18 API calls 3804->3805 3805->3804 3807 40428e SendMessageW 3806->3807 3808 4053d3 3807->3808 3811 401389 2 API calls 3808->3811 3812 4053fa 3808->3812 3809 40428e SendMessageW 3810 40540c OleUninitialize 3809->3810 3810->3761 3811->3808 3812->3809 3813->3727 3814->3732 3815->3800 3816 401b37 3817 401b44 3816->3817 3818 401b88 3816->3818 3821 401bcd 3817->3821 3826 401b5b 3817->3826 3819 401bb2 GlobalAlloc 3818->3819 3820 401b8d 3818->3820 3823 4061a0 18 API calls 3819->3823 3834 402288 3820->3834 3837 40617e lstrcpynW 3820->3837 3822 4061a0 18 API calls 3821->3822 3821->3834 3824 402282 3822->3824 3823->3821 3829 4058c3 MessageBoxIndirectW 3824->3829 3835 40617e lstrcpynW 3826->3835 3827 401b9f GlobalFree 3827->3834 3829->3834 3830 401b6a 3836 40617e lstrcpynW 3830->3836 3832 401b79 3838 40617e lstrcpynW 3832->3838 3835->3830 3836->3832 3837->3827 3838->3834 3839 402537 3840 402562 3839->3840 3841 40254b 3839->3841 3843 402596 3840->3843 3844 402567 3840->3844 3842 402ba2 18 API calls 3841->3842 3849 402552 3842->3849 3846 402bbf 18 API calls 3843->3846 3845 402bbf 18 API calls 3844->3845 3847 40256e WideCharToMultiByte lstrlenA 3845->3847 3848 40259d lstrlenW 3846->3848 3847->3849 3848->3849 3850 4025e0 3849->3850 3851 4025d2 3849->3851 3853 4025c3 3849->3853 3852 405e05 WriteFile 3851->3852 3852->3850 3856 405e34 SetFilePointer 3853->3856 3857 405e50 3856->3857 3858 4025ca 3856->3858 3859 405dd6 ReadFile 3857->3859 3858->3850 3858->3851 3860 405e5c 3859->3860 3860->3858 3861 405e75 SetFilePointer 3860->3861 3862 405e9d SetFilePointer 3860->3862 3861->3862 3863 405e80 3861->3863 3862->3858 3864 405e05 WriteFile 3863->3864 3864->3858 4644 4014b8 4645 4014be 4644->4645 4646 401389 2 API calls 4645->4646 4647 4014c6 4646->4647 3865 4015b9 3866 402bbf 18 API calls 3865->3866 3867 4015c0 3866->3867 3868 405bdd 4 API calls 3867->3868 3880 4015c9 3868->3880 3869 401629 3871 40165b 3869->3871 3872 40162e 3869->3872 3870 405b5f CharNextW 3870->3880 3875 401423 25 API calls 3871->3875 3873 401423 25 API calls 3872->3873 3874 401635 3873->3874 3884 40617e lstrcpynW 3874->3884 3881 401653 3875->3881 3877 405829 2 API calls 3877->3880 3878 405846 5 API calls 3878->3880 3879 401642 SetCurrentDirectoryW 3879->3881 3880->3869 3880->3870 3880->3877 3880->3878 3882 40160f GetFileAttributesW 3880->3882 3883 4057ac 4 API calls 3880->3883 3882->3880 3883->3880 3884->3879 4655 40293b 4656 402ba2 18 API calls 4655->4656 4657 402941 4656->4657 4658 402964 4657->4658 4659 40297d 4657->4659 4665 40281e 4657->4665 4660 402969 4658->4660 4661 40297a 4658->4661 4662 402993 4659->4662 4663 402987 4659->4663 4669 40617e lstrcpynW 4660->4669 4670 4060c5 wsprintfW 4661->4670 4664 4061a0 18 API calls 4662->4664 4666 402ba2 18 API calls 4663->4666 4664->4665 4666->4665 4669->4665 4670->4665

                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                        Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401stringfilecomCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 0 4033b6-4033e9 SetErrorMode GetVersion 1 4033eb-4033f3 call 406558 0->1 2 4033fc 0->2 1->2 8 4033f5 1->8 4 403401-403415 call 4064e8 lstrlenA 2->4 9 403417-40348b call 406558 * 2 #17 OleInitialize SHGetFileInfoW call 40617e GetCommandLineW call 40617e GetModuleHandleW 4->9 8->2 18 403495-4034af call 405b5f CharNextW 9->18 19 40348d-403494 9->19 22 4034b5-4034bb 18->22 23 4035c6-4035e0 GetTempPathW call 403385 18->23 19->18 25 4034c4-4034c8 22->25 26 4034bd-4034c2 22->26 32 4035e2-403600 GetWindowsDirectoryW lstrcatW call 403385 23->32 33 403638-403652 DeleteFileW call 402e41 23->33 27 4034ca-4034ce 25->27 28 4034cf-4034d3 25->28 26->25 26->26 27->28 30 403592-40359f call 405b5f 28->30 31 4034d9-4034df 28->31 46 4035a1-4035a2 30->46 47 4035a3-4035a9 30->47 35 4034e1-4034e9 31->35 36 4034fa-403533 31->36 32->33 52 403602-403632 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403385 32->52 48 403703-403713 ExitProcess OleUninitialize 33->48 49 403658-40365e 33->49 41 4034f0 35->41 42 4034eb-4034ee 35->42 43 403550-40358a 36->43 44 403535-40353a 36->44 41->36 42->36 42->41 43->30 51 40358c-403590 43->51 44->43 50 40353c-403544 44->50 46->47 47->22 53 4035af 47->53 56 403839-40383f 48->56 57 403719-403729 call 4058c3 ExitProcess 48->57 54 4036f3-4036fa call 4039c7 49->54 55 403664-40366f call 405b5f 49->55 58 403546-403549 50->58 59 40354b 50->59 51->30 60 4035b1-4035bf call 40617e 51->60 52->33 52->48 62 4035c4 53->62 71 4036ff 54->71 78 403671-4036a6 55->78 79 4036bd-4036c7 55->79 67 403841-403857 GetCurrentProcess OpenProcessToken 56->67 68 4038bd-4038c5 56->68 58->43 58->59 59->43 60->62 62->23 75 403859-403887 LookupPrivilegeValueW AdjustTokenPrivileges 67->75 76 40388d-40389b call 406558 67->76 72 4038c7 68->72 73 4038cb-4038cf ExitProcess 68->73 71->48 72->73 75->76 84 4038a9-4038b4 ExitWindowsEx 76->84 85 40389d-4038a7 76->85 81 4036a8-4036ac 78->81 82 4036c9-4036d7 call 405c3a 79->82 83 40372f-403743 call 405846 lstrcatW 79->83 86 4036b5-4036b9 81->86 87 4036ae-4036b3 81->87 82->48 94 4036d9-4036ef call 40617e * 2 82->94 97 403750-40376a lstrcatW lstrcmpiW 83->97 98 403745-40374b lstrcatW 83->98 84->68 90 4038b6-4038b8 call 40140b 84->90 85->84 85->90 86->81 91 4036bb 86->91 87->86 87->91 90->68 91->79 94->54 97->48 100 40376c-40376f 97->100 98->97 102 403771-403776 call 4057ac 100->102 103 403778 call 405829 100->103 109 40377d-40378b SetCurrentDirectoryW 102->109 103->109 110 403798-4037c1 call 40617e 109->110 111 40378d-403793 call 40617e 109->111 115 4037c6-4037e2 call 4061a0 DeleteFileW 110->115 111->110 118 403823-40382b 115->118 119 4037e4-4037f4 CopyFileW 115->119 118->115 121 40382d-403834 call 40601f 118->121 119->118 120 4037f6-403816 call 40601f call 4061a0 call 40585e 119->120 120->118 130 403818-40381f CloseHandle 120->130 121->48 130->118
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetErrorMode.KERNELBASE ref: 004033D9
                                                                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 004033DF
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
                                                                                                                                                                                                                                        • #17.COMCTL32(00000007,00000009), ref: 0040342B
                                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403432
                                                                                                                                                                                                                                        • SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
                                                                                                                                                                                                                                        • GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
                                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00000000), ref: 00403476
                                                                                                                                                                                                                                        • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00000020), ref: 0040349D
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035D7
                                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035E8
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F4
                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403608
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403610
                                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403621
                                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403629
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(1033), ref: 0040363D
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32(?), ref: 00403703
                                                                                                                                                                                                                                        • OleUninitialize.OLE32(?), ref: 00403708
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403729
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 0040373C
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040374B
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403756
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00000000,?), ref: 00403762
                                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040377E
                                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
                                                                                                                                                                                                                                        • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
                                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
                                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
                                                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
                                                                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 00403887
                                                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004038CF
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $.tmp$1033$C:\Program Files (x86)\TeamViewer$C:\Program Files (x86)\TeamViewer\TVExtractTemp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer$C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                                        • API String ID: 354199918-3907601620
                                                                                                                                                                                                                                        • Opcode ID: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
                                                                                                                                                                                                                                        • Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 492 40596f-405995 call 405c3a 495 405997-4059a9 DeleteFileW 492->495 496 4059ae-4059b5 492->496 497 405b2b-405b2f 495->497 498 4059b7-4059b9 496->498 499 4059c8-4059d8 call 40617e 496->499 500 405ad9-405ade 498->500 501 4059bf-4059c2 498->501 505 4059e7-4059e8 call 405b7e 499->505 506 4059da-4059e5 lstrcatW 499->506 500->497 503 405ae0-405ae3 500->503 501->499 501->500 507 405ae5-405aeb 503->507 508 405aed-405af5 call 4064c1 503->508 509 4059ed-4059f1 505->509 506->509 507->497 508->497 516 405af7-405b0b call 405b32 call 405927 508->516 512 4059f3-4059fb 509->512 513 4059fd-405a03 lstrcatW 509->513 512->513 515 405a08-405a24 lstrlenW FindFirstFileW 512->515 513->515 517 405a2a-405a32 515->517 518 405ace-405ad2 515->518 532 405b23-405b26 call 4052dd 516->532 533 405b0d-405b10 516->533 521 405a52-405a66 call 40617e 517->521 522 405a34-405a3c 517->522 518->500 520 405ad4 518->520 520->500 534 405a68-405a70 521->534 535 405a7d-405a88 call 405927 521->535 524 405ab1-405ac1 FindNextFileW 522->524 525 405a3e-405a46 522->525 524->517 531 405ac7-405ac8 FindClose 524->531 525->521 528 405a48-405a50 525->528 528->521 528->524 531->518 532->497 533->507 538 405b12-405b21 call 4052dd call 40601f 533->538 534->524 539 405a72-405a76 call 40596f 534->539 545 405aa9-405aac call 4052dd 535->545 546 405a8a-405a8d 535->546 538->497 544 405a7b 539->544 544->524 545->524 548 405aa1-405aa7 546->548 549 405a8f-405a9f call 4052dd call 40601f 546->549 548->524 549->524
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,76233420,76232EE0,00000000), ref: 00405998
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\*.*,\*.*), ref: 004059E0
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014), ref: 00405A03
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405A09
                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405A19
                                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
                                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405AC8
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\*.*$\*.*
                                                                                                                                                                                                                                        • API String ID: 2035342205-3651580028
                                                                                                                                                                                                                                        • Opcode ID: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
                                                                                                                                                                                                                                        • Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004064C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0), ref: 004064CC
                                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 004064D8
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                        • String ID: C:\$xgB
                                                                                                                                                                                                                                        • API String ID: 2295610775-2001824454
                                                                                                                                                                                                                                        • Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
                                                                                                                                                                                                                                        • Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
                                                                                                                                                                                                                                        • Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 131 40541c-405437 132 4055c6-4055cd 131->132 133 40543d-405504 GetDlgItem * 3 call 404277 call 404b7a GetClientRect GetSystemMetrics SendMessageW * 2 131->133 135 4055f7-405604 132->135 136 4055cf-4055f1 GetDlgItem CreateThread CloseHandle 132->136 153 405522-405525 133->153 154 405506-405520 SendMessageW * 2 133->154 138 405622-40562c 135->138 139 405606-40560c 135->139 136->135 143 405682-405686 138->143 144 40562e-405634 138->144 141 405647-405650 call 4042a9 139->141 142 40560e-40561d ShowWindow * 2 call 404277 139->142 157 405655-405659 141->157 142->138 143->141 146 405688-40568e 143->146 148 405636-405642 call 40421b 144->148 149 40565c-40566c ShowWindow 144->149 146->141 155 405690-4056a3 SendMessageW 146->155 148->141 151 40567c-40567d call 40421b 149->151 152 40566e-405677 call 4052dd 149->152 151->143 152->151 160 405535-40554c call 404242 153->160 161 405527-405533 SendMessageW 153->161 154->153 162 4057a5-4057a7 155->162 163 4056a9-4056d4 CreatePopupMenu call 4061a0 AppendMenuW 155->163 170 405582-4055a3 GetDlgItem SendMessageW 160->170 171 40554e-405562 ShowWindow 160->171 161->160 162->157 168 4056d6-4056e6 GetWindowRect 163->168 169 4056e9-4056fe TrackPopupMenu 163->169 168->169 169->162 173 405704-40571b 169->173 170->162 172 4055a9-4055c1 SendMessageW * 2 170->172 174 405571 171->174 175 405564-40556f ShowWindow 171->175 172->162 176 405720-40573b SendMessageW 173->176 177 405577-40557d call 404277 174->177 175->177 176->176 178 40573d-405760 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 176->178 177->170 180 405762-405789 SendMessageW 178->180 180->180 181 40578b-40579f GlobalUnlock SetClipboardData CloseClipboard 180->181 181->162
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 0040547A
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00405489
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 004054C6
                                                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000002), ref: 004054CD
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 00405569
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040558A
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00405498
                                                                                                                                                                                                                                          • Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004055DC
                                                                                                                                                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004055F1
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00405615
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040561A
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405664
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
                                                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004056A9
                                                                                                                                                                                                                                        • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
                                                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004056DD
                                                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
                                                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 0040573E
                                                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405744
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
                                                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0040575A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
                                                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0040578E
                                                                                                                                                                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00405799
                                                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0040579F
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                                        • String ID: (7B${
                                                                                                                                                                                                                                        • API String ID: 590372296-525222780
                                                                                                                                                                                                                                        • Opcode ID: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
                                                                                                                                                                                                                                        • Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 182 403d6a-403d7c 183 403d82-403d88 182->183 184 403ebd-403ecc 182->184 183->184 185 403d8e-403d97 183->185 186 403f1b-403f30 184->186 187 403ece-403f16 GetDlgItem * 2 call 404242 SetClassLongW call 40140b 184->187 188 403d99-403da6 SetWindowPos 185->188 189 403dac-403daf 185->189 191 403f70-403f75 call 40428e 186->191 192 403f32-403f35 186->192 187->186 188->189 194 403db1-403dc3 ShowWindow 189->194 195 403dc9-403dcf 189->195 200 403f7a-403f95 191->200 197 403f37-403f42 call 401389 192->197 198 403f68-403f6a 192->198 194->195 201 403dd1-403de6 DestroyWindow 195->201 202 403deb-403dee 195->202 197->198 219 403f44-403f63 SendMessageW 197->219 198->191 199 40420f 198->199 207 404211-404218 199->207 205 403f97-403f99 call 40140b 200->205 206 403f9e-403fa4 200->206 208 4041ec-4041f2 201->208 210 403df0-403dfc SetWindowLongW 202->210 211 403e01-403e07 202->211 205->206 215 403faa-403fb5 206->215 216 4041cd-4041e6 DestroyWindow KiUserCallbackDispatcher 206->216 208->199 213 4041f4-4041fa 208->213 210->207 217 403eaa-403eb8 call 4042a9 211->217 218 403e0d-403e1e GetDlgItem 211->218 213->199 221 4041fc-404205 ShowWindow 213->221 215->216 222 403fbb-404008 call 4061a0 call 404242 * 3 GetDlgItem 215->222 216->208 217->207 223 403e20-403e37 SendMessageW IsWindowEnabled 218->223 224 403e3d-403e40 218->224 219->207 221->199 252 404012-40404e ShowWindow KiUserCallbackDispatcher call 404264 EnableWindow 222->252 253 40400a-40400f 222->253 223->199 223->224 227 403e42-403e43 224->227 228 403e45-403e48 224->228 232 403e73-403e78 call 40421b 227->232 229 403e56-403e5b 228->229 230 403e4a-403e50 228->230 233 403e91-403ea4 SendMessageW 229->233 235 403e5d-403e63 229->235 230->233 234 403e52-403e54 230->234 232->217 233->217 234->232 238 403e65-403e6b call 40140b 235->238 239 403e7a-403e83 call 40140b 235->239 248 403e71 238->248 239->217 249 403e85-403e8f 239->249 248->232 249->248 256 404050-404051 252->256 257 404053 252->257 253->252 258 404055-404083 GetSystemMenu EnableMenuItem SendMessageW 256->258 257->258 259 404085-404096 SendMessageW 258->259 260 404098 258->260 261 40409e-4040dc call 404277 call 40617e lstrlenW call 4061a0 SetWindowTextW call 401389 259->261 260->261 261->200 270 4040e2-4040e4 261->270 270->200 271 4040ea-4040ee 270->271 272 4040f0-4040f6 271->272 273 40410d-404121 DestroyWindow 271->273 272->199 274 4040fc-404102 272->274 273->208 275 404127-404154 CreateDialogParamW 273->275 274->200 276 404108 274->276 275->208 277 40415a-4041b1 call 404242 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 275->277 276->199 277->199 282 4041b3-4041c6 ShowWindow call 40428e 277->282 284 4041cb 282->284 284->208
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
                                                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 00403DC3
                                                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 00403DD7
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403E14
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
                                                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403E2F
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403EDD
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403EE7
                                                                                                                                                                                                                                        • SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
                                                                                                                                                                                                                                        • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403FF8
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00404019
                                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040402B
                                                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00404046
                                                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
                                                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00404063
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,00423728), ref: 004040CB
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 004041FF
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                                                                                                                                                                                        • String ID: (7B
                                                                                                                                                                                                                                        • API String ID: 3282139019-3251261122
                                                                                                                                                                                                                                        • Opcode ID: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
                                                                                                                                                                                                                                        • Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 285 4039c7-4039df call 406558 288 4039e1-4039f1 call 4060c5 285->288 289 4039f3-403a2a call 40604b 285->289 297 403a4d-403a76 call 403c9d call 405c3a 288->297 293 403a42-403a48 lstrcatW 289->293 294 403a2c-403a3d call 40604b 289->294 293->297 294->293 303 403b08-403b10 call 405c3a 297->303 304 403a7c-403a81 297->304 310 403b12-403b19 call 4061a0 303->310 311 403b1e-403b43 LoadImageW 303->311 304->303 305 403a87-403aa1 call 40604b 304->305 309 403aa6-403aaf 305->309 309->303 314 403ab1-403ab5 309->314 310->311 312 403bc4-403bcc call 40140b 311->312 313 403b45-403b75 RegisterClassW 311->313 328 403bd6-403be1 call 403c9d 312->328 329 403bce-403bd1 312->329 316 403c93 313->316 317 403b7b-403bbf SystemParametersInfoW CreateWindowExW 313->317 319 403ac7-403ad3 lstrlenW 314->319 320 403ab7-403ac4 call 405b5f 314->320 321 403c95-403c9c 316->321 317->312 322 403ad5-403ae3 lstrcmpiW 319->322 323 403afb-403b03 call 405b32 call 40617e 319->323 320->319 322->323 327 403ae5-403aef GetFileAttributesW 322->327 323->303 331 403af1-403af3 327->331 332 403af5-403af6 call 405b7e 327->332 338 403be7-403c01 ShowWindow call 4064e8 328->338 339 403c6a-403c6b call 4053b0 328->339 329->321 331->323 331->332 332->323 346 403c03-403c08 call 4064e8 338->346 347 403c0d-403c1f GetClassInfoW 338->347 342 403c70-403c72 339->342 344 403c74-403c7a 342->344 345 403c8c-403c8e call 40140b 342->345 344->329 350 403c80-403c87 call 40140b 344->350 345->316 346->347 348 403c21-403c31 GetClassInfoW RegisterClassW 347->348 349 403c37-403c5a DialogBoxParamW call 40140b 347->349 348->349 355 403c5f-403c68 call 403917 349->355 350->329 355->321
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(1033,00423728), ref: 00403A48
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,76233420), ref: 00403AC8
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AE6
                                                                                                                                                                                                                                        • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\TeamViewer), ref: 00403B2F
                                                                                                                                                                                                                                          • Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2
                                                                                                                                                                                                                                        • RegisterClassW.USER32(004291E0), ref: 00403B6C
                                                                                                                                                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
                                                                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 00403BEF
                                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
                                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
                                                                                                                                                                                                                                        • RegisterClassW.USER32(004291E0), ref: 00403C31
                                                                                                                                                                                                                                        • DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\TeamViewer$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                                        • API String ID: 1975747703-4156469811
                                                                                                                                                                                                                                        • Opcode ID: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
                                                                                                                                                                                                                                        • Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203memoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 359 402e41-402e8f GetTickCount GetModuleFileNameW call 405d53 362 402e91-402e96 359->362 363 402e9b-402ec9 call 40617e call 405b7e call 40617e GetFileSize 359->363 364 4030e0-4030e4 362->364 371 402fb9-402fc7 call 402d9f 363->371 372 402ecf-402ee6 363->372 379 403098-40309d 371->379 380 402fcd-402fd0 371->380 374 402ee8 372->374 375 402eea-402ef7 call 403358 372->375 374->375 381 403054-40305c call 402d9f 375->381 382 402efd-402f03 375->382 379->364 383 402fd2-402fea call 40336e call 403358 380->383 384 402ffc-403048 GlobalAlloc call 406677 call 405d82 CreateFileW 380->384 381->379 385 402f83-402f87 382->385 386 402f05-402f1d call 405d0e 382->386 383->379 407 402ff0-402ff6 383->407 410 40304a-40304f 384->410 411 40305e-40308e call 40336e call 4030e7 384->411 390 402f90-402f96 385->390 391 402f89-402f8f call 402d9f 385->391 386->390 405 402f1f-402f26 386->405 398 402f98-402fa6 call 406609 390->398 399 402fa9-402fb3 390->399 391->390 398->399 399->371 399->372 405->390 409 402f28-402f2f 405->409 407->379 407->384 409->390 412 402f31-402f38 409->412 410->364 418 403093-403096 411->418 412->390 414 402f3a-402f41 412->414 414->390 416 402f43-402f63 414->416 416->379 419 402f69-402f6d 416->419 418->379 420 40309f-4030b0 418->420 421 402f75-402f7d 419->421 422 402f6f-402f73 419->422 423 4030b2 420->423 424 4030b8-4030bd 420->424 421->390 425 402f7f-402f81 421->425 422->371 422->421 423->424 426 4030be-4030c4 424->426 425->390 426->426 427 4030c6-4030de call 405d0e 426->427 427->364
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402E55
                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,00000400), ref: 00402E71
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
                                                                                                                                                                                                                                        • GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Null, xrefs: 00402F3A
                                                                                                                                                                                                                                        • Inst, xrefs: 00402F28
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer, xrefs: 00402E9C, 00402EA1, 00402EA7
                                                                                                                                                                                                                                        • soft, xrefs: 00402F31
                                                                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 00402E91
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
                                                                                                                                                                                                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
                                                                                                                                                                                                                                        • "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" , xrefs: 00402E41
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer$C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                                        • API String ID: 2803837635-517821220
                                                                                                                                                                                                                                        • Opcode ID: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
                                                                                                                                                                                                                                        • Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 430 4061a0-4061ab 431 4061ad-4061bc 430->431 432 4061be-4061d4 430->432 431->432 433 4061da-4061e7 432->433 434 4063ec-4063f2 432->434 433->434 435 4061ed-4061f4 433->435 436 4063f8-406403 434->436 437 4061f9-406206 434->437 435->434 439 406405-406409 call 40617e 436->439 440 40640e-40640f 436->440 437->436 438 40620c-406218 437->438 441 4063d9 438->441 442 40621e-40625a 438->442 439->440 444 4063e7-4063ea 441->444 445 4063db-4063e5 441->445 446 406260-40626b GetVersion 442->446 447 40637a-40637e 442->447 444->434 445->434 448 406285 446->448 449 40626d-406271 446->449 450 406380-406384 447->450 451 4063b3-4063b7 447->451 457 40628c-406293 448->457 449->448 454 406273-406277 449->454 455 406394-4063a1 call 40617e 450->455 456 406386-406392 call 4060c5 450->456 452 4063c6-4063d7 lstrlenW 451->452 453 4063b9-4063c1 call 4061a0 451->453 452->434 453->452 454->448 459 406279-40627d 454->459 468 4063a6-4063af 455->468 456->468 461 406295-406297 457->461 462 406298-40629a 457->462 459->448 464 40627f-406283 459->464 461->462 466 4062d6-4062d9 462->466 467 40629c-4062b9 call 40604b 462->467 464->457 469 4062e9-4062ec 466->469 470 4062db-4062e7 GetSystemDirectoryW 466->470 473 4062be-4062c2 467->473 468->452 472 4063b1 468->472 476 406357-406359 469->476 477 4062ee-4062fc GetWindowsDirectoryW 469->477 475 40635b-40635f 470->475 474 406372-406378 call 406412 472->474 478 406361-406365 473->478 479 4062c8-4062d1 call 4061a0 473->479 474->452 475->474 475->478 476->475 480 4062fe-406308 476->480 477->476 478->474 483 406367-40636d lstrcatW 478->483 479->475 485 406322-406338 SHGetSpecialFolderLocation 480->485 486 40630a-40630d 480->486 483->474 489 406353 485->489 490 40633a-406351 SHGetPathFromIDListW CoTaskMemFree 485->490 486->485 488 40630f-406316 486->488 491 40631e-406320 488->491 489->476 490->475 490->489 491->475 491->485
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetVersion.KERNEL32(00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000), ref: 00406263
                                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062E1
                                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062F4
                                                                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
                                                                                                                                                                                                                                        • SHGetPathFromIDListW.SHELL32(?,Remove folder: ), ref: 0040633E
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(?), ref: 00406349
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000), ref: 004063C7
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                                                                        • String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                                        • API String ID: 900638850-111976239
                                                                                                                                                                                                                                        • Opcode ID: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
                                                                                                                                                                                                                                        • Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004052DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 556 4052dd-4052f2 557 4052f8-405309 556->557 558 4053a9-4053ad 556->558 559 405314-405320 lstrlenW 557->559 560 40530b-40530f call 4061a0 557->560 562 405322-405332 lstrlenW 559->562 563 40533d-405341 559->563 560->559 562->558 564 405334-405338 lstrcatW 562->564 565 405350-405354 563->565 566 405343-40534a SetWindowTextW 563->566 564->563 567 405356-405398 SendMessageW * 3 565->567 568 40539a-40539c 565->568 566->565 567->568 568->558 569 40539e-4053a1 568->569 569->558
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00402E19), ref: 00405338
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\), ref: 0040534A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                                        • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\
                                                                                                                                                                                                                                        • API String ID: 2531174081-438890559
                                                                                                                                                                                                                                        • Opcode ID: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
                                                                                                                                                                                                                                        • Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401767 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 570 401767-40178c call 402bbf call 405ba9 575 401796-4017a8 call 40617e call 405b32 lstrcatW 570->575 576 40178e-401794 call 40617e 570->576 581 4017ad-4017ae call 406412 575->581 576->581 585 4017b3-4017b7 581->585 586 4017b9-4017c3 call 4064c1 585->586 587 4017ea-4017ed 585->587 595 4017d5-4017e7 586->595 596 4017c5-4017d3 CompareFileTime 586->596 589 4017f5-401811 call 405d53 587->589 590 4017ef-4017f0 call 405d2e 587->590 597 401813-401816 589->597 598 401885-4018ae call 4052dd call 4030e7 589->598 590->589 595->587 596->595 599 401867-401871 call 4052dd 597->599 600 401818-401856 call 40617e * 2 call 4061a0 call 40617e call 4058c3 597->600 612 4018b0-4018b4 598->612 613 4018b6-4018c2 SetFileTime 598->613 610 40187a-401880 599->610 600->585 633 40185c-40185d 600->633 614 402a55 610->614 612->613 616 4018c8-4018d3 FindCloseChangeNotification 612->616 613->616 617 402a57-402a5b 614->617 619 4018d9-4018dc 616->619 620 402a4c-402a4f 616->620 621 4018f1-4018f4 call 4061a0 619->621 622 4018de-4018ef call 4061a0 lstrcatW 619->622 620->614 628 4018f9-40228d call 4058c3 621->628 622->628 628->617 628->620 633->610 634 40185f-401860 633->634 634->599
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00000000,00000000), ref: 004017A8
                                                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,00000000,00000000,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,C:\Program Files (x86)\TeamViewer\TVExtractTemp,?,?,00000031), ref: 004017CD
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\TeamViewer\TVExtractTemp$InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
                                                                                                                                                                                                                                        • API String ID: 1941528284-3531762384
                                                                                                                                                                                                                                        • Opcode ID: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
                                                                                                                                                                                                                                        • Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 636 402d9f-402dae 637 402db0-402db7 636->637 638 402dc8-402dce 636->638 641 402dc0-402dc6 637->641 642 402db9-402dba DestroyWindow 637->642 639 402dd0-402dd6 call 406594 638->639 640 402dd8-402de4 GetTickCount 638->640 645 402e3e-402e40 639->645 644 402de6-402dec 640->644 640->645 641->645 642->641 647 402e1b-402e38 CreateDialogParamW ShowWindow 644->647 648 402dee-402df5 644->648 647->645 648->645 649 402df7-402e14 call 402d83 wsprintfW call 4052dd 648->649 653 402e19 649->653 653->645
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402DD8
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00402E06
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        • CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402E38
                                                                                                                                                                                                                                          • Part of subcall function 00402D83: MulDiv.KERNEL32(00056D4F,00000064,0005783C), ref: 00402D98
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                                                        • API String ID: 722711167-2449383134
                                                                                                                                                                                                                                        • Opcode ID: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
                                                                                                                                                                                                                                        • Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004057AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 654 4057ac-4057f7 CreateDirectoryW 655 4057f9-4057fb 654->655 656 4057fd-40580a GetLastError 654->656 657 405824-405826 655->657 656->657 658 40580c-405820 SetFileSecurityW 656->658 658->655 659 405822 GetLastError 658->659 659->657
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405803
                                                                                                                                                                                                                                        • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405822
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004057D2
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer, xrefs: 004057AC
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer
                                                                                                                                                                                                                                        • API String ID: 3449924974-4254914244
                                                                                                                                                                                                                                        • Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
                                                                                                                                                                                                                                        • Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 660 4064e8-406508 GetSystemDirectoryW 661 40650a 660->661 662 40650c-40650e 660->662 661->662 663 406510-406519 662->663 664 40651f-406521 662->664 663->664 665 40651b-40651d 663->665 666 406522-406555 wsprintfW LoadLibraryExW 664->666 665->666
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 0040653A
                                                                                                                                                                                                                                        • LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                                        • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                                        • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                                        • Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
                                                                                                                                                                                                                                        • Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 667 405d82-405d8e 668 405d8f-405dc3 GetTickCount GetTempFileNameW 667->668 669 405dd2-405dd4 668->669 670 405dc5-405dc7 668->670 672 405dcc-405dcf 669->672 670->668 671 405dc9 670->671 671->672
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00405DA0
                                                                                                                                                                                                                                        • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405DBB
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405D87
                                                                                                                                                                                                                                        • nsa, xrefs: 00405D8F
                                                                                                                                                                                                                                        • "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" , xrefs: 00405D82
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                                        • API String ID: 1716503409-2378697826
                                                                                                                                                                                                                                        • Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
                                                                                                                                                                                                                                        • Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 673 402bff-402c28 RegOpenKeyExW 674 402c93-402c97 673->674 675 402c2a-402c35 673->675 676 402c50-402c60 RegEnumKeyW 675->676 677 402c62-402c74 RegCloseKey call 406558 676->677 678 402c37-402c3a 676->678 686 402c76-402c85 677->686 687 402c9a-402ca0 677->687 679 402c87-402c8a RegCloseKey 678->679 680 402c3c-402c4e call 402bff 678->680 684 402c90-402c92 679->684 680->676 680->677 684->674 686->674 687->684 688 402ca2-402cb0 RegDeleteKeyW 687->688 688->684 689 402cb2 688->689 689->674
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
                                                                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402C65
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402C8A
                                                                                                                                                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1912718029-0
                                                                                                                                                                                                                                        • Opcode ID: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
                                                                                                                                                                                                                                        • Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 691 401bdf-401bf7 call 402ba2 * 2 696 401c03-401c07 691->696 697 401bf9-401c00 call 402bbf 691->697 699 401c13-401c19 696->699 700 401c09-401c10 call 402bbf 696->700 697->696 703 401c1b-401c2f call 402ba2 * 2 699->703 704 401c5f-401c89 call 402bbf * 2 FindWindowExW 699->704 700->699 715 401c31-401c4d SendMessageTimeoutW 703->715 716 401c4f-401c5d SendMessageW 703->716 714 401c8f 704->714 717 401c92-401c95 714->717 715->717 716->714 718 401c9b 717->718 719 402a4c-402a5b 717->719 718->719
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                                        • Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
                                                                                                                                                                                                                                        • Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405C3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405BEB
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405C93
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0), ref: 00405CA3
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                                        • String ID: 4#v.#v$C:\
                                                                                                                                                                                                                                        • API String ID: 3248276644-3425723832
                                                                                                                                                                                                                                        • Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
                                                                                                                                                                                                                                        • Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040604B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Remove folder: ,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406075
                                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406096
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 004060B9
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                        • String ID: Remove folder:
                                                                                                                                                                                                                                        • API String ID: 3677997916-1958208860
                                                                                                                                                                                                                                        • Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
                                                                                                                                                                                                                                        • Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
                                                                                                                                                                                                                                        • RegSetValueExW.KERNELBASE(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1356686001-0
                                                                                                                                                                                                                                        • Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
                                                                                                                                                                                                                                        • Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004038D5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038E7
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038FB
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004038DA
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\, xrefs: 0040390B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\
                                                                                                                                                                                                                                        • API String ID: 2962429428-1303000878
                                                                                                                                                                                                                                        • Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
                                                                                                                                                                                                                                        • Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405BEB
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612
                                                                                                                                                                                                                                          • Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
                                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,C:\Program Files (x86)\TeamViewer\TVExtractTemp,?,00000000,000000F0), ref: 00401645
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Program Files (x86)\TeamViewer\TVExtractTemp, xrefs: 00401638
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\TeamViewer\TVExtractTemp
                                                                                                                                                                                                                                        • API String ID: 1892508949-3084337345
                                                                                                                                                                                                                                        • Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
                                                                                                                                                                                                                                        • Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
                                                                                                                                                                                                                                        • Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
                                                                                                                                                                                                                                        • Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
                                                                                                                                                                                                                                        • Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
                                                                                                                                                                                                                                        • Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
                                                                                                                                                                                                                                        • Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
                                                                                                                                                                                                                                        • Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
                                                                                                                                                                                                                                        • Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403203
                                                                                                                                                                                                                                          • Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(02A37769,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer$CountTick
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1092082344-0
                                                                                                                                                                                                                                        • Opcode ID: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
                                                                                                                                                                                                                                        • Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        • LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 334405425-0
                                                                                                                                                                                                                                        • Opcode ID: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
                                                                                                                                                                                                                                        • Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00401BA7
                                                                                                                                                                                                                                        • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!, xrefs: 00401B5E, 00401B64, 00401B7E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                                                                        • String ID: InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
                                                                                                                                                                                                                                        • API String ID: 3394109436-3224948528
                                                                                                                                                                                                                                        • Opcode ID: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
                                                                                                                                                                                                                                        • Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3109718747-0
                                                                                                                                                                                                                                        • Opcode ID: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
                                                                                                                                                                                                                                        • Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004021EA Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 004064C1: FindFirstFileW.KERNELBASE(?,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0), ref: 004064CC
                                                                                                                                                                                                                                          • Part of subcall function 004064C1: FindClose.KERNEL32(00000000), ref: 004064D8
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32 ref: 0040222A
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000), ref: 00402235
                                                                                                                                                                                                                                        • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 0040225E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1486964399-0
                                                                                                                                                                                                                                        • Opcode ID: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
                                                                                                                                                                                                                                        • Instruction ID: 9c43d8eab5e28b8efadc9e1ada5fd511aa80cab417b32b1cb638ddde26c09318
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4711707190021896CB10EFF98D4999EB7F8AF04314F10807FA905FB2DAE6B8D9018B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
                                                                                                                                                                                                                                        • RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Enum$CloseOpenValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 167947723-0
                                                                                                                                                                                                                                        • Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
                                                                                                                                                                                                                                        • Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
                                                                                                                                                                                                                                          • Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47
                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
                                                                                                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1655745494-0
                                                                                                                                                                                                                                        • Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
                                                                                                                                                                                                                                        • Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040421B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000408,?,00000000,00403E78), ref: 00404239
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID: x
                                                                                                                                                                                                                                        • API String ID: 3850602802-2363233923
                                                                                                                                                                                                                                        • Opcode ID: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
                                                                                                                                                                                                                                        • Instruction ID: 9e34857be529cc3efc5f0a7cea2a0d9e3d50e3e0a723924f26ebfb3191f04208
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78C012B1240200FBCA209B00EE00B167A20F7A8702F2089BDF380200B086718822DB2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                                        • Opcode ID: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
                                                                                                                                                                                                                                        • Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                                                        • Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
                                                                                                                                                                                                                                        • Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                                        • Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
                                                                                                                                                                                                                                        • Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00402347
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                                                                        • Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
                                                                                                                                                                                                                                        • Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004053B0 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 004053C0
                                                                                                                                                                                                                                          • Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0
                                                                                                                                                                                                                                        • OleUninitialize.OLE32(00000404,00000000), ref: 0040540C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: InitializeMessageSendUninitialize
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2896919175-0
                                                                                                                                                                                                                                        • Opcode ID: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
                                                                                                                                                                                                                                        • Instruction ID: fd15c1a48ffcd0bde852b119af7687a848e5b357f1d71b2c4b4b2b4c4c2fcb19
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 55F0F076645601CBD3101B54AD05B5B7268EF80781F56407EEE44A23F1CABA48428B2E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2547128583-0
                                                                                                                                                                                                                                        • Opcode ID: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
                                                                                                                                                                                                                                        • Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
                                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00401DFD
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CallbackDispatcherShowUserWindow
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 82835404-0
                                                                                                                                                                                                                                        • Opcode ID: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
                                                                                                                                                                                                                                        • Instruction ID: 21ddd3577add1129786b8edf5e015a7aca6159172531db4ba1f8ff50d12c07f3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D3E08C326005009BCB20AFB5AA4999D3375EF50369710017BE402F10E1CABC9C408A2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,76233420,00000000,76232EE0,00403909,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 0040394C
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00403953
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1100898210-0
                                                                                                                                                                                                                                        • Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
                                                                                                                                                                                                                                        • Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                                                        • Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
                                                                                                                                                                                                                                        • Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
                                                                                                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                                                        • Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
                                                                                                                                                                                                                                        • Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040582F
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0040583D
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                                                                        • Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
                                                                                                                                                                                                                                        • Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0
                                                                                                                                                                                                                                          • Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointerwsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 327478801-0
                                                                                                                                                                                                                                        • Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
                                                                                                                                                                                                                                        • Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: PrivateProfileStringWrite
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 390214022-0
                                                                                                                                                                                                                                        • Opcode ID: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
                                                                                                                                                                                                                                        • Instruction ID: a822d11f1d05533bca3208a69e79300e3559a9020bae074bf72d5f6ed1f8f9d7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BCE04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00410E86,0040CED0,004032EF,0040CED0,00410E86,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                                                                        • Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
                                                                                                                                                                                                                                        • Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                                                                        • Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
                                                                                                                                                                                                                                        • Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                                                        • Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
                                                                                                                                                                                                                                        • Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004058C3 Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MessageBoxIndirectW.USER32(0040A3E8), ref: 0040591E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: IndirectMessage
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1874166685-0
                                                                                                                                                                                                                                        • Opcode ID: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
                                                                                                                                                                                                                                        • Instruction ID: 321c8730501e623a228f699c15320e1e2f592dc12f854a1532b6ac915461554a
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CCF0F272A10701CBC768CF18EA44B1A3BE0E704304F50817AE854A23B0D77998E2DF1E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: PrivateProfileString
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1096422788-0
                                                                                                                                                                                                                                        • Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
                                                                                                                                                                                                                                        • Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404242 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,?,00000000), ref: 0040425C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ItemText
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3367045223-0
                                                                                                                                                                                                                                        • Opcode ID: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
                                                                                                                                                                                                                                        • Instruction ID: 65f8c73b99d4ee7bdc81e4beaf37a5475fca5134ded6dd21b3b8f91a9c360ad6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2C04C76148200BFE641A755CC42F1FB799EF9431AF40C52EB59CE51D2C63994309A2A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040428E Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                                        • Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
                                                                                                                                                                                                                                        • Instruction ID: 8584b4a80e8197aea4c9dd325401cbfcfbe68695eba590e205f4256e4e85e437
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67C04C71740600BBDA20CB649D45F1677546754740F1448697640A60E0C674D420D62C
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                                        • Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
                                                                                                                                                                                                                                        • Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404277 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                                        • Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
                                                                                                                                                                                                                                        • Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404264 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,0040403C), ref: 0040426E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2492992576-0
                                                                                                                                                                                                                                        • Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
                                                                                                                                                                                                                                        • Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                        Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404C71
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404C7C
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
                                                                                                                                                                                                                                        • LoadBitmapW.USER32(0000006E), ref: 00404CD9
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
                                                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
                                                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00404D4F
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
                                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404EA9
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
                                                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00405079
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00405089
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
                                                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00405228
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00405233
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040523A
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                                                                        • Opcode ID: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
                                                                                                                                                                                                                                        • Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004043DF Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404491
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 004044BF
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 004044E0
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 0040455B
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000), ref: 00404562
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 0040458D
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
                                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 004045E1
                                                                                                                                                                                                                                        • ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
                                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00404602
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00404605
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                                                                        • String ID: N$Remove folder: $VC@$open
                                                                                                                                                                                                                                        • API String ID: 3615053054-2721566001
                                                                                                                                                                                                                                        • Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
                                                                                                                                                                                                                                        • Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                                        • DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                                                                        • Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
                                                                                                                                                                                                                                        • Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004046DD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 0040472C
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 00404756
                                                                                                                                                                                                                                        • SHBrowseForFolderW.SHELL32(?), ref: 00404807
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00404812
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(Remove folder: ,00423728,00000000,?,?), ref: 00404844
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404850
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862
                                                                                                                                                                                                                                          • Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C
                                                                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: (7B$A$C:\Program Files (x86)\TeamViewer$Remove folder:
                                                                                                                                                                                                                                        • API String ID: 2624150263-1696410446
                                                                                                                                                                                                                                        • Opcode ID: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
                                                                                                                                                                                                                                        • Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcpyW.KERNEL32(00426DC8,NUL), ref: 00405EBC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
                                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9
                                                                                                                                                                                                                                          • Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
                                                                                                                                                                                                                                          • Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA
                                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405F24
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
                                                                                                                                                                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0040600D
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                                                                                                                                                                                                        • String ID: %ls=%ls$NUL$[Rename]
                                                                                                                                                                                                                                        • API String ID: 222337774-899692902
                                                                                                                                                                                                                                        • Opcode ID: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
                                                                                                                                                                                                                                        • Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406412 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
                                                                                                                                                                                                                                        • CharNextW.USER32(?,?,?,00000000), ref: 00406484
                                                                                                                                                                                                                                        • CharNextW.USER32(?,00000000,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
                                                                                                                                                                                                                                        • CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • *?|<>/":, xrefs: 00406464
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00406413
                                                                                                                                                                                                                                        • "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" , xrefs: 00406412
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 589700163-3287089449
                                                                                                                                                                                                                                        • Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
                                                                                                                                                                                                                                        • Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 004042C6
                                                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 004042E2
                                                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 004042EE
                                                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 004042FA
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040430D
                                                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 0040431D
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00404337
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00404341
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                                                        • Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
                                                                                                                                                                                                                                        • Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
                                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
                                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1
                                                                                                                                                                                                                                          • Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                                        • String ID: 9
                                                                                                                                                                                                                                        • API String ID: 163830602-2366072709
                                                                                                                                                                                                                                        • Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
                                                                                                                                                                                                                                        • Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
                                                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 00404BCA
                                                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00404BE4
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                                                        • Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
                                                                                                                                                                                                                                        • Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D59
                                                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
                                                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401D86
                                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                                        • String ID: Tahoma
                                                                                                                                                                                                                                        • API String ID: 3808545654-3580928618
                                                                                                                                                                                                                                        • Opcode ID: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
                                                                                                                                                                                                                                        • Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00402D56
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00402D66
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                                        • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                                                        • API String ID: 1451636040-1158693248
                                                                                                                                                                                                                                        • Opcode ID: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
                                                                                                                                                                                                                                        • Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 004028E9
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004028FC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00402914
                                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2667972263-0
                                                                                                                                                                                                                                        • Opcode ID: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
                                                                                                                                                                                                                                        • Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00404B43
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00423728), ref: 00404B56
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: %u.%u%s%s$(7B
                                                                                                                                                                                                                                        • API String ID: 3540041739-1320723960
                                                                                                                                                                                                                                        • Opcode ID: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
                                                                                                                                                                                                                                        • Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00401D00
                                                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401D0D
                                                                                                                                                                                                                                        • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D4B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                                                        • Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
                                                                                                                                                                                                                                        • Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405BDD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405BEB
                                                                                                                                                                                                                                        • CharNextW.USER32(00000000), ref: 00405BF0
                                                                                                                                                                                                                                        • CharNextW.USER32(00000000), ref: 00405C08
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                                                        • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                                        • Opcode ID: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
                                                                                                                                                                                                                                        • Instruction ID: 6e78a38a92844ebddfb5a00e32717de03c0cdfda6ab0f65e84db47d2e3257ff5
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83F0B411949F1D95FF3177584C45A7BA7BCEB55360B00803BEA41B72C1D7B84C818EEA
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405B32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B38
                                                                                                                                                                                                                                        • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B42
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014), ref: 00405B54
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405B32
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                                        • API String ID: 2659869361-3936084776
                                                                                                                                                                                                                                        • Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
                                                                                                                                                                                                                                        • Instruction ID: 1c34604f245f66d13fb295c2dca74b2082213948d97efa3850964b8affffb698
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57D05E31101934AAC2116B448C04DDB73AC9E46304341442AF201B70A6C778695286FD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsj87DF.tmp\), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                          • Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
                                                                                                                                                                                                                                          • Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894
                                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
                                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
                                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3585118688-0
                                                                                                                                                                                                                                        • Opcode ID: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
                                                                                                                                                                                                                                        • Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403C9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,00429240), ref: 00403D35
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: TextWindow
                                                                                                                                                                                                                                        • String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" $1033
                                                                                                                                                                                                                                        • API String ID: 530164218-4070124735
                                                                                                                                                                                                                                        • Opcode ID: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
                                                                                                                                                                                                                                        • Instruction ID: 4786a0dcc4ba2f930af81554b1ec9cb86176e7a1d2ad565e9f211a7c6dcc4e6b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7111C331B44210ABD7359F15EC40A337B6CEF85715B28427BE801AB3A1C63A9D1296A9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00405280
                                                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?), ref: 004052D1
                                                                                                                                                                                                                                          • Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                                        • Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
                                                                                                                                                                                                                                        • Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00405894
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 00405871
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                                        • String ID: Error launching installer
                                                                                                                                                                                                                                        • API String ID: 3712363035-66219284
                                                                                                                                                                                                                                        • Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
                                                                                                                                                                                                                                        • Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\TeamViewer,00402EAD,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00405B84
                                                                                                                                                                                                                                        • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\TeamViewer,00402EAD,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe,80000000,00000003), ref: 00405B94
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\TeamViewer, xrefs: 00405B7E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\TeamViewer
                                                                                                                                                                                                                                        • API String ID: 2709904686-2358812827
                                                                                                                                                                                                                                        • Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
                                                                                                                                                                                                                                        • Instruction ID: 87bbc210c64b19a6b78a00595756172ded5dec919d443e3f73ce50da7c0279be
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4D05EB24009209AD312AB04DD00DAF77ACEF163007464426E841AB166D778BC8186BC
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
                                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 0000000E.00000002.3047304350.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047124866.0000000000400000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047489416.0000000000408000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000040A000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000422000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000425000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.000000000042B000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000430000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3047575365.0000000000435000.00000004.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.0000000000485000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 0000000E.00000002.3048224081.00000000004C7000.00000002.00000001.01000000.00000018.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_14_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                                                        • Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
                                                                                                                                                                                                                                        • Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                                        Execution Coverage:19.9%
                                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                                                                        Total number of Nodes:1344
                                                                                                                                                                                                                                        Total number of Limit Nodes:34
                                                                                                                                                                                                                                        execution_graph 3882 402840 3883 402bbf 18 API calls 3882->3883 3885 40284e 3883->3885 3884 402864 3887 405d2e 2 API calls 3884->3887 3885->3884 3886 402bbf 18 API calls 3885->3886 3886->3884 3888 40286a 3887->3888 3910 405d53 GetFileAttributesW CreateFileW 3888->3910 3890 402877 3891 402883 GlobalAlloc 3890->3891 3892 40291a 3890->3892 3895 402911 CloseHandle 3891->3895 3896 40289c 3891->3896 3893 402922 DeleteFileW 3892->3893 3894 402935 3892->3894 3893->3894 3895->3892 3911 40336e SetFilePointer 3896->3911 3898 4028a2 3899 403358 ReadFile 3898->3899 3900 4028ab GlobalAlloc 3899->3900 3901 4028bb 3900->3901 3902 4028ef 3900->3902 3903 4030e7 45 API calls 3901->3903 3904 405e05 WriteFile 3902->3904 3905 4028c8 3903->3905 3906 4028fb GlobalFree 3904->3906 3908 4028e6 GlobalFree 3905->3908 3907 4030e7 45 API calls 3906->3907 3909 40290e 3907->3909 3908->3902 3909->3895 3910->3890 3911->3898 3912 401cc0 3913 402ba2 18 API calls 3912->3913 3914 401cc7 3913->3914 3915 402ba2 18 API calls 3914->3915 3916 401ccf GetDlgItem 3915->3916 3917 402531 3916->3917 3917->3917 3918 4029c0 3919 402ba2 18 API calls 3918->3919 3920 4029c6 3919->3920 3921 4029f9 3920->3921 3922 40281e 3920->3922 3924 4029d4 3920->3924 3921->3922 3923 4061a0 18 API calls 3921->3923 3923->3922 3924->3922 3926 4060c5 wsprintfW 3924->3926 3926->3922 3101 401fc3 3102 401fd5 3101->3102 3103 402087 3101->3103 3121 402bbf 3102->3121 3106 401423 25 API calls 3103->3106 3112 4021e1 3106->3112 3107 402bbf 18 API calls 3108 401fe5 3107->3108 3109 401ffb LoadLibraryExW 3108->3109 3110 401fed GetModuleHandleW 3108->3110 3109->3103 3111 40200c 3109->3111 3110->3109 3110->3111 3127 4065c7 WideCharToMultiByte 3111->3127 3115 402056 3133 4052dd 3115->3133 3116 40201d 3119 40202d 3116->3119 3130 401423 3116->3130 3119->3112 3120 402079 FreeLibrary 3119->3120 3120->3112 3122 402bcb 3121->3122 3144 4061a0 3122->3144 3125 401fdc 3125->3107 3128 4065f1 GetProcAddress 3127->3128 3129 402017 3127->3129 3128->3129 3129->3115 3129->3116 3131 4052dd 25 API calls 3130->3131 3132 401431 3131->3132 3132->3119 3134 4052f8 3133->3134 3135 40539a 3133->3135 3136 405314 lstrlenW 3134->3136 3137 4061a0 18 API calls 3134->3137 3135->3119 3138 405322 lstrlenW 3136->3138 3139 40533d 3136->3139 3137->3136 3138->3135 3140 405334 lstrcatW 3138->3140 3141 405350 3139->3141 3142 405343 SetWindowTextW 3139->3142 3140->3139 3141->3135 3143 405356 SendMessageW SendMessageW SendMessageW 3141->3143 3142->3141 3143->3135 3149 4061ad 3144->3149 3145 4063f8 3146 402bec 3145->3146 3178 40617e lstrcpynW 3145->3178 3146->3125 3162 406412 3146->3162 3148 406260 GetVersion 3148->3149 3149->3145 3149->3148 3150 4063c6 lstrlenW 3149->3150 3151 4061a0 10 API calls 3149->3151 3154 4062db GetSystemDirectoryW 3149->3154 3156 4062ee GetWindowsDirectoryW 3149->3156 3157 406412 5 API calls 3149->3157 3158 4061a0 10 API calls 3149->3158 3159 406367 lstrcatW 3149->3159 3160 406322 SHGetSpecialFolderLocation 3149->3160 3171 40604b RegOpenKeyExW 3149->3171 3176 4060c5 wsprintfW 3149->3176 3177 40617e lstrcpynW 3149->3177 3150->3149 3151->3150 3154->3149 3156->3149 3157->3149 3158->3149 3159->3149 3160->3149 3161 40633a SHGetPathFromIDListW CoTaskMemFree 3160->3161 3161->3149 3163 40641f 3162->3163 3165 406495 3163->3165 3166 406488 CharNextW 3163->3166 3169 406474 CharNextW 3163->3169 3170 406483 CharNextW 3163->3170 3179 405b5f 3163->3179 3164 40649a CharPrevW 3164->3165 3165->3164 3167 4064bb 3165->3167 3166->3163 3166->3165 3167->3125 3169->3163 3170->3166 3172 4060bf 3171->3172 3173 40607f RegQueryValueExW 3171->3173 3172->3149 3174 4060a0 RegCloseKey 3173->3174 3174->3172 3176->3149 3177->3149 3178->3146 3180 405b65 3179->3180 3181 405b7b 3180->3181 3182 405b6c CharNextW 3180->3182 3181->3163 3182->3180 3927 4016c4 3928 402bbf 18 API calls 3927->3928 3929 4016ca GetFullPathNameW 3928->3929 3932 4016e4 3929->3932 3936 401706 3929->3936 3930 40171b GetShortPathNameW 3931 402a4c 3930->3931 3933 4064c1 2 API calls 3932->3933 3932->3936 3934 4016f6 3933->3934 3934->3936 3937 40617e lstrcpynW 3934->3937 3936->3930 3936->3931 3937->3936 3938 406846 3944 4066ca 3938->3944 3939 407035 3940 406754 GlobalAlloc 3940->3939 3940->3944 3941 40674b GlobalFree 3941->3940 3942 4067c2 GlobalFree 3943 4067cb GlobalAlloc 3942->3943 3943->3939 3943->3944 3944->3939 3944->3940 3944->3941 3944->3942 3944->3943 3355 4027ce 3356 4027d6 3355->3356 3357 4027da FindNextFileW 3356->3357 3359 4027ec 3356->3359 3358 402833 3357->3358 3357->3359 3361 40617e lstrcpynW 3358->3361 3361->3359 3948 40194e 3949 402bbf 18 API calls 3948->3949 3950 401955 lstrlenW 3949->3950 3951 402531 3950->3951 3959 405251 3960 405261 3959->3960 3961 405275 3959->3961 3962 405267 3960->3962 3971 4052be 3960->3971 3963 40527d IsWindowVisible 3961->3963 3969 405294 3961->3969 3964 40428e SendMessageW 3962->3964 3965 40528a 3963->3965 3963->3971 3967 405271 3964->3967 3972 404ba7 SendMessageW 3965->3972 3966 4052c3 CallWindowProcW 3966->3967 3969->3966 3977 404c27 3969->3977 3971->3966 3973 404c06 SendMessageW 3972->3973 3974 404bca GetMessagePos ScreenToClient SendMessageW 3972->3974 3976 404bfe 3973->3976 3975 404c03 3974->3975 3974->3976 3975->3973 3976->3969 3986 40617e lstrcpynW 3977->3986 3979 404c3a 3987 4060c5 wsprintfW 3979->3987 3981 404c44 3982 40140b 2 API calls 3981->3982 3983 404c4d 3982->3983 3988 40617e lstrcpynW 3983->3988 3985 404c54 3985->3971 3986->3979 3987->3981 3988->3985 3415 401754 3416 402bbf 18 API calls 3415->3416 3417 40175b 3416->3417 3421 405d82 3417->3421 3419 401762 3420 405d82 2 API calls 3419->3420 3420->3419 3422 405d8f GetTickCount GetTempFileNameW 3421->3422 3423 405dc9 3422->3423 3424 405dc5 3422->3424 3423->3419 3424->3422 3424->3423 3425 4038d5 3426 4038f0 3425->3426 3427 4038e6 CloseHandle 3425->3427 3428 403904 3426->3428 3429 4038fa CloseHandle 3426->3429 3427->3426 3434 403932 3428->3434 3429->3428 3435 403940 3434->3435 3436 403909 3435->3436 3437 403945 FreeLibrary GlobalFree 3435->3437 3438 40596f 3436->3438 3437->3436 3437->3437 3474 405c3a 3438->3474 3441 405997 DeleteFileW 3471 403915 3441->3471 3442 4059ae 3443 405ace 3442->3443 3488 40617e lstrcpynW 3442->3488 3450 4064c1 2 API calls 3443->3450 3443->3471 3445 4059d4 3446 4059e7 3445->3446 3447 4059da lstrcatW 3445->3447 3489 405b7e lstrlenW 3446->3489 3448 4059ed 3447->3448 3451 4059fd lstrcatW 3448->3451 3453 405a08 lstrlenW FindFirstFileW 3448->3453 3452 405af3 3450->3452 3451->3453 3455 405b32 3 API calls 3452->3455 3452->3471 3453->3443 3454 405a2a 3453->3454 3457 405ab1 FindNextFileW 3454->3457 3466 40596f 62 API calls 3454->3466 3470 4052dd 25 API calls 3454->3470 3472 4052dd 25 API calls 3454->3472 3473 40601f 38 API calls 3454->3473 3493 40617e lstrcpynW 3454->3493 3494 405927 3454->3494 3456 405afd 3455->3456 3458 405927 5 API calls 3456->3458 3457->3454 3461 405ac7 FindClose 3457->3461 3460 405b09 3458->3460 3462 405b23 3460->3462 3465 405b0d 3460->3465 3461->3443 3464 4052dd 25 API calls 3462->3464 3464->3471 3467 4052dd 25 API calls 3465->3467 3465->3471 3466->3454 3468 405b1a 3467->3468 3469 40601f 38 API calls 3468->3469 3469->3471 3470->3457 3472->3454 3473->3454 3502 40617e lstrcpynW 3474->3502 3476 405c4b 3503 405bdd CharNextW CharNextW 3476->3503 3479 40598f 3479->3441 3479->3442 3480 406412 5 API calls 3486 405c61 3480->3486 3481 405c92 lstrlenW 3482 405c9d 3481->3482 3481->3486 3483 405b32 3 API calls 3482->3483 3485 405ca2 GetFileAttributesW 3483->3485 3484 4064c1 2 API calls 3484->3486 3485->3479 3486->3479 3486->3481 3486->3484 3487 405b7e 2 API calls 3486->3487 3487->3481 3488->3445 3490 405b8c 3489->3490 3491 405b92 CharPrevW 3490->3491 3492 405b9e 3490->3492 3491->3490 3491->3492 3492->3448 3493->3454 3495 405d2e 2 API calls 3494->3495 3496 405933 3495->3496 3497 405954 3496->3497 3498 405942 RemoveDirectoryW 3496->3498 3499 40594a DeleteFileW 3496->3499 3497->3454 3500 405950 3498->3500 3499->3500 3500->3497 3501 405960 SetFileAttributesW 3500->3501 3501->3497 3502->3476 3505 405c0c 3503->3505 3506 405bfa 3503->3506 3504 405c30 3504->3479 3504->3480 3505->3504 3508 405b5f CharNextW 3505->3508 3506->3505 3507 405c07 CharNextW 3506->3507 3507->3504 3508->3505 3989 404356 lstrcpynW lstrlenW 3990 401d56 GetDC GetDeviceCaps 3991 402ba2 18 API calls 3990->3991 3992 401d74 MulDiv ReleaseDC 3991->3992 3993 402ba2 18 API calls 3992->3993 3994 401d93 3993->3994 3995 4061a0 18 API calls 3994->3995 3996 401dcc CreateFontIndirectW 3995->3996 3997 402531 3996->3997 3998 401a57 3999 402ba2 18 API calls 3998->3999 4000 401a5d 3999->4000 4001 402ba2 18 API calls 4000->4001 4002 401a05 4001->4002 4003 4014d7 4004 402ba2 18 API calls 4003->4004 4005 4014dd Sleep 4004->4005 4007 402a4c 4005->4007 4008 404c59 GetDlgItem GetDlgItem 4009 404cab 7 API calls 4008->4009 4016 404ec4 4008->4016 4010 404d41 SendMessageW 4009->4010 4011 404d4e DeleteObject 4009->4011 4010->4011 4012 404d57 4011->4012 4014 404d8e 4012->4014 4015 4061a0 18 API calls 4012->4015 4013 404fa8 4018 405054 4013->4018 4028 405001 SendMessageW 4013->4028 4048 404eb7 4013->4048 4059 404242 4014->4059 4019 404d70 SendMessageW SendMessageW 4015->4019 4016->4013 4026 404ba7 5 API calls 4016->4026 4051 404f35 4016->4051 4020 405066 4018->4020 4021 40505e SendMessageW 4018->4021 4019->4012 4025 40508f 4020->4025 4030 405078 ImageList_Destroy 4020->4030 4031 40507f 4020->4031 4021->4020 4022 404da2 4027 404242 19 API calls 4022->4027 4024 404f9a SendMessageW 4024->4013 4033 4051fe 4025->4033 4047 404c27 4 API calls 4025->4047 4055 4050ca 4025->4055 4026->4051 4032 404db0 4027->4032 4034 405016 SendMessageW 4028->4034 4028->4048 4030->4031 4031->4025 4035 405088 GlobalFree 4031->4035 4036 404e85 GetWindowLongW SetWindowLongW 4032->4036 4043 404e7f 4032->4043 4046 404e00 SendMessageW 4032->4046 4049 404e3c SendMessageW 4032->4049 4050 404e4d SendMessageW 4032->4050 4038 405210 ShowWindow GetDlgItem ShowWindow 4033->4038 4033->4048 4037 405029 4034->4037 4035->4025 4039 404e9e 4036->4039 4042 40503a SendMessageW 4037->4042 4038->4048 4040 404ea4 ShowWindow 4039->4040 4041 404ebc 4039->4041 4062 404277 SendMessageW 4040->4062 4063 404277 SendMessageW 4041->4063 4042->4018 4043->4036 4043->4039 4046->4032 4047->4055 4067 4042a9 4048->4067 4049->4032 4050->4032 4051->4013 4051->4024 4052 4051d4 InvalidateRect 4052->4033 4053 4051ea 4052->4053 4064 404b62 4053->4064 4054 4050f8 SendMessageW 4058 40510e 4054->4058 4055->4054 4055->4058 4057 405182 SendMessageW SendMessageW 4057->4058 4058->4052 4058->4057 4060 4061a0 18 API calls 4059->4060 4061 40424d SetDlgItemTextW 4060->4061 4061->4022 4062->4048 4063->4016 4081 404a99 4064->4081 4066 404b77 4066->4033 4068 4042c1 GetWindowLongW 4067->4068 4078 40434a 4067->4078 4069 4042d2 4068->4069 4068->4078 4070 4042e1 GetSysColor 4069->4070 4071 4042e4 4069->4071 4070->4071 4072 4042f4 SetBkMode 4071->4072 4073 4042ea SetTextColor 4071->4073 4074 404312 4072->4074 4075 40430c GetSysColor 4072->4075 4073->4072 4076 404319 SetBkColor 4074->4076 4077 404323 4074->4077 4075->4074 4076->4077 4077->4078 4079 404336 DeleteObject 4077->4079 4080 40433d CreateBrushIndirect 4077->4080 4079->4080 4080->4078 4082 404ab2 4081->4082 4083 4061a0 18 API calls 4082->4083 4084 404b16 4083->4084 4085 4061a0 18 API calls 4084->4085 4086 404b21 4085->4086 4087 4061a0 18 API calls 4086->4087 4088 404b37 lstrlenW wsprintfW SetDlgItemTextW 4087->4088 4088->4066 4089 40155b 4090 4029f2 4089->4090 4093 4060c5 wsprintfW 4090->4093 4092 4029f7 4093->4092 4094 401ddc 4095 402ba2 18 API calls 4094->4095 4096 401de2 4095->4096 4097 402ba2 18 API calls 4096->4097 4098 401deb 4097->4098 4099 401df2 ShowWindow 4098->4099 4100 401dfd EnableWindow 4098->4100 4101 402a4c 4099->4101 4100->4101 4102 4046dd 4103 404709 4102->4103 4104 40471a 4102->4104 4163 4058a7 GetDlgItemTextW 4103->4163 4106 404726 GetDlgItem 4104->4106 4112 404785 4104->4112 4107 40473a 4106->4107 4111 40474e SetWindowTextW 4107->4111 4115 405bdd 4 API calls 4107->4115 4108 404869 4161 404a18 4108->4161 4165 4058a7 GetDlgItemTextW 4108->4165 4109 404714 4110 406412 5 API calls 4109->4110 4110->4104 4116 404242 19 API calls 4111->4116 4112->4108 4117 4061a0 18 API calls 4112->4117 4112->4161 4114 4042a9 8 API calls 4119 404a2c 4114->4119 4120 404744 4115->4120 4121 40476a 4116->4121 4122 4047f9 SHBrowseForFolderW 4117->4122 4118 404899 4123 405c3a 18 API calls 4118->4123 4120->4111 4127 405b32 3 API calls 4120->4127 4124 404242 19 API calls 4121->4124 4122->4108 4125 404811 CoTaskMemFree 4122->4125 4126 40489f 4123->4126 4128 404778 4124->4128 4129 405b32 3 API calls 4125->4129 4166 40617e lstrcpynW 4126->4166 4127->4111 4164 404277 SendMessageW 4128->4164 4131 40481e 4129->4131 4134 404855 SetDlgItemTextW 4131->4134 4138 4061a0 18 API calls 4131->4138 4133 40477e 4136 406558 5 API calls 4133->4136 4134->4108 4135 4048b6 4137 406558 5 API calls 4135->4137 4136->4112 4149 4048bd 4137->4149 4139 40483d lstrcmpiW 4138->4139 4139->4134 4141 40484e lstrcatW 4139->4141 4140 4048fe 4167 40617e lstrcpynW 4140->4167 4141->4134 4143 404905 4144 405bdd 4 API calls 4143->4144 4145 40490b GetDiskFreeSpaceW 4144->4145 4147 40492f MulDiv 4145->4147 4150 404956 4145->4150 4147->4150 4148 405b7e 2 API calls 4148->4149 4149->4140 4149->4148 4149->4150 4151 4049c7 4150->4151 4153 404b62 21 API calls 4150->4153 4152 4049ea 4151->4152 4154 40140b 2 API calls 4151->4154 4168 404264 EnableWindow 4152->4168 4155 4049b4 4153->4155 4154->4152 4157 4049c9 SetDlgItemTextW 4155->4157 4158 4049b9 4155->4158 4157->4151 4159 404a99 21 API calls 4158->4159 4159->4151 4160 404a06 4160->4161 4169 404672 4160->4169 4161->4114 4163->4109 4164->4133 4165->4118 4166->4135 4167->4143 4168->4160 4170 404680 4169->4170 4171 404685 SendMessageW 4169->4171 4170->4171 4171->4161 3850 4022df 3851 402bbf 18 API calls 3850->3851 3852 4022ee 3851->3852 3853 402bbf 18 API calls 3852->3853 3854 4022f7 3853->3854 3855 402bbf 18 API calls 3854->3855 3856 402301 GetPrivateProfileStringW 3855->3856 4172 4043df 4174 4043f7 4172->4174 4177 404511 4172->4177 4173 40457b 4175 404585 GetDlgItem 4173->4175 4176 40464d 4173->4176 4178 404242 19 API calls 4174->4178 4179 40460e 4175->4179 4180 40459f 4175->4180 4183 4042a9 8 API calls 4176->4183 4177->4173 4177->4176 4181 40454c GetDlgItem SendMessageW 4177->4181 4182 40445e 4178->4182 4179->4176 4188 404620 4179->4188 4180->4179 4187 4045c5 6 API calls 4180->4187 4203 404264 EnableWindow 4181->4203 4185 404242 19 API calls 4182->4185 4186 404648 4183->4186 4190 40446b CheckDlgButton 4185->4190 4187->4179 4191 404636 4188->4191 4192 404626 SendMessageW 4188->4192 4189 404576 4193 404672 SendMessageW 4189->4193 4201 404264 EnableWindow 4190->4201 4191->4186 4195 40463c SendMessageW 4191->4195 4192->4191 4193->4173 4195->4186 4196 404489 GetDlgItem 4202 404277 SendMessageW 4196->4202 4198 40449f SendMessageW 4199 4044c5 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4198->4199 4200 4044bc GetSysColor 4198->4200 4199->4186 4200->4199 4201->4196 4202->4198 4203->4189 4204 401bdf 4205 402ba2 18 API calls 4204->4205 4206 401be6 4205->4206 4207 402ba2 18 API calls 4206->4207 4208 401bf0 4207->4208 4209 401c00 4208->4209 4210 402bbf 18 API calls 4208->4210 4211 401c10 4209->4211 4212 402bbf 18 API calls 4209->4212 4210->4209 4213 401c1b 4211->4213 4214 401c5f 4211->4214 4212->4211 4215 402ba2 18 API calls 4213->4215 4216 402bbf 18 API calls 4214->4216 4217 401c20 4215->4217 4218 401c64 4216->4218 4219 402ba2 18 API calls 4217->4219 4220 402bbf 18 API calls 4218->4220 4221 401c29 4219->4221 4222 401c6d FindWindowExW 4220->4222 4223 401c31 SendMessageTimeoutW 4221->4223 4224 401c4f SendMessageW 4221->4224 4225 401c8f 4222->4225 4223->4225 4224->4225 4226 401960 4227 402ba2 18 API calls 4226->4227 4228 401967 4227->4228 4229 402ba2 18 API calls 4228->4229 4230 401971 4229->4230 4231 402bbf 18 API calls 4230->4231 4232 40197a 4231->4232 4233 40198e lstrlenW 4232->4233 4234 4019ca 4232->4234 4235 401998 4233->4235 4235->4234 4239 40617e lstrcpynW 4235->4239 4237 4019b3 4237->4234 4238 4019c0 lstrlenW 4237->4238 4238->4234 4239->4237 4240 401662 4241 402bbf 18 API calls 4240->4241 4242 401668 4241->4242 4243 4064c1 2 API calls 4242->4243 4244 40166e 4243->4244 4245 4019e4 4246 402bbf 18 API calls 4245->4246 4247 4019eb 4246->4247 4248 402bbf 18 API calls 4247->4248 4249 4019f4 4248->4249 4250 4019fb lstrcmpiW 4249->4250 4251 401a0d lstrcmpW 4249->4251 4252 401a01 4250->4252 4251->4252 4253 4025e5 4254 402ba2 18 API calls 4253->4254 4256 4025f4 4254->4256 4255 40272d 4256->4255 4257 40263a ReadFile 4256->4257 4258 405dd6 ReadFile 4256->4258 4259 40267a MultiByteToWideChar 4256->4259 4260 40272f 4256->4260 4261 405e34 5 API calls 4256->4261 4263 4026a0 SetFilePointer MultiByteToWideChar 4256->4263 4264 402740 4256->4264 4257->4255 4257->4256 4258->4256 4259->4256 4266 4060c5 wsprintfW 4260->4266 4261->4256 4263->4256 4264->4255 4265 402761 SetFilePointer 4264->4265 4265->4255 4266->4255 3183 401e66 3184 402bbf 18 API calls 3183->3184 3185 401e6c 3184->3185 3186 4052dd 25 API calls 3185->3186 3187 401e76 3186->3187 3200 40585e CreateProcessW 3187->3200 3190 40281e 3191 401edb FindCloseChangeNotification 3191->3190 3192 401e8c WaitForSingleObject 3193 401e9e 3192->3193 3194 401eb0 GetExitCodeProcess 3193->3194 3203 406594 3193->3203 3195 401ec2 3194->3195 3196 401ecd 3194->3196 3207 4060c5 wsprintfW 3195->3207 3196->3191 3201 405891 CloseHandle 3200->3201 3202 401e7c 3200->3202 3201->3202 3202->3190 3202->3191 3202->3192 3204 4065b1 PeekMessageW 3203->3204 3205 401ea5 WaitForSingleObject 3204->3205 3206 4065a7 DispatchMessageW 3204->3206 3205->3193 3206->3204 3207->3196 3220 401767 3221 402bbf 18 API calls 3220->3221 3222 40176e 3221->3222 3223 401796 3222->3223 3224 40178e 3222->3224 3275 40617e lstrcpynW 3223->3275 3274 40617e lstrcpynW 3224->3274 3227 4017a1 3276 405b32 lstrlenW CharPrevW 3227->3276 3228 401794 3231 406412 5 API calls 3228->3231 3241 4017b3 3231->3241 3235 4017c5 CompareFileTime 3235->3241 3236 401885 3237 4052dd 25 API calls 3236->3237 3239 40188f 3237->3239 3238 4052dd 25 API calls 3240 401871 3238->3240 3259 4030e7 3239->3259 3241->3235 3241->3236 3245 4061a0 18 API calls 3241->3245 3250 40617e lstrcpynW 3241->3250 3257 40185c 3241->3257 3258 405d53 GetFileAttributesW CreateFileW 3241->3258 3279 4064c1 FindFirstFileW 3241->3279 3282 405d2e GetFileAttributesW 3241->3282 3285 4058c3 3241->3285 3244 4018b6 SetFileTime 3246 4018c8 FindCloseChangeNotification 3244->3246 3245->3241 3246->3240 3247 4018d9 3246->3247 3248 4018f1 3247->3248 3249 4018de 3247->3249 3252 4061a0 18 API calls 3248->3252 3251 4061a0 18 API calls 3249->3251 3250->3241 3253 4018e6 lstrcatW 3251->3253 3254 4018f9 3252->3254 3253->3254 3256 4058c3 MessageBoxIndirectW 3254->3256 3256->3240 3257->3238 3257->3240 3258->3241 3260 403112 3259->3260 3261 4030f6 SetFilePointer 3259->3261 3289 4031ef GetTickCount 3260->3289 3261->3260 3266 4031ef 43 API calls 3267 403149 3266->3267 3268 4031b5 ReadFile 3267->3268 3271 403158 3267->3271 3273 4018a2 3267->3273 3268->3273 3270 405dd6 ReadFile 3270->3271 3271->3270 3271->3273 3304 405e05 WriteFile 3271->3304 3273->3244 3273->3246 3274->3228 3275->3227 3277 4017a7 lstrcatW 3276->3277 3278 405b4e lstrcatW 3276->3278 3277->3228 3278->3277 3280 4064e2 3279->3280 3281 4064d7 FindClose 3279->3281 3280->3241 3281->3280 3283 405d40 SetFileAttributesW 3282->3283 3284 405d4d 3282->3284 3283->3284 3284->3241 3286 4058d8 3285->3286 3287 405924 3286->3287 3288 4058ec MessageBoxIndirectW 3286->3288 3287->3241 3288->3287 3290 403347 3289->3290 3291 40321d 3289->3291 3292 402d9f 33 API calls 3290->3292 3306 40336e SetFilePointer 3291->3306 3298 403119 3292->3298 3294 403228 SetFilePointer 3300 40324d 3294->3300 3298->3273 3302 405dd6 ReadFile 3298->3302 3299 405e05 WriteFile 3299->3300 3300->3298 3300->3299 3301 403328 SetFilePointer 3300->3301 3307 403358 3300->3307 3310 406697 3300->3310 3317 402d9f 3300->3317 3301->3290 3303 403132 3302->3303 3303->3266 3303->3273 3305 405e23 3304->3305 3305->3271 3306->3294 3308 405dd6 ReadFile 3307->3308 3309 40336b 3308->3309 3309->3300 3311 4066bc 3310->3311 3316 4066c4 3310->3316 3311->3300 3312 406754 GlobalAlloc 3312->3311 3312->3316 3313 40674b GlobalFree 3313->3312 3314 4067c2 GlobalFree 3315 4067cb GlobalAlloc 3314->3315 3315->3311 3315->3316 3316->3311 3316->3312 3316->3313 3316->3314 3316->3315 3318 402db0 3317->3318 3319 402dc8 3317->3319 3320 402db9 DestroyWindow 3318->3320 3324 402dc0 3318->3324 3321 402dd0 3319->3321 3322 402dd8 GetTickCount 3319->3322 3320->3324 3325 406594 2 API calls 3321->3325 3323 402de6 3322->3323 3322->3324 3326 402e1b CreateDialogParamW ShowWindow 3323->3326 3327 402dee 3323->3327 3324->3300 3325->3324 3326->3324 3327->3324 3332 402d83 3327->3332 3329 402dfc wsprintfW 3330 4052dd 25 API calls 3329->3330 3331 402e19 3330->3331 3331->3324 3333 402d92 3332->3333 3334 402d94 MulDiv 3332->3334 3333->3334 3334->3329 4274 401ee9 4275 402bbf 18 API calls 4274->4275 4276 401ef0 4275->4276 4277 4064c1 2 API calls 4276->4277 4278 401ef6 4277->4278 4280 401f07 4278->4280 4281 4060c5 wsprintfW 4278->4281 4281->4280 4282 403d6a 4283 403d82 4282->4283 4284 403ebd 4282->4284 4283->4284 4285 403d8e 4283->4285 4286 403f0e 4284->4286 4287 403ece GetDlgItem GetDlgItem 4284->4287 4288 403d99 SetWindowPos 4285->4288 4289 403dac 4285->4289 4291 403f68 4286->4291 4299 401389 2 API calls 4286->4299 4290 404242 19 API calls 4287->4290 4288->4289 4293 403db1 ShowWindow 4289->4293 4294 403dc9 4289->4294 4295 403ef8 SetClassLongW 4290->4295 4292 40428e SendMessageW 4291->4292 4310 403eb8 4291->4310 4339 403f7a 4292->4339 4293->4294 4296 403dd1 DestroyWindow 4294->4296 4297 403deb 4294->4297 4298 40140b 2 API calls 4295->4298 4349 4041cb 4296->4349 4300 403df0 SetWindowLongW 4297->4300 4301 403e01 4297->4301 4298->4286 4302 403f40 4299->4302 4300->4310 4305 403e0d GetDlgItem 4301->4305 4319 403e78 4301->4319 4302->4291 4306 403f44 SendMessageW 4302->4306 4303 40140b 2 API calls 4303->4339 4304 4041cd DestroyWindow EndDialog 4304->4349 4309 403e20 SendMessageW IsWindowEnabled 4305->4309 4312 403e3d 4305->4312 4306->4310 4307 4042a9 8 API calls 4307->4310 4308 4041fc ShowWindow 4308->4310 4309->4310 4309->4312 4311 4061a0 18 API calls 4311->4339 4313 403e4a 4312->4313 4314 403e91 SendMessageW 4312->4314 4315 403e5d 4312->4315 4323 403e42 4312->4323 4313->4314 4313->4323 4314->4319 4317 403e65 4315->4317 4318 403e7a 4315->4318 4320 40140b 2 API calls 4317->4320 4321 40140b 2 API calls 4318->4321 4319->4307 4320->4323 4321->4323 4322 404242 19 API calls 4322->4339 4323->4319 4350 40421b 4323->4350 4324 404242 19 API calls 4325 403ff5 GetDlgItem 4324->4325 4326 404012 ShowWindow EnableWindow 4325->4326 4327 40400a 4325->4327 4353 404264 EnableWindow 4326->4353 4327->4326 4329 40403c EnableWindow 4332 404050 4329->4332 4330 404055 GetSystemMenu EnableMenuItem SendMessageW 4331 404085 SendMessageW 4330->4331 4330->4332 4331->4332 4332->4330 4354 404277 SendMessageW 4332->4354 4355 40617e lstrcpynW 4332->4355 4335 4040b3 lstrlenW 4336 4061a0 18 API calls 4335->4336 4337 4040c9 SetWindowTextW 4336->4337 4338 401389 2 API calls 4337->4338 4338->4339 4339->4303 4339->4304 4339->4310 4339->4311 4339->4322 4339->4324 4340 40410d DestroyWindow 4339->4340 4341 404127 CreateDialogParamW 4340->4341 4340->4349 4342 40415a 4341->4342 4341->4349 4343 404242 19 API calls 4342->4343 4344 404165 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4343->4344 4345 401389 2 API calls 4344->4345 4346 4041ab 4345->4346 4346->4310 4347 4041b3 ShowWindow 4346->4347 4348 40428e SendMessageW 4347->4348 4348->4349 4349->4308 4349->4310 4351 404222 4350->4351 4352 404228 SendMessageW 4350->4352 4351->4352 4352->4319 4353->4329 4354->4332 4355->4335 4356 4021ea 4357 402bbf 18 API calls 4356->4357 4358 4021f0 4357->4358 4359 402bbf 18 API calls 4358->4359 4360 4021f9 4359->4360 4361 402bbf 18 API calls 4360->4361 4362 402202 4361->4362 4363 4064c1 2 API calls 4362->4363 4364 40220b 4363->4364 4365 40221c lstrlenW lstrlenW 4364->4365 4366 40220f 4364->4366 4368 4052dd 25 API calls 4365->4368 4367 4052dd 25 API calls 4366->4367 4370 402217 4366->4370 4367->4370 4369 40225a SHFileOperationW 4368->4369 4369->4366 4369->4370 4371 40156b 4372 401584 4371->4372 4373 40157b ShowWindow 4371->4373 4374 401592 ShowWindow 4372->4374 4375 402a4c 4372->4375 4373->4372 4374->4375 4376 40226e 4377 402275 4376->4377 4381 402288 4376->4381 4378 4061a0 18 API calls 4377->4378 4379 402282 4378->4379 4380 4058c3 MessageBoxIndirectW 4379->4380 4380->4381 4382 4014f1 SetForegroundWindow 4383 402a4c 4382->4383 3362 401673 3363 402bbf 18 API calls 3362->3363 3364 40167a 3363->3364 3365 402bbf 18 API calls 3364->3365 3366 401683 3365->3366 3367 402bbf 18 API calls 3366->3367 3368 40168c MoveFileW 3367->3368 3369 40169f 3368->3369 3375 401698 3368->3375 3370 4064c1 2 API calls 3369->3370 3373 4021e1 3369->3373 3372 4016ae 3370->3372 3371 401423 25 API calls 3371->3373 3372->3373 3376 40601f MoveFileExW 3372->3376 3375->3371 3377 406042 3376->3377 3378 406033 3376->3378 3377->3375 3381 405ead lstrcpyW 3378->3381 3382 405ed5 3381->3382 3383 405efb GetShortPathNameW 3381->3383 3408 405d53 GetFileAttributesW CreateFileW 3382->3408 3384 405f10 3383->3384 3385 40601a 3383->3385 3384->3385 3387 405f18 wsprintfA 3384->3387 3385->3377 3390 4061a0 18 API calls 3387->3390 3388 405edf CloseHandle GetShortPathNameW 3388->3385 3389 405ef3 3388->3389 3389->3383 3389->3385 3391 405f40 3390->3391 3409 405d53 GetFileAttributesW CreateFileW 3391->3409 3393 405f4d 3393->3385 3394 405f5c GetFileSize GlobalAlloc 3393->3394 3395 406013 CloseHandle 3394->3395 3396 405f7e 3394->3396 3395->3385 3397 405dd6 ReadFile 3396->3397 3398 405f86 3397->3398 3398->3395 3410 405cb8 lstrlenA 3398->3410 3401 405fb1 3403 405cb8 4 API calls 3401->3403 3402 405f9d lstrcpyA 3404 405fbf 3402->3404 3403->3404 3405 405ff6 SetFilePointer 3404->3405 3406 405e05 WriteFile 3405->3406 3407 40600c GlobalFree 3406->3407 3407->3395 3408->3388 3409->3393 3411 405cf9 lstrlenA 3410->3411 3412 405d01 3411->3412 3413 405cd2 lstrcmpiA 3411->3413 3412->3401 3412->3402 3413->3412 3414 405cf0 CharNextA 3413->3414 3414->3411 4384 401cfa GetDlgItem GetClientRect 4385 402bbf 18 API calls 4384->4385 4386 401d2c LoadImageW SendMessageW 4385->4386 4387 401d4a DeleteObject 4386->4387 4388 402a4c 4386->4388 4387->4388 3830 4027fb 3831 402bbf 18 API calls 3830->3831 3832 402802 FindFirstFileW 3831->3832 3833 40282a 3832->3833 3836 402815 3832->3836 3834 402833 3833->3834 3838 4060c5 wsprintfW 3833->3838 3839 40617e lstrcpynW 3834->3839 3838->3834 3839->3836 4389 40237b 4390 402381 4389->4390 4391 402bbf 18 API calls 4390->4391 4392 402393 4391->4392 4393 402bbf 18 API calls 4392->4393 4394 40239d RegCreateKeyExW 4393->4394 4395 4023c7 4394->4395 4399 402a4c 4394->4399 4396 4023e2 4395->4396 4397 402bbf 18 API calls 4395->4397 4398 4023ee 4396->4398 4401 402ba2 18 API calls 4396->4401 4400 4023d8 lstrlenW 4397->4400 4402 402409 RegSetValueExW 4398->4402 4403 4030e7 45 API calls 4398->4403 4400->4396 4401->4398 4404 40241f RegCloseKey 4402->4404 4403->4402 4404->4399 4420 4014ff 4421 401507 4420->4421 4423 40151a 4420->4423 4422 402ba2 18 API calls 4421->4422 4422->4423 4424 401000 4425 401037 BeginPaint GetClientRect 4424->4425 4427 40100c DefWindowProcW 4424->4427 4428 4010f3 4425->4428 4431 401179 4427->4431 4429 401073 CreateBrushIndirect FillRect DeleteObject 4428->4429 4430 4010fc 4428->4430 4429->4428 4432 401102 CreateFontIndirectW 4430->4432 4433 401167 EndPaint 4430->4433 4432->4433 4434 401112 6 API calls 4432->4434 4433->4431 4434->4433 4442 401904 4443 40193b 4442->4443 4444 402bbf 18 API calls 4443->4444 4445 401940 4444->4445 4446 40596f 69 API calls 4445->4446 4447 401949 4446->4447 4448 402d04 4449 402d16 SetTimer 4448->4449 4450 402d2f 4448->4450 4449->4450 4451 402d7d 4450->4451 4452 402d83 MulDiv 4450->4452 4453 402d3d wsprintfW SetWindowTextW SetDlgItemTextW 4452->4453 4453->4451 4455 403985 4456 403990 4455->4456 4457 403994 4456->4457 4458 403997 GlobalAlloc 4456->4458 4458->4457 3208 402786 3209 40278d 3208->3209 3212 4029f7 3208->3212 3216 402ba2 3209->3216 3211 402798 3213 40279f SetFilePointer 3211->3213 3213->3212 3214 4027af 3213->3214 3219 4060c5 wsprintfW 3214->3219 3217 4061a0 18 API calls 3216->3217 3218 402bb6 3217->3218 3218->3211 3219->3212 4459 401907 4460 402bbf 18 API calls 4459->4460 4461 40190e 4460->4461 4462 4058c3 MessageBoxIndirectW 4461->4462 4463 401917 4462->4463 4464 401e08 4465 402bbf 18 API calls 4464->4465 4466 401e0e 4465->4466 4467 402bbf 18 API calls 4466->4467 4468 401e17 4467->4468 4469 402bbf 18 API calls 4468->4469 4470 401e20 4469->4470 4471 402bbf 18 API calls 4470->4471 4472 401e29 4471->4472 4473 401423 25 API calls 4472->4473 4474 401e30 ShellExecuteW 4473->4474 4475 401e61 4474->4475 3335 401389 3337 401390 3335->3337 3336 4013fe 3337->3336 3338 4013cb MulDiv SendMessageW 3337->3338 3338->3337 4481 404390 lstrlenW 4482 4043b1 WideCharToMultiByte 4481->4482 4483 4043af 4481->4483 4483->4482 4484 401491 4485 4052dd 25 API calls 4484->4485 4486 401498 4485->4486 4494 401a15 4495 402bbf 18 API calls 4494->4495 4496 401a1e ExpandEnvironmentStringsW 4495->4496 4497 401a32 4496->4497 4499 401a45 4496->4499 4498 401a37 lstrcmpW 4497->4498 4497->4499 4498->4499 4500 402515 4501 402bbf 18 API calls 4500->4501 4502 40251c 4501->4502 4505 405d53 GetFileAttributesW CreateFileW 4502->4505 4504 402528 4505->4504 4506 402095 4507 402bbf 18 API calls 4506->4507 4508 40209c 4507->4508 4509 402bbf 18 API calls 4508->4509 4510 4020a6 4509->4510 4511 402bbf 18 API calls 4510->4511 4512 4020b0 4511->4512 4513 402bbf 18 API calls 4512->4513 4514 4020ba 4513->4514 4515 402bbf 18 API calls 4514->4515 4517 4020c4 4515->4517 4516 402103 CoCreateInstance 4521 402122 4516->4521 4517->4516 4518 402bbf 18 API calls 4517->4518 4518->4516 4519 401423 25 API calls 4520 4021e1 4519->4520 4521->4519 4521->4520 4522 401b16 4523 402bbf 18 API calls 4522->4523 4524 401b1d 4523->4524 4525 402ba2 18 API calls 4524->4525 4526 401b26 wsprintfW 4525->4526 4527 402a4c 4526->4527 4528 404696 4529 4046a6 4528->4529 4530 4046cc 4528->4530 4532 404242 19 API calls 4529->4532 4531 4042a9 8 API calls 4530->4531 4533 4046d8 4531->4533 4534 4046b3 SetDlgItemTextW 4532->4534 4534->4530 4535 40159b 4536 402bbf 18 API calls 4535->4536 4537 4015a2 SetFileAttributesW 4536->4537 4538 4015b4 4537->4538 4539 40541c 4540 4055c6 4539->4540 4541 40543d GetDlgItem GetDlgItem GetDlgItem 4539->4541 4543 4055f7 4540->4543 4544 4055cf GetDlgItem CreateThread CloseHandle 4540->4544 4584 404277 SendMessageW 4541->4584 4546 405622 4543->4546 4547 405647 4543->4547 4548 40560e ShowWindow ShowWindow 4543->4548 4544->4543 4545 4054ad 4550 4054b4 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4545->4550 4549 405682 4546->4549 4552 405636 4546->4552 4553 40565c ShowWindow 4546->4553 4554 4042a9 8 API calls 4547->4554 4586 404277 SendMessageW 4548->4586 4549->4547 4559 405690 SendMessageW 4549->4559 4557 405522 4550->4557 4558 405506 SendMessageW SendMessageW 4550->4558 4560 40421b SendMessageW 4552->4560 4555 40567c 4553->4555 4556 40566e 4553->4556 4561 405655 4554->4561 4563 40421b SendMessageW 4555->4563 4562 4052dd 25 API calls 4556->4562 4564 405535 4557->4564 4565 405527 SendMessageW 4557->4565 4558->4557 4559->4561 4566 4056a9 CreatePopupMenu 4559->4566 4560->4547 4562->4555 4563->4549 4568 404242 19 API calls 4564->4568 4565->4564 4567 4061a0 18 API calls 4566->4567 4569 4056b9 AppendMenuW 4567->4569 4570 405545 4568->4570 4571 4056d6 GetWindowRect 4569->4571 4572 4056e9 TrackPopupMenu 4569->4572 4573 405582 GetDlgItem SendMessageW 4570->4573 4574 40554e ShowWindow 4570->4574 4571->4572 4572->4561 4576 405704 4572->4576 4573->4561 4575 4055a9 SendMessageW SendMessageW 4573->4575 4577 405571 4574->4577 4578 405564 ShowWindow 4574->4578 4575->4561 4579 405720 SendMessageW 4576->4579 4585 404277 SendMessageW 4577->4585 4578->4577 4579->4579 4580 40573d OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4579->4580 4582 405762 SendMessageW 4580->4582 4582->4582 4583 40578b GlobalUnlock SetClipboardData CloseClipboard 4582->4583 4583->4561 4584->4545 4585->4573 4586->4546 4587 401f1d 4588 402bbf 18 API calls 4587->4588 4589 401f24 4588->4589 4590 406558 5 API calls 4589->4590 4591 401f33 4590->4591 4592 401fb7 4591->4592 4593 401f4f GlobalAlloc 4591->4593 4593->4592 4594 401f63 4593->4594 4595 406558 5 API calls 4594->4595 4596 401f6a 4595->4596 4597 406558 5 API calls 4596->4597 4598 401f74 4597->4598 4598->4592 4602 4060c5 wsprintfW 4598->4602 4600 401fa9 4603 4060c5 wsprintfW 4600->4603 4602->4600 4603->4592 4604 40229d 4605 4022a5 4604->4605 4606 4022ab 4604->4606 4607 402bbf 18 API calls 4605->4607 4608 4022b9 4606->4608 4609 402bbf 18 API calls 4606->4609 4607->4606 4610 402bbf 18 API calls 4608->4610 4612 4022c7 4608->4612 4609->4608 4610->4612 4611 402bbf 18 API calls 4613 4022d0 WritePrivateProfileStringW 4611->4613 4612->4611 3840 40249e 3841 402cc9 19 API calls 3840->3841 3842 4024a8 3841->3842 3843 402ba2 18 API calls 3842->3843 3844 4024b1 3843->3844 3845 40281e 3844->3845 3846 4024d5 RegEnumValueW 3844->3846 3847 4024c9 RegEnumKeyW 3844->3847 3846->3845 3848 4024ee RegCloseKey 3846->3848 3847->3848 3848->3845 4614 40149e 4615 402288 4614->4615 4616 4014ac PostQuitMessage 4614->4616 4616->4615 3857 40231f 3858 402324 3857->3858 3859 40234f 3857->3859 3861 402cc9 19 API calls 3858->3861 3860 402bbf 18 API calls 3859->3860 3863 402356 3860->3863 3862 40232b 3861->3862 3864 402335 3862->3864 3868 40236c 3862->3868 3869 402bff RegOpenKeyExW 3863->3869 3865 402bbf 18 API calls 3864->3865 3866 40233c RegDeleteValueW RegCloseKey 3865->3866 3866->3868 3870 402c90 3869->3870 3874 402c2a 3869->3874 3870->3868 3871 402c50 RegEnumKeyW 3872 402c62 RegCloseKey 3871->3872 3871->3874 3875 406558 5 API calls 3872->3875 3873 402c87 RegCloseKey 3873->3870 3874->3871 3874->3872 3874->3873 3876 402bff 5 API calls 3874->3876 3877 402c72 3875->3877 3876->3874 3878 402c76 RegDeleteKeyExW 3877->3878 3879 402c9a 3877->3879 3878->3870 3879->3870 3880 402ca2 RegDeleteKeyW 3879->3880 3880->3870 3881 402cb2 3880->3881 3881->3870 4617 401ca3 4618 402ba2 18 API calls 4617->4618 4619 401ca9 IsWindow 4618->4619 4620 401a05 4619->4620 4621 402a27 SendMessageW 4622 402a41 InvalidateRect 4621->4622 4623 402a4c 4621->4623 4622->4623 3339 40242a 3350 402cc9 3339->3350 3341 402434 3342 402bbf 18 API calls 3341->3342 3343 40243d 3342->3343 3344 402448 RegQueryValueExW 3343->3344 3347 40281e 3343->3347 3345 402468 3344->3345 3346 40246e RegCloseKey 3344->3346 3345->3346 3354 4060c5 wsprintfW 3345->3354 3346->3347 3351 402bbf 18 API calls 3350->3351 3352 402ce2 3351->3352 3353 402cf0 RegOpenKeyExW 3352->3353 3353->3341 3354->3346 4631 40172d 4632 402bbf 18 API calls 4631->4632 4633 401734 SearchPathW 4632->4633 4634 40174f 4633->4634 4635 404a33 4636 404a43 4635->4636 4637 404a5f 4635->4637 4646 4058a7 GetDlgItemTextW 4636->4646 4639 404a92 4637->4639 4640 404a65 SHGetPathFromIDListW 4637->4640 4641 404a7c SendMessageW 4640->4641 4642 404a75 4640->4642 4641->4639 4644 40140b 2 API calls 4642->4644 4643 404a50 SendMessageW 4643->4637 4644->4641 4646->4643 4647 4027b4 4648 4027ba 4647->4648 4649 4027c2 FindClose 4648->4649 4650 402a4c 4648->4650 4649->4650 3509 4033b6 SetErrorMode GetVersion 3510 4033eb 3509->3510 3511 4033f1 3509->3511 3512 406558 5 API calls 3510->3512 3597 4064e8 GetSystemDirectoryW 3511->3597 3512->3511 3514 403407 lstrlenA 3514->3511 3515 403417 3514->3515 3600 406558 GetModuleHandleA 3515->3600 3518 406558 5 API calls 3519 403426 #17 OleInitialize SHGetFileInfoW 3518->3519 3606 40617e lstrcpynW 3519->3606 3521 403463 GetCommandLineW 3607 40617e lstrcpynW 3521->3607 3523 403475 GetModuleHandleW 3524 40348d 3523->3524 3525 405b5f CharNextW 3524->3525 3526 40349c CharNextW 3525->3526 3527 4035c6 GetTempPathW 3526->3527 3529 4034b5 3526->3529 3608 403385 3527->3608 3529->3529 3534 405b5f CharNextW 3529->3534 3540 4035af 3529->3540 3544 4035b1 3529->3544 3530 4035de 3531 4035e2 GetWindowsDirectoryW lstrcatW 3530->3531 3532 403638 DeleteFileW 3530->3532 3533 403385 12 API calls 3531->3533 3618 402e41 GetTickCount GetModuleFileNameW 3532->3618 3537 4035fe 3533->3537 3534->3529 3536 40364c 3538 403703 ExitProcess OleUninitialize 3536->3538 3541 4036ef 3536->3541 3546 405b5f CharNextW 3536->3546 3537->3532 3539 403602 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3537->3539 3542 403839 3538->3542 3543 403719 3538->3543 3545 403385 12 API calls 3539->3545 3540->3527 3648 4039c7 3541->3648 3550 403841 GetCurrentProcess OpenProcessToken 3542->3550 3551 4038bd ExitProcess 3542->3551 3549 4058c3 MessageBoxIndirectW 3543->3549 3705 40617e lstrcpynW 3544->3705 3552 403630 3545->3552 3563 40366b 3546->3563 3555 403727 ExitProcess 3549->3555 3556 403859 LookupPrivilegeValueW AdjustTokenPrivileges 3550->3556 3557 40388d 3550->3557 3552->3532 3552->3538 3556->3557 3558 406558 5 API calls 3557->3558 3559 403894 3558->3559 3562 4038a9 ExitWindowsEx 3559->3562 3566 4038b6 3559->3566 3560 4036c9 3565 405c3a 18 API calls 3560->3565 3561 40372f 3708 405846 3561->3708 3562->3551 3562->3566 3563->3560 3563->3561 3568 4036d5 3565->3568 3721 40140b 3566->3721 3568->3538 3706 40617e lstrcpynW 3568->3706 3570 403750 lstrcatW lstrcmpiW 3570->3538 3572 40376c 3570->3572 3571 403745 lstrcatW 3571->3570 3574 403771 3572->3574 3575 403778 3572->3575 3711 4057ac CreateDirectoryW 3574->3711 3716 405829 CreateDirectoryW 3575->3716 3576 4036e4 3707 40617e lstrcpynW 3576->3707 3581 40377d SetCurrentDirectoryW 3582 403798 3581->3582 3583 40378d 3581->3583 3720 40617e lstrcpynW 3582->3720 3719 40617e lstrcpynW 3583->3719 3586 4061a0 18 API calls 3587 4037d7 DeleteFileW 3586->3587 3588 4037e4 CopyFileW 3587->3588 3594 4037a6 3587->3594 3588->3594 3589 40382d 3591 40601f 38 API calls 3589->3591 3590 40601f 38 API calls 3590->3594 3592 403834 3591->3592 3592->3538 3593 4061a0 18 API calls 3593->3594 3594->3586 3594->3589 3594->3590 3594->3593 3595 40585e 2 API calls 3594->3595 3596 403818 CloseHandle 3594->3596 3595->3594 3596->3594 3598 40650a wsprintfW LoadLibraryExW 3597->3598 3598->3514 3601 406574 3600->3601 3602 40657e GetProcAddress 3600->3602 3603 4064e8 3 API calls 3601->3603 3604 40341f 3602->3604 3605 40657a 3603->3605 3604->3518 3605->3602 3605->3604 3606->3521 3607->3523 3609 406412 5 API calls 3608->3609 3611 403391 3609->3611 3610 40339b 3610->3530 3611->3610 3612 405b32 3 API calls 3611->3612 3613 4033a3 3612->3613 3614 405829 2 API calls 3613->3614 3615 4033a9 3614->3615 3616 405d82 2 API calls 3615->3616 3617 4033b4 3616->3617 3617->3530 3724 405d53 GetFileAttributesW CreateFileW 3618->3724 3620 402e84 3647 402e91 3620->3647 3725 40617e lstrcpynW 3620->3725 3622 402ea7 3623 405b7e 2 API calls 3622->3623 3624 402ead 3623->3624 3726 40617e lstrcpynW 3624->3726 3626 402eb8 GetFileSize 3627 402fb9 3626->3627 3645 402ecf 3626->3645 3628 402d9f 33 API calls 3627->3628 3630 402fc0 3628->3630 3629 403358 ReadFile 3629->3645 3632 402ffc GlobalAlloc 3630->3632 3630->3647 3728 40336e SetFilePointer 3630->3728 3631 403054 3634 402d9f 33 API calls 3631->3634 3633 403013 3632->3633 3639 405d82 2 API calls 3633->3639 3634->3647 3636 402fdd 3637 403358 ReadFile 3636->3637 3640 402fe8 3637->3640 3638 402d9f 33 API calls 3638->3645 3641 403024 CreateFileW 3639->3641 3640->3632 3640->3647 3642 40305e 3641->3642 3641->3647 3727 40336e SetFilePointer 3642->3727 3644 40306c 3646 4030e7 45 API calls 3644->3646 3645->3627 3645->3629 3645->3631 3645->3638 3645->3647 3646->3647 3647->3536 3649 406558 5 API calls 3648->3649 3650 4039db 3649->3650 3651 4039e1 3650->3651 3652 4039f3 3650->3652 3738 4060c5 wsprintfW 3651->3738 3653 40604b 3 API calls 3652->3653 3654 403a23 3653->3654 3655 403a42 lstrcatW 3654->3655 3657 40604b 3 API calls 3654->3657 3658 4039f1 3655->3658 3657->3655 3729 403c9d 3658->3729 3661 405c3a 18 API calls 3662 403a74 3661->3662 3663 403b08 3662->3663 3665 40604b 3 API calls 3662->3665 3664 405c3a 18 API calls 3663->3664 3666 403b0e 3664->3666 3667 403aa6 3665->3667 3668 403b1e LoadImageW 3666->3668 3671 4061a0 18 API calls 3666->3671 3667->3663 3674 403ac7 lstrlenW 3667->3674 3678 405b5f CharNextW 3667->3678 3669 403bc4 3668->3669 3670 403b45 RegisterClassW 3668->3670 3673 40140b 2 API calls 3669->3673 3672 403b7b SystemParametersInfoW CreateWindowExW 3670->3672 3681 4036ff 3670->3681 3671->3668 3672->3669 3677 403bca 3673->3677 3675 403ad5 lstrcmpiW 3674->3675 3676 403afb 3674->3676 3675->3676 3680 403ae5 GetFileAttributesW 3675->3680 3682 405b32 3 API calls 3676->3682 3677->3681 3684 403c9d 19 API calls 3677->3684 3679 403ac4 3678->3679 3679->3674 3683 403af1 3680->3683 3681->3538 3685 403b01 3682->3685 3683->3676 3686 405b7e 2 API calls 3683->3686 3687 403bdb 3684->3687 3739 40617e lstrcpynW 3685->3739 3686->3676 3689 403be7 ShowWindow 3687->3689 3690 403c6a 3687->3690 3692 4064e8 3 API calls 3689->3692 3740 4053b0 OleInitialize 3690->3740 3694 403bff 3692->3694 3693 403c70 3695 403c74 3693->3695 3696 403c8c 3693->3696 3697 403c0d GetClassInfoW 3694->3697 3701 4064e8 3 API calls 3694->3701 3695->3681 3703 40140b 2 API calls 3695->3703 3700 40140b 2 API calls 3696->3700 3698 403c21 GetClassInfoW RegisterClassW 3697->3698 3699 403c37 DialogBoxParamW 3697->3699 3698->3699 3702 40140b 2 API calls 3699->3702 3700->3681 3701->3697 3704 403c5f 3702->3704 3703->3681 3704->3681 3705->3540 3706->3576 3707->3541 3709 406558 5 API calls 3708->3709 3710 403734 lstrcatW 3709->3710 3710->3570 3710->3571 3712 4057fd GetLastError 3711->3712 3713 403776 3711->3713 3712->3713 3714 40580c SetFileSecurityW 3712->3714 3713->3581 3714->3713 3715 405822 GetLastError 3714->3715 3715->3713 3717 405839 3716->3717 3718 40583d GetLastError 3716->3718 3717->3581 3718->3717 3719->3582 3720->3594 3722 401389 2 API calls 3721->3722 3723 401420 3722->3723 3723->3551 3724->3620 3725->3622 3726->3626 3727->3644 3728->3636 3730 403cb1 3729->3730 3747 4060c5 wsprintfW 3730->3747 3732 403d22 3733 4061a0 18 API calls 3732->3733 3734 403d2e SetWindowTextW 3733->3734 3735 403a52 3734->3735 3736 403d4a 3734->3736 3735->3661 3736->3735 3737 4061a0 18 API calls 3736->3737 3737->3736 3738->3658 3739->3663 3748 40428e 3740->3748 3742 4053d3 3746 4053fa 3742->3746 3751 401389 3742->3751 3743 40428e SendMessageW 3744 40540c OleUninitialize 3743->3744 3744->3693 3746->3743 3747->3732 3749 4042a6 3748->3749 3750 404297 SendMessageW 3748->3750 3749->3742 3750->3749 3753 401390 3751->3753 3752 4013fe 3752->3742 3753->3752 3754 4013cb MulDiv SendMessageW 3753->3754 3754->3753 3755 402537 3756 402562 3755->3756 3757 40254b 3755->3757 3759 402596 3756->3759 3760 402567 3756->3760 3758 402ba2 18 API calls 3757->3758 3765 402552 3758->3765 3762 402bbf 18 API calls 3759->3762 3761 402bbf 18 API calls 3760->3761 3763 40256e WideCharToMultiByte lstrlenA 3761->3763 3764 40259d lstrlenW 3762->3764 3763->3765 3764->3765 3766 4025e0 3765->3766 3767 4025d2 3765->3767 3769 4025c3 3765->3769 3768 405e05 WriteFile 3767->3768 3768->3766 3772 405e34 SetFilePointer 3769->3772 3773 405e50 3772->3773 3774 4025ca 3772->3774 3775 405dd6 ReadFile 3773->3775 3774->3766 3774->3767 3776 405e5c 3775->3776 3776->3774 3777 405e75 SetFilePointer 3776->3777 3778 405e9d SetFilePointer 3776->3778 3777->3778 3779 405e80 3777->3779 3778->3774 3780 405e05 WriteFile 3779->3780 3780->3774 3781 401b37 3782 401b44 3781->3782 3783 401b88 3781->3783 3786 401bcd 3782->3786 3791 401b5b 3782->3791 3784 401bb2 GlobalAlloc 3783->3784 3785 401b8d 3783->3785 3788 4061a0 18 API calls 3784->3788 3799 402288 3785->3799 3802 40617e lstrcpynW 3785->3802 3787 4061a0 18 API calls 3786->3787 3786->3799 3789 402282 3787->3789 3788->3786 3794 4058c3 MessageBoxIndirectW 3789->3794 3800 40617e lstrcpynW 3791->3800 3792 401b9f GlobalFree 3792->3799 3794->3799 3795 401b6a 3801 40617e lstrcpynW 3795->3801 3797 401b79 3803 40617e lstrcpynW 3797->3803 3800->3795 3801->3797 3802->3792 3803->3799 4651 4014b8 4652 4014be 4651->4652 4653 401389 2 API calls 4652->4653 4654 4014c6 4653->4654 3810 4015b9 3811 402bbf 18 API calls 3810->3811 3812 4015c0 3811->3812 3813 405bdd 4 API calls 3812->3813 3825 4015c9 3813->3825 3814 401629 3816 40165b 3814->3816 3817 40162e 3814->3817 3815 405b5f CharNextW 3815->3825 3819 401423 25 API calls 3816->3819 3818 401423 25 API calls 3817->3818 3820 401635 3818->3820 3827 401653 3819->3827 3829 40617e lstrcpynW 3820->3829 3822 405829 2 API calls 3822->3825 3823 405846 5 API calls 3823->3825 3824 401642 SetCurrentDirectoryW 3824->3827 3825->3814 3825->3815 3825->3822 3825->3823 3826 40160f GetFileAttributesW 3825->3826 3828 4057ac 4 API calls 3825->3828 3826->3825 3828->3825 3829->3824 4662 40293b 4663 402ba2 18 API calls 4662->4663 4664 402941 4663->4664 4665 402964 4664->4665 4666 40297d 4664->4666 4672 40281e 4664->4672 4667 402969 4665->4667 4668 40297a 4665->4668 4669 402993 4666->4669 4670 402987 4666->4670 4676 40617e lstrcpynW 4667->4676 4677 4060c5 wsprintfW 4668->4677 4671 4061a0 18 API calls 4669->4671 4673 402ba2 18 API calls 4670->4673 4671->4672 4673->4672 4676->4672 4677->4672

                                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                                        Function 004033B6 Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 401stringfilecomCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 0 4033b6-4033e9 SetErrorMode GetVersion 1 4033eb-4033f3 call 406558 0->1 2 4033fc 0->2 1->2 7 4033f5 1->7 4 403401-403415 call 4064e8 lstrlenA 2->4 9 403417-40348b call 406558 * 2 #17 OleInitialize SHGetFileInfoW call 40617e GetCommandLineW call 40617e GetModuleHandleW 4->9 7->2 18 403495-4034af call 405b5f CharNextW 9->18 19 40348d-403494 9->19 22 4034b5-4034bb 18->22 23 4035c6-4035e0 GetTempPathW call 403385 18->23 19->18 25 4034c4-4034c8 22->25 26 4034bd-4034c2 22->26 32 4035e2-403600 GetWindowsDirectoryW lstrcatW call 403385 23->32 33 403638-403652 DeleteFileW call 402e41 23->33 28 4034ca-4034ce 25->28 29 4034cf-4034d3 25->29 26->25 26->26 28->29 30 403592-40359f call 405b5f 29->30 31 4034d9-4034df 29->31 51 4035a1-4035a2 30->51 52 4035a3-4035a9 30->52 34 4034e1-4034e9 31->34 35 4034fa-403533 31->35 32->33 50 403602-403632 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403385 32->50 46 403703-403713 ExitProcess OleUninitialize 33->46 47 403658-40365e 33->47 40 4034f0 34->40 41 4034eb-4034ee 34->41 42 403550-40358a 35->42 43 403535-40353a 35->43 40->35 41->35 41->40 42->30 49 40358c-403590 42->49 43->42 48 40353c-403544 43->48 56 403839-40383f 46->56 57 403719-403729 call 4058c3 ExitProcess 46->57 54 4036f3-4036fa call 4039c7 47->54 55 403664-40366f call 405b5f 47->55 58 403546-403549 48->58 59 40354b 48->59 49->30 60 4035b1-4035bf call 40617e 49->60 50->33 50->46 51->52 52->22 53 4035af 52->53 62 4035c4 53->62 71 4036ff 54->71 77 403671-4036a6 55->77 78 4036bd-4036c7 55->78 67 403841-403857 GetCurrentProcess OpenProcessToken 56->67 68 4038bd-4038c5 56->68 58->42 58->59 59->42 60->62 62->23 75 403859-403887 LookupPrivilegeValueW AdjustTokenPrivileges 67->75 76 40388d-40389b call 406558 67->76 72 4038c7 68->72 73 4038cb-4038cf ExitProcess 68->73 71->46 72->73 75->76 84 4038a9-4038b4 ExitWindowsEx 76->84 85 40389d-4038a7 76->85 81 4036a8-4036ac 77->81 82 4036c9-4036d7 call 405c3a 78->82 83 40372f-403743 call 405846 lstrcatW 78->83 86 4036b5-4036b9 81->86 87 4036ae-4036b3 81->87 82->46 98 4036d9-4036ef call 40617e * 2 82->98 96 403750-40376a lstrcatW lstrcmpiW 83->96 97 403745-40374b lstrcatW 83->97 84->68 90 4038b6-4038b8 call 40140b 84->90 85->84 85->90 86->81 91 4036bb 86->91 87->86 87->91 90->68 91->78 96->46 99 40376c-40376f 96->99 97->96 98->54 101 403771-403776 call 4057ac 99->101 102 403778 call 405829 99->102 109 40377d-40378b SetCurrentDirectoryW 101->109 102->109 110 403798-4037c1 call 40617e 109->110 111 40378d-403793 call 40617e 109->111 115 4037c6-4037e2 call 4061a0 DeleteFileW 110->115 111->110 118 403823-40382b 115->118 119 4037e4-4037f4 CopyFileW 115->119 118->115 120 40382d-403834 call 40601f 118->120 119->118 121 4037f6-403816 call 40601f call 4061a0 call 40585e 119->121 120->46 121->118 130 403818-40381f CloseHandle 121->130 130->118
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetErrorMode.KERNELBASE ref: 004033D9
                                                                                                                                                                                                                                        • GetVersion.KERNEL32 ref: 004033DF
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
                                                                                                                                                                                                                                        • #17.COMCTL32(00000007,00000009), ref: 0040342B
                                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 00403432
                                                                                                                                                                                                                                        • SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
                                                                                                                                                                                                                                        • GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
                                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000), ref: 00403476
                                                                                                                                                                                                                                        • CharNextW.USER32(00000000,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000020), ref: 0040349D
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000400,00437800), ref: 004035D7
                                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(00437800,000003FB), ref: 004035E8
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437800,\Temp), ref: 004035F4
                                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp), ref: 00403608
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437800,Low), ref: 00403610
                                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low), ref: 00403621
                                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TMP,00437800), ref: 00403629
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(00437000), ref: 0040363D
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32(?), ref: 00403703
                                                                                                                                                                                                                                        • OleUninitialize.OLE32(?), ref: 00403708
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403729
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437800,~nsu), ref: 0040373C
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437800,0040A328), ref: 0040374B
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437800,.tmp), ref: 00403756
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 00403762
                                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(00437800,00437800), ref: 0040377E
                                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
                                                                                                                                                                                                                                        • CopyFileW.KERNEL32(C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
                                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
                                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
                                                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
                                                                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 00403887
                                                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
                                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 004038CF
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$.tmp$C:\Program Files (x86)\TeamViewer$C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                                        • API String ID: 354199918-2060707457
                                                                                                                                                                                                                                        • Opcode ID: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
                                                                                                                                                                                                                                        • Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 338 40596f-405995 call 405c3a 341 405997-4059a9 DeleteFileW 338->341 342 4059ae-4059b5 338->342 343 405b2b-405b2f 341->343 344 4059b7-4059b9 342->344 345 4059c8-4059d8 call 40617e 342->345 346 405ad9-405ade 344->346 347 4059bf-4059c2 344->347 351 4059e7-4059e8 call 405b7e 345->351 352 4059da-4059e5 lstrcatW 345->352 346->343 349 405ae0-405ae3 346->349 347->345 347->346 353 405ae5-405aeb 349->353 354 405aed-405af5 call 4064c1 349->354 355 4059ed-4059f1 351->355 352->355 353->343 354->343 362 405af7-405b0b call 405b32 call 405927 354->362 358 4059f3-4059fb 355->358 359 4059fd-405a03 lstrcatW 355->359 358->359 361 405a08-405a24 lstrlenW FindFirstFileW 358->361 359->361 363 405a2a-405a32 361->363 364 405ace-405ad2 361->364 378 405b23-405b26 call 4052dd 362->378 379 405b0d-405b10 362->379 367 405a52-405a66 call 40617e 363->367 368 405a34-405a3c 363->368 364->346 366 405ad4 364->366 366->346 380 405a68-405a70 367->380 381 405a7d-405a88 call 405927 367->381 370 405ab1-405ac1 FindNextFileW 368->370 371 405a3e-405a46 368->371 370->363 377 405ac7-405ac8 FindClose 370->377 371->367 374 405a48-405a50 371->374 374->367 374->370 377->364 378->343 379->353 384 405b12-405b21 call 4052dd call 40601f 379->384 380->370 385 405a72-405a7b call 40596f 380->385 391 405aa9-405aac call 4052dd 381->391 392 405a8a-405a8d 381->392 384->343 385->370 391->370 394 405aa1-405aa7 392->394 395 405a8f-405a9f call 4052dd call 40601f 392->395 394->370 395->370
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,76233420,76232EE0,00000000), ref: 00405998
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Windows\TEMP\nscC342.tmp\*.*,\*.*), ref: 004059E0
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014), ref: 00405A03
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Windows\TEMP\nscC342.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405A09
                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(C:\Windows\TEMP\nscC342.tmp\*.*,?,?,?,0040A014,?,C:\Windows\TEMP\nscC342.tmp\*.*,?,?,76233420,76232EE0,00000000), ref: 00405A19
                                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
                                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405AC8
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Windows\TEMP\nscC342.tmp\*.*$\*.*
                                                                                                                                                                                                                                        • API String ID: 2035342205-2629438227
                                                                                                                                                                                                                                        • Opcode ID: fd57f151e8af197d71c8fed8a04c65ccd5cf3bf9c4040b497ebf2cee1ecae55f
                                                                                                                                                                                                                                        • Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fd57f151e8af197d71c8fed8a04c65ccd5cf3bf9c4040b497ebf2cee1ecae55f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 576 406846-40684b 577 4068bc-4068da 576->577 578 40684d-40687c 576->578 579 406eb2-406ec7 577->579 580 406883-406887 578->580 581 40687e-406881 578->581 585 406ee1-406ef7 579->585 586 406ec9-406edf 579->586 583 406889-40688d 580->583 584 40688f 580->584 582 406893-406896 581->582 587 4068b4-4068b7 582->587 588 406898-4068a1 582->588 583->582 584->582 589 406efa-406f01 585->589 586->589 592 406a89-406aa7 587->592 590 4068a3 588->590 591 4068a6-4068b2 588->591 593 406f03-406f07 589->593 594 406f28-406f34 589->594 590->591 597 40691c-40694a 591->597 595 406aa9-406abd 592->595 596 406abf-406ad1 592->596 598 4070b6-4070c0 593->598 599 406f0d-406f25 593->599 603 4066ca-4066d3 594->603 601 406ad4-406ade 595->601 596->601 604 406966-406980 597->604 605 40694c-406964 597->605 602 4070cc-4070df 598->602 599->594 608 406ae0 601->608 609 406a81-406a87 601->609 607 4070e4-4070e8 602->607 610 4070e1 603->610 611 4066d9 603->611 606 406983-40698d 604->606 605->606 613 406993 606->613 614 406904-40690a 606->614 630 406a66-406a7e 608->630 631 407068-407072 608->631 609->592 612 406a25-406a2f 609->612 610->607 616 4066e0-4066e4 611->616 617 406820-406841 611->617 618 406785-406789 611->618 619 4067f5-4067f9 611->619 626 407074-40707e 612->626 627 406a35-406bfe 612->627 636 407050-40705a 613->636 637 4068e9-406901 613->637 628 406910-406916 614->628 629 4069bd-4069c3 614->629 616->602 623 4066ea-4066f7 616->623 617->579 621 407035-40703f 618->621 622 40678f-4067a8 618->622 624 407044-40704e 619->624 625 4067ff-406813 619->625 621->602 632 4067ab-4067af 622->632 623->610 635 4066fd-406743 623->635 624->602 638 406816-40681e 625->638 626->602 627->603 628->597 633 406a21 628->633 629->633 634 4069c5-4069e3 629->634 630->609 631->602 632->618 640 4067b1-4067b7 632->640 633->612 641 4069e5-4069f9 634->641 642 4069fb-406a0d 634->642 643 406745-406749 635->643 644 40676b-40676d 635->644 636->602 637->614 638->617 638->619 645 4067e1-4067f3 640->645 646 4067b9-4067c0 640->646 647 406a10-406a1a 641->647 642->647 648 406754-406762 GlobalAlloc 643->648 649 40674b-40674e GlobalFree 643->649 650 40677b-406783 644->650 651 40676f-406779 644->651 645->638 652 4067c2-4067c5 GlobalFree 646->652 653 4067cb-4067db GlobalAlloc 646->653 647->629 654 406a1c 647->654 648->610 655 406768 648->655 649->648 650->632 651->650 651->651 652->653 653->610 653->645 657 4069a2-4069ba 654->657 658 40705c-407066 654->658 655->644 657->629 658->602
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
                                                                                                                                                                                                                                        • Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004064C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 659 4064c1-4064d5 FindFirstFileW 660 4064e2 659->660 661 4064d7-4064e0 FindClose 659->661 662 4064e4-4064e5 660->662 661->662
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405C83,00425F30,00425F30,00000000,00425F30,00425F30, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0), ref: 004064CC
                                                                                                                                                                                                                                        • FindClose.KERNELBASE(00000000), ref: 004064D8
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                        • String ID: xgB
                                                                                                                                                                                                                                        • API String ID: 2295610775-399326502
                                                                                                                                                                                                                                        • Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
                                                                                                                                                                                                                                        • Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                                                                        • Opcode ID: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
                                                                                                                                                                                                                                        • Instruction ID: ca82d2f7608ddbe9a9db451b4e667c54ef54e9945bbc135f2cbc761c4928cd6d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3CF08275600114DBC711EBE4DD49AAEB374FF00324F2045BBE105F31E1D7B499559B2A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004039C7 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 131 4039c7-4039df call 406558 134 4039e1-4039f1 call 4060c5 131->134 135 4039f3-403a2a call 40604b 131->135 143 403a4d-403a76 call 403c9d call 405c3a 134->143 139 403a42-403a48 lstrcatW 135->139 140 403a2c-403a3d call 40604b 135->140 139->143 140->139 149 403b08-403b10 call 405c3a 143->149 150 403a7c-403a81 143->150 156 403b12-403b19 call 4061a0 149->156 157 403b1e-403b43 LoadImageW 149->157 150->149 151 403a87-403aa1 call 40604b 150->151 155 403aa6-403aaf 151->155 155->149 160 403ab1-403ab5 155->160 156->157 158 403bc4-403bcc call 40140b 157->158 159 403b45-403b75 RegisterClassW 157->159 174 403bd6-403be1 call 403c9d 158->174 175 403bce-403bd1 158->175 162 403c93 159->162 163 403b7b-403bbf SystemParametersInfoW CreateWindowExW 159->163 165 403ac7-403ad3 lstrlenW 160->165 166 403ab7-403ac4 call 405b5f 160->166 167 403c95-403c9c 162->167 163->158 168 403ad5-403ae3 lstrcmpiW 165->168 169 403afb-403b03 call 405b32 call 40617e 165->169 166->165 168->169 173 403ae5-403aef GetFileAttributesW 168->173 169->149 177 403af1-403af3 173->177 178 403af5-403af6 call 405b7e 173->178 184 403be7-403c01 ShowWindow call 4064e8 174->184 185 403c6a-403c72 call 4053b0 174->185 175->167 177->169 177->178 178->169 192 403c03-403c08 call 4064e8 184->192 193 403c0d-403c1f GetClassInfoW 184->193 190 403c74-403c7a 185->190 191 403c8c-403c8e call 40140b 185->191 190->175 196 403c80-403c87 call 40140b 190->196 191->162 192->193 194 403c21-403c31 GetClassInfoW RegisterClassW 193->194 195 403c37-403c68 DialogBoxParamW call 40140b call 403917 193->195 194->195 195->167 196->175
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                          • Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00437000,00423728), ref: 00403A48
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,C:\Program Files (x86)\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,76233420), ref: 00403AC8
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,C:\Program Files (x86)\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(004281E0), ref: 00403AE6
                                                                                                                                                                                                                                        • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\TeamViewer), ref: 00403B2F
                                                                                                                                                                                                                                          • Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2
                                                                                                                                                                                                                                        • RegisterClassW.USER32(004291E0), ref: 00403B6C
                                                                                                                                                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
                                                                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 00403BEF
                                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
                                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
                                                                                                                                                                                                                                        • RegisterClassW.USER32(004291E0), ref: 00403C31
                                                                                                                                                                                                                                        • DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$(7B$.DEFAULT\Control Panel\International$.exe$C:\Program Files (x86)\TeamViewer$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                                        • API String ID: 1975747703-3031017473
                                                                                                                                                                                                                                        • Opcode ID: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
                                                                                                                                                                                                                                        • Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402E41 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203memoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 205 402e41-402e8f GetTickCount GetModuleFileNameW call 405d53 208 402e91-402e96 205->208 209 402e9b-402ec9 call 40617e call 405b7e call 40617e GetFileSize 205->209 210 4030e0-4030e4 208->210 217 402fb9-402fc7 call 402d9f 209->217 218 402ecf-402ee6 209->218 225 403098-40309d 217->225 226 402fcd-402fd0 217->226 220 402ee8 218->220 221 402eea-402ef7 call 403358 218->221 220->221 227 403054-40305c call 402d9f 221->227 228 402efd-402f03 221->228 225->210 229 402fd2-402fea call 40336e call 403358 226->229 230 402ffc-403048 GlobalAlloc call 406677 call 405d82 CreateFileW 226->230 227->225 231 402f83-402f87 228->231 232 402f05-402f1d call 405d0e 228->232 229->225 253 402ff0-402ff6 229->253 256 40304a-40304f 230->256 257 40305e-40308e call 40336e call 4030e7 230->257 236 402f90-402f96 231->236 237 402f89-402f8f call 402d9f 231->237 232->236 251 402f1f-402f26 232->251 244 402f98-402fa6 call 406609 236->244 245 402fa9-402fb3 236->245 237->236 244->245 245->217 245->218 251->236 255 402f28-402f2f 251->255 253->225 253->230 255->236 258 402f31-402f38 255->258 256->210 264 403093-403096 257->264 258->236 260 402f3a-402f41 258->260 260->236 262 402f43-402f63 260->262 262->225 265 402f69-402f6d 262->265 264->225 266 40309f-4030b0 264->266 267 402f75-402f7d 265->267 268 402f6f-402f73 265->268 269 4030b2 266->269 270 4030b8-4030bd 266->270 267->236 271 402f7f-402f81 267->271 268->217 268->267 269->270 272 4030be-4030c4 270->272 271->236 272->272 273 4030c6-4030de call 405d0e 272->273 273->210
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402E55
                                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,00000400), ref: 00402E71
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
                                                                                                                                                                                                                                        • GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
                                                                                                                                                                                                                                        • Null, xrefs: 00402F3A
                                                                                                                                                                                                                                        • Inst, xrefs: 00402F28
                                                                                                                                                                                                                                        • "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00402E41
                                                                                                                                                                                                                                        • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
                                                                                                                                                                                                                                        • soft, xrefs: 00402F31
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 00402E91
                                                                                                                                                                                                                                        • Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                                        • API String ID: 2803837635-429661633
                                                                                                                                                                                                                                        • Opcode ID: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
                                                                                                                                                                                                                                        • Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004061A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 276 4061a0-4061ab 277 4061ad-4061bc 276->277 278 4061be-4061d4 276->278 277->278 279 4061da-4061e7 278->279 280 4063ec-4063f2 278->280 279->280 283 4061ed-4061f4 279->283 281 4063f8-406403 280->281 282 4061f9-406206 280->282 285 406405-406409 call 40617e 281->285 286 40640e-40640f 281->286 282->281 284 40620c-406218 282->284 283->280 287 4063d9 284->287 288 40621e-40625a 284->288 285->286 290 4063e7-4063ea 287->290 291 4063db-4063e5 287->291 292 406260-40626b GetVersion 288->292 293 40637a-40637e 288->293 290->280 291->280 294 406285 292->294 295 40626d-406271 292->295 296 406380-406384 293->296 297 4063b3-4063b7 293->297 301 40628c-406293 294->301 295->294 298 406273-406277 295->298 299 406394-4063a1 call 40617e 296->299 300 406386-406392 call 4060c5 296->300 302 4063c6-4063d7 lstrlenW 297->302 303 4063b9-4063c1 call 4061a0 297->303 298->294 305 406279-40627d 298->305 314 4063a6-4063af 299->314 300->314 307 406295-406297 301->307 308 406298-40629a 301->308 302->280 303->302 305->294 310 40627f-406283 305->310 307->308 312 4062d6-4062d9 308->312 313 40629c-4062b9 call 40604b 308->313 310->301 315 4062e9-4062ec 312->315 316 4062db-4062e7 GetSystemDirectoryW 312->316 322 4062be-4062c2 313->322 314->302 318 4063b1 314->318 320 406357-406359 315->320 321 4062ee-4062fc GetWindowsDirectoryW 315->321 319 40635b-40635f 316->319 323 406372-406378 call 406412 318->323 319->323 324 406361-406365 319->324 320->319 326 4062fe-406308 320->326 321->320 322->324 327 4062c8-4062d1 call 4061a0 322->327 323->302 324->323 329 406367-40636d lstrcatW 324->329 331 406322-406338 SHGetSpecialFolderLocation 326->331 332 40630a-40630d 326->332 327->319 329->323 335 406353 331->335 336 40633a-406351 SHGetPathFromIDListW CoTaskMemFree 331->336 332->331 334 40630f-406320 332->334 334->319 334->331 335->320 336->319 336->335
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetVersion.KERNEL32(00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 00406263
                                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 004062E1
                                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(004281E0,00000400), ref: 004062F4
                                                                                                                                                                                                                                        • SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
                                                                                                                                                                                                                                        • SHGetPathFromIDListW.SHELL32(?,004281E0), ref: 0040633E
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(?), ref: 00406349
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 004063C7
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF
                                                                                                                                                                                                                                        • \Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
                                                                                                                                                                                                                                        • String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                                        • API String ID: 900638850-730719616
                                                                                                                                                                                                                                        • Opcode ID: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
                                                                                                                                                                                                                                        • Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 402 4064e8-406508 GetSystemDirectoryW 403 40650a 402->403 404 40650c-40650e 402->404 403->404 405 406510-406519 404->405 406 40651f-406521 404->406 405->406 407 40651b-40651d 405->407 408 406522-406555 wsprintfW LoadLibraryExW 406->408 407->408
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 0040653A
                                                                                                                                                                                                                                        • LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                                        • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                                        • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                                        • Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
                                                                                                                                                                                                                                        • Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402BFF Relevance: 9.1, APIs: 6, Instructions: 67registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 409 402bff-402c28 RegOpenKeyExW 410 402c93-402c97 409->410 411 402c2a-402c35 409->411 412 402c50-402c60 RegEnumKeyW 411->412 413 402c62-402c74 RegCloseKey call 406558 412->413 414 402c37-402c3a 412->414 422 402c76-402c85 RegDeleteKeyExW 413->422 423 402c9a-402ca0 413->423 415 402c87-402c8a RegCloseKey 414->415 416 402c3c-402c47 call 402bff 414->416 420 402c90-402c92 415->420 421 402c4c-402c4e 416->421 420->410 421->412 421->413 422->410 423->420 424 402ca2-402cb0 RegDeleteKeyW 423->424 424->420 425 402cb2 424->425 425->410
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
                                                                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?), ref: 00402C65
                                                                                                                                                                                                                                        • RegDeleteKeyExW.KERNELBASE(?,?,00000000,00000003), ref: 00402C83
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00402C8A
                                                                                                                                                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseDelete$EnumOpen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 345360480-0
                                                                                                                                                                                                                                        • Opcode ID: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
                                                                                                                                                                                                                                        • Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 426 401767-40178c call 402bbf call 405ba9 431 401796-4017a8 call 40617e call 405b32 lstrcatW 426->431 432 40178e-401794 call 40617e 426->432 437 4017ad-4017ae call 406412 431->437 432->437 441 4017b3-4017b7 437->441 442 4017b9-4017c3 call 4064c1 441->442 443 4017ea-4017ed 441->443 451 4017d5-4017e7 442->451 452 4017c5-4017d3 CompareFileTime 442->452 445 4017f5-401811 call 405d53 443->445 446 4017ef-4017f0 call 405d2e 443->446 453 401813-401816 445->453 454 401885-4018ae call 4052dd call 4030e7 445->454 446->445 451->443 452->451 455 401867-401871 call 4052dd 453->455 456 401818-401856 call 40617e * 2 call 4061a0 call 40617e call 4058c3 453->456 468 4018b0-4018b4 454->468 469 4018b6-4018c2 SetFileTime 454->469 466 40187a-401880 455->466 456->441 489 40185c-40185d 456->489 470 402a55 466->470 468->469 472 4018c8-4018d3 FindCloseChangeNotification 468->472 469->472 473 402a57-402a5b 470->473 475 4018d9-4018dc 472->475 476 402a4c-402a4f 472->476 477 4018f1-4018f4 call 4061a0 475->477 478 4018de-4018ef call 4061a0 lstrcatW 475->478 476->470 484 4018f9-40228d call 4058c3 477->484 478->484 484->473 484->476 489->466 490 40185f-401860 489->490 490->455
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00000000,00000000), ref: 004017A8
                                                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017CD
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1941528284-0
                                                                                                                                                                                                                                        • Opcode ID: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
                                                                                                                                                                                                                                        • Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405C3A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 492 405c3a-405c55 call 40617e call 405bdd 497 405c57-405c59 492->497 498 405c5b-405c68 call 406412 492->498 499 405cb3-405cb5 497->499 502 405c78-405c7c 498->502 503 405c6a-405c70 498->503 505 405c92-405c9b lstrlenW 502->505 503->497 504 405c72-405c76 503->504 504->497 504->502 506 405c9d-405cb1 call 405b32 GetFileAttributesW 505->506 507 405c7e-405c85 call 4064c1 505->507 506->499 512 405c87-405c8a 507->512 513 405c8c-405c8d call 405b7e 507->513 512->497 512->513 513->505
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405BEB
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405C93
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0), ref: 00405CA3
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                                        • String ID: 4#v.#v$0_B
                                                                                                                                                                                                                                        • API String ID: 3248276644-2013401392
                                                                                                                                                                                                                                        • Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
                                                                                                                                                                                                                                        • Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D82 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 515 405d82-405d8e 516 405d8f-405dc3 GetTickCount GetTempFileNameW 515->516 517 405dd2-405dd4 516->517 518 405dc5-405dc7 516->518 520 405dcc-405dcf 517->520 518->516 519 405dc9 518->519 519->520
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00405DA0
                                                                                                                                                                                                                                        • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,004033B4,00437000,00437800,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 00405DBB
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00405D82
                                                                                                                                                                                                                                        • nsa, xrefs: 00405D8F
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$nsa
                                                                                                                                                                                                                                        • API String ID: 1716503409-2804713399
                                                                                                                                                                                                                                        • Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
                                                                                                                                                                                                                                        • Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 521 40237b-4023c1 call 402cb4 call 402bbf * 2 RegCreateKeyExW 528 4023c7-4023cf 521->528 529 402a4c-402a5b 521->529 531 4023d1-4023de call 402bbf lstrlenW 528->531 532 4023e2-4023e5 528->532 531->532 534 4023f5-4023f8 532->534 535 4023e7-4023f4 call 402ba2 532->535 539 402409-40241d RegSetValueExW 534->539 540 4023fa-402404 call 4030e7 534->540 535->534 543 402422-4024fc RegCloseKey 539->543 544 40241f 539->544 540->539 543->529 544->543
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
                                                                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateValuelstrlen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1356686001-0
                                                                                                                                                                                                                                        • Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
                                                                                                                                                                                                                                        • Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 546 401e66-401e81 call 402bbf call 4052dd call 40585e 553 401e87-401e8a 546->553 554 40281e-402825 546->554 556 401edb-401ee4 FindCloseChangeNotification 553->556 557 401e8c-401e9c WaitForSingleObject 553->557 555 402a4c-402a5b 554->555 556->555 559 401eac-401eae 557->559 560 401eb0-401ec0 GetExitCodeProcess 559->560 561 401e9e-401eaa call 406594 WaitForSingleObject 559->561 563 401ec2-401ecd call 4060c5 560->563 564 401ecf-401ed2 560->564 561->559 563->556 564->556 567 401ed4 564->567 567->556
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                          • Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
                                                                                                                                                                                                                                          • Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894
                                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
                                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
                                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
                                                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401EDE
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$CloseObjectProcessSingleWaitlstrlen$ChangeCodeCreateExitFindHandleNotificationTextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2769198804-0
                                                                                                                                                                                                                                        • Opcode ID: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
                                                                                                                                                                                                                                        • Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004057AC Relevance: 6.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                                        control_flow_graph 570 4057ac-4057f7 CreateDirectoryW 571 4057f9-4057fb 570->571 572 4057fd-40580a GetLastError 570->572 573 405824-405826 571->573 572->573 574 40580c-405820 SetFileSecurityW 572->574 574->571 575 405822 GetLastError 574->575 575->573
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405803
                                                                                                                                                                                                                                        • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405822
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3449924974-0
                                                                                                                                                                                                                                        • Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
                                                                                                                                                                                                                                        • Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
                                                                                                                                                                                                                                        • Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
                                                                                                                                                                                                                                        • Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
                                                                                                                                                                                                                                        • Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
                                                                                                                                                                                                                                        • Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
                                                                                                                                                                                                                                        • Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
                                                                                                                                                                                                                                        • Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                        • Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
                                                                                                                                                                                                                                        • Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00403203
                                                                                                                                                                                                                                          • Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(0037CB24,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer$CountTick
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1092082344-0
                                                                                                                                                                                                                                        • Opcode ID: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
                                                                                                                                                                                                                                        • Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        • LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 334405425-0
                                                                                                                                                                                                                                        • Opcode ID: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
                                                                                                                                                                                                                                        • Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3109718747-0
                                                                                                                                                                                                                                        • Opcode ID: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
                                                                                                                                                                                                                                        • Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040604B Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,004281E0,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406075
                                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406096
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 004060B9
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                                                        • Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
                                                                                                                                                                                                                                        • Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
                                                                                                                                                                                                                                        • RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Enum$CloseOpenValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 167947723-0
                                                                                                                                                                                                                                        • Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
                                                                                                                                                                                                                                        • Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
                                                                                                                                                                                                                                          • Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47
                                                                                                                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
                                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
                                                                                                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1655745494-0
                                                                                                                                                                                                                                        • Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
                                                                                                                                                                                                                                        • Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004038D5 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038E7
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038FB
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • C:\Windows\TEMP\nscC342.tmp\, xrefs: 0040390B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                                        • String ID: C:\Windows\TEMP\nscC342.tmp\
                                                                                                                                                                                                                                        • API String ID: 2962429428-511017100
                                                                                                                                                                                                                                        • Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
                                                                                                                                                                                                                                        • Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                                        • Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
                                                                                                                                                                                                                                        • Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004015B9 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30, 4#v.#v,?,76232EE0,0040598F,?,76233420,76232EE0,00000000), ref: 00405BEB
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
                                                                                                                                                                                                                                          • Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612
                                                                                                                                                                                                                                          • Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF
                                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,00436000,?,00000000,000000F0), ref: 00401645
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1892508949-0
                                                                                                                                                                                                                                        • Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
                                                                                                                                                                                                                                        • Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
                                                                                                                                                                                                                                        • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3677997916-0
                                                                                                                                                                                                                                        • Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
                                                                                                                                                                                                                                        • Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                                        • Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
                                                                                                                                                                                                                                        • Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                          • Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
                                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00402347
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseDeleteOpenValue
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 849931509-0
                                                                                                                                                                                                                                        • Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
                                                                                                                                                                                                                                        • Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
                                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00406585
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
                                                                                                                                                                                                                                          • Part of subcall function 004064E8: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2547128583-0
                                                                                                                                                                                                                                        • Opcode ID: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
                                                                                                                                                                                                                                        • Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(?,76233420,00000000,76232EE0,00403909,00437800,00403708,?), ref: 0040394C
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00403953
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1100898210-0
                                                                                                                                                                                                                                        • Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
                                                                                                                                                                                                                                        • Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                                                        • Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
                                                                                                                                                                                                                                        • Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
                                                                                                                                                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                                                        • Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
                                                                                                                                                                                                                                        • Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(?,00000000,004033A9,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 0040582F
                                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0040583D
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                                                                        • Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
                                                                                                                                                                                                                                        • Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401B37 Relevance: 2.6, APIs: 2, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00401BA7
                                                                                                                                                                                                                                        • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Global$AllocFree
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3394109436-0
                                                                                                                                                                                                                                        • Opcode ID: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
                                                                                                                                                                                                                                        • Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401673 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MoveFileW.KERNEL32(00000000,00000000), ref: 0040168E
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileMove
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3562171763-0
                                                                                                                                                                                                                                        • Opcode ID: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
                                                                                                                                                                                                                                        • Instruction ID: f96437beda5fd31dd1875ddb5f908f1f3267c620ccf54a3d4895ce3c899c2c08
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 50F0B431604114D7CB20BF7A4F0DD5E32A59F82338B25437BF912B62E6DAFC8A41956E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004027CE Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,?,?), ref: 004027E2
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileFindNext
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2029273394-0
                                                                                                                                                                                                                                        • Opcode ID: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
                                                                                                                                                                                                                                        • Instruction ID: 03c77e44a5bd49d5adcbbbc7357f2d618ce2ff781a2b40b59b4f28f65829b406
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9E06576600115DBCB50DFD0DE48AAEB3B4AF04314F10447BD101F61D1E6F889519B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0
                                                                                                                                                                                                                                          • Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointerwsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 327478801-0
                                                                                                                                                                                                                                        • Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
                                                                                                                                                                                                                                        • Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040DA15,0040CED0,004032EF,0040CED0,0040DA15,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                                                                        • Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
                                                                                                                                                                                                                                        • Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                                                                        • Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
                                                                                                                                                                                                                                        • Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                                                        • Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
                                                                                                                                                                                                                                        • Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: PrivateProfileString
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1096422788-0
                                                                                                                                                                                                                                        • Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
                                                                                                                                                                                                                                        • Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040601F Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • MoveFileExW.KERNELBASE(?,?,00000005,00405B21,?,00000000,000000F1,?,?,?,?,?), ref: 00406029
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: lstrcpyW.KERNEL32(00426DC8,NUL), ref: 00405EBC
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: wsprintfA.USER32 ref: 00405F24
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
                                                                                                                                                                                                                                          • Part of subcall function 00405EAD: SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2305538632-0
                                                                                                                                                                                                                                        • Opcode ID: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
                                                                                                                                                                                                                                        • Instruction ID: 18bddb7de20ac1970eb55a3559b5efcfaddd6cd83010f6772ef5631c43e5a1b0
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CBD0C73124C601BFDB255B10DD0591B7BA5FB90355F11C43EF595900B2E7368461EF0D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                                        • Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
                                                                                                                                                                                                                                        • Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                        Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404C71
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404C7C
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
                                                                                                                                                                                                                                        • LoadBitmapW.USER32(0000006E), ref: 00404CD9
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
                                                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
                                                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00404D4F
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
                                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00404EA9
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
                                                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00405079
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00405089
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
                                                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00405228
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 00405233
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 0040523A
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                                                                        • API String ID: 1638840714-813528018
                                                                                                                                                                                                                                        • Opcode ID: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
                                                                                                                                                                                                                                        • Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 0040547A
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00405489
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 004054C6
                                                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000002), ref: 004054CD
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 00405569
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 0040558A
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00405498
                                                                                                                                                                                                                                          • Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004055DC
                                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004055F1
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00405615
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 0040561A
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 00405664
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
                                                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 004056A9
                                                                                                                                                                                                                                        • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
                                                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004056DD
                                                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
                                                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 0040573E
                                                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405744
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
                                                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 0040575A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
                                                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0040578E
                                                                                                                                                                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00405799
                                                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 0040579F
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                                        • String ID: (7B${
                                                                                                                                                                                                                                        • API String ID: 590372296-525222780
                                                                                                                                                                                                                                        • Opcode ID: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
                                                                                                                                                                                                                                        • Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
                                                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 00403DC3
                                                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 00403DD7
                                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00403E14
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
                                                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 00403E2F
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00403EDD
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00403EE7
                                                                                                                                                                                                                                        • SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
                                                                                                                                                                                                                                        • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00403FF8
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00404019
                                                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 0040402B
                                                                                                                                                                                                                                        • EnableWindow.USER32(?,?), ref: 00404046
                                                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
                                                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 00404063
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,00423728), ref: 004040CB
                                                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 004041FF
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                                                        • String ID: (7B
                                                                                                                                                                                                                                        • API String ID: 184305955-3251261122
                                                                                                                                                                                                                                        • Opcode ID: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
                                                                                                                                                                                                                                        • Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004043DF Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404491
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 004044BF
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 004044E0
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 0040455B
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000), ref: 00404562
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 0040458D
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
                                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 004045E1
                                                                                                                                                                                                                                        • ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
                                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00404602
                                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00404605
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
                                                                                                                                                                                                                                        • String ID: N$VC@$open
                                                                                                                                                                                                                                        • API String ID: 3615053054-3831744127
                                                                                                                                                                                                                                        • Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
                                                                                                                                                                                                                                        • Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                                        • DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                                                                        • Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
                                                                                                                                                                                                                                        • Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrcpyW.KERNEL32(00426DC8,NUL), ref: 00405EBC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
                                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9
                                                                                                                                                                                                                                          • Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
                                                                                                                                                                                                                                          • Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA
                                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
                                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00405F24
                                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
                                                                                                                                                                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0040600D
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
                                                                                                                                                                                                                                          • Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
                                                                                                                                                                                                                                        • String ID: %ls=%ls$NUL$[Rename]
                                                                                                                                                                                                                                        • API String ID: 222337774-899692902
                                                                                                                                                                                                                                        • Opcode ID: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
                                                                                                                                                                                                                                        • Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004046DD Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 0040472C
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 00404756
                                                                                                                                                                                                                                        • SHBrowseForFolderW.SHELL32(?), ref: 00404807
                                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00404812
                                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 00404844
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,004281E0), ref: 00404850
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862
                                                                                                                                                                                                                                          • Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharNextW.USER32(?,00000000,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
                                                                                                                                                                                                                                          • Part of subcall function 00406412: CharPrevW.USER32(?,?,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C
                                                                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
                                                                                                                                                                                                                                          • Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: (7B$A$C:\Program Files (x86)\TeamViewer
                                                                                                                                                                                                                                        • API String ID: 2624150263-2237299938
                                                                                                                                                                                                                                        • Opcode ID: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
                                                                                                                                                                                                                                        • Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 004042C6
                                                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 004042E2
                                                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 004042EE
                                                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 004042FA
                                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040430D
                                                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 0040431D
                                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00404337
                                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 00404341
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                                                        • Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
                                                                                                                                                                                                                                        • Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
                                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
                                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1
                                                                                                                                                                                                                                          • Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A
                                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                                        • String ID: 9
                                                                                                                                                                                                                                        • API String ID: 163830602-2366072709
                                                                                                                                                                                                                                        • Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
                                                                                                                                                                                                                                        • Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 004052DD Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00422708,00402E19), ref: 00405338
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2531174081-0
                                                                                                                                                                                                                                        • Opcode ID: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
                                                                                                                                                                                                                                        • Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00406412 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CharNextW.USER32(?,*?|<>/":,00000000,00000000,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
                                                                                                                                                                                                                                        • CharNextW.USER32(?,?,?,00000000), ref: 00406484
                                                                                                                                                                                                                                        • CharNextW.USER32(?,00000000,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
                                                                                                                                                                                                                                        • CharPrevW.USER32(?,?,76233420,00437800,"C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00406412
                                                                                                                                                                                                                                        • *?|<>/":, xrefs: 00406464
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                                                        • String ID: "C:\Program Files (x86)\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$*?|<>/":
                                                                                                                                                                                                                                        • API String ID: 589700163-1944370740
                                                                                                                                                                                                                                        • Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
                                                                                                                                                                                                                                        • Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
                                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 00402DD8
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00402E06
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19), ref: 00405338
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
                                                                                                                                                                                                                                          • Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398
                                                                                                                                                                                                                                        • CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
                                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 00402E38
                                                                                                                                                                                                                                          • Part of subcall function 00402D83: MulDiv.KERNEL32(00000000,00000064,000FCACD), ref: 00402D98
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                                                        • API String ID: 722711167-2449383134
                                                                                                                                                                                                                                        • Opcode ID: 8ee64202bb889ad073ab03690c1da717cfa73e4708a38b32ca01aecf011a85b8
                                                                                                                                                                                                                                        • Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ee64202bb889ad073ab03690c1da717cfa73e4708a38b32ca01aecf011a85b8
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
                                                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 00404BCA
                                                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00404BE4
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
                                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                                                        • Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
                                                                                                                                                                                                                                        • Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00402D56
                                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00402D66
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                                        • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                                                        • API String ID: 1451636040-1158693248
                                                                                                                                                                                                                                        • Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
                                                                                                                                                                                                                                        • Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
                                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 004028E9
                                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004028FC
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00402914
                                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 2667972263-0
                                                                                                                                                                                                                                        • Opcode ID: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
                                                                                                                                                                                                                                        • Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
                                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00404B43
                                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00423728), ref: 00404B56
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                                        • String ID: %u.%u%s%s$(7B
                                                                                                                                                                                                                                        • API String ID: 3540041739-1320723960
                                                                                                                                                                                                                                        • Opcode ID: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
                                                                                                                                                                                                                                        • Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00401D00
                                                                                                                                                                                                                                        • GetClientRect.USER32(00000000,?), ref: 00401D0D
                                                                                                                                                                                                                                        • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
                                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401D4B
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                                                        • Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
                                                                                                                                                                                                                                        • Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401D59
                                                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
                                                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
                                                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401D86
                                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3808545654-0
                                                                                                                                                                                                                                        • Opcode ID: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
                                                                                                                                                                                                                                        • Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
                                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                                        • Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
                                                                                                                                                                                                                                        • Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00405280
                                                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?), ref: 004052D1
                                                                                                                                                                                                                                          • Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                                        • Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
                                                                                                                                                                                                                                        • Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
                                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 00405894
                                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                                        • Error launching installer, xrefs: 00405871
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                                        • String ID: Error launching installer
                                                                                                                                                                                                                                        • API String ID: 3712363035-66219284
                                                                                                                                                                                                                                        • Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
                                                                                                                                                                                                                                        • Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                                        Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
                                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
                                                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
                                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA
                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                        • Source File: 00000011.00000002.2932944125.0000000000401000.00000020.00000001.01000000.00000021.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2932296800.0000000000400000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933414770.0000000000408000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000040A000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000425000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000427000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.000000000042C000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000430000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000435000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2933604530.0000000000438000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.0000000000485000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        • Associated: 00000011.00000002.2936839366.00000000004C7000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_400000_TeamViewer_.jbxd
                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                                                        • Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
                                                                                                                                                                                                                                        • Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8
                                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                                        Uniqueness Score: -1.00%